[Zeek] Load Unload Script Signature RunTime
jsiwek at corelight.com
Fri Apr 10 10:40:32 PDT 2020
On Thu, Apr 9, 2020 at 1:29 PM Vincenzo <vincyforce at gmail.com> wrote:
> Hi, is there a way to enable scripts or signatures in runtime, without doing zeekctl restart or zeekctl deploy?
For signatures: no, don't know (or never seen) a way to dynamically
enable/disable them at run-time
For scripts: also no direct/generic way to dynamically enable/disable,
but if you have control of the script, it's always possible to
conditionalize logic on some flag and then flip that flag state
whenever you want.
More information about the Zeek