Thanks Seth! I was hoping to have a new Zeek script written for the Zeek contest, but it doesn't look like modules that need source code modifications will be considered. Andrew On Tue, Aug 27, 2019 at 7:02 PM Seth Hall <seth(a)corelight.com> wrote: > I believe that this isn't available since (as your already > discovered), > the analyzer strips whitespace. The only option would be to modify > the > analyzer or write a new one. > > .Seth > > On 25 Aug 2019, at 0:32, Andrew Klaus wrote: > >> Hello, >> >> I'd like to write a script for HTTP requests, but I need the raw and >> untruncated headers to do this. I can't seem to find an event that >> will >> give me this data to work with. I've looked at http_all_headers and >> http_header, but they still strip whitespace. >> >> Is there any (current) way of doing this? It'd be nice to be able to >> do >> this without having to modify the analyzer. >> >> Thanks! >> Andrew >> _______________________________________________ >> Zeek mailing list >> zeek(a)zeek.org >> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek > > -- > Seth Hall * Corelight, Inc * www.corelight.com >