mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 22:58:20 +00:00
c93b057a97
The default of "skip_processing_after_detection" is confusing and causes conn.log to not be written as one would assume, plus the counters are not incremented and thus some kinds of potential detections are short-changed. I propose adding "disable_analyzer_after_detection" which would react, on the surface, the same way by disabling the SSH analyzer, but allowing conn.log to be written appropriately. |
||
|---|---|---|
| .. | ||
| files | ||
| frameworks | ||
| misc | ||
| protocols | ||
| utils | ||
| init-bare.bro | ||
| init-default.bro | ||