[Zeek] Load Unload Script Signature RunTime

Jon Siwek jsiwek at corelight.com
Fri Apr 10 10:40:32 PDT 2020


On Thu, Apr 9, 2020 at 1:29 PM Vincenzo <vincyforce at gmail.com> wrote:
>
> Hi, is there a way to enable scripts or signatures in runtime, without doing zeekctl restart or zeekctl deploy?

For signatures: no, don't know (or never seen) a way to dynamically
enable/disable them at run-time

For scripts: also no direct/generic way to dynamically enable/disable,
but if you have control of the script, it's always possible to
conditionalize logic on some flag and then flip that flag state
whenever you want.

- Jon


More information about the Zeek mailing list