Add VLAN tags to all Bro logs
This script adds VLAN tags to all of the Bro logs that have the
bro-pkg refresh bro-pkg install corelight/log-add-vlan-everywhere
All Bro logs that contain connection information with the
should have fields that indicate VLAN tags (named
Potential Side Effects
There are potential side effects from loading this script if another script
is indexing tables based on the
c$id field. This generally is not done
in most modern scripts and is not done in the core Bro distribution anywhere.
This script tries to avoid potential trouble with this indexing issue by
only grabbing the VLAN information from the
event because any other script that uses
c$id for indexing would probably
always get the value that was collected already anyway.
If you think that this script is impacting any other script please reach out to us at email@example.com and let us know what script you think it might be impacting.
Nate Guagenti @neu5ron Seth Hall <firstname.lastname@example.org>