Unknown MIME Type Discovery
This package is for Zeek to help network analysts improve Zeek
by using their network to discover unknown file types. It
does this by creating a log named
unknown_mime_type_discovery.log that will log a
configurable amount of data from the beginning of any files not
found to already have a file type detection signature in Zeek.
zkg refresh zkg install sethhall/unknown-mime-type-discovery
If you would like to log a different amount of the beginning of files with unknown mime types you can use the following configuration option in local.zeek or another script you are loading. The default is to log 1000 bytes.
redef UnknownMimeTypeDiscovery::max_content_extraction = 250;