Skip to content

Instantly share code, notes, and snippets.

@JustinAzoff

JustinAzoff/files-split-certs.bro

Created November 18, 2016 17:33
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save JustinAzoff/7a7d0fc2ce83e20ac56361b53154cefa to your computer and use it in GitHub Desktop.
Save JustinAzoff/7a7d0fc2ce83e20ac56361b53154cefa to your computer and use it in GitHub Desktop.
Download ZIP
Raw
files-split-certs.bro
event bro_init()
{
Log::remove_default_filter(Files::LOG);
Log::add_filter(Files::LOG, [
$name = "files-split",
$path_func(id: Log::ID, path: string, rec: Files::Info) = {
if (rec?$mime_type && rec$mime_type == "application/pkix-cert")
return "files_certs";
return "files";
}
]);
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment