Can you convert to zeek

[blacktop]

Can you please convert from bro to zeek?

[hosom]

Yep! I'll work on this today.

Check out the zeek branch if you want to track the changes.

[hosom]

@blacktop Mind testing? I pushed a new version. This should now be compatible with zeek/zkg.

[blacktop]

Thank you!

When I ran I got the following:

$ docker run --rm -v `pwd`/pcap:/pcap blacktop/zeek:3.1.1 -F -r smallFlows.pcap local file-extraction/plugins/extract-all-files.zeek "Site::local_nets += { 192.168.5.0/24, 10.0.2.0/24 }"

zeek version 3.1.1
warning in /usr/local/zeek/share/zeek/site/file-extraction/plugins/../././file-extensions.zeek, lines 90-91: multiple initializations for index (text/rtf)

[hosom]

I know what the issue is... I'll fix it in the morning. I caused an issue implementing someone else's request.

[hosom]

Should be fixed now.

[blacktop]

works great thank you! 👍