Aw! Sorry to hear that. It's equally frustrating for us when people
run into problems that can't be fixed merely with scripts. Hopefully in
the future we'll have a better solution for you. Hopefull you can
figure out a different approach or some other script for the contest!
On 27 Aug 2019, at 22:01, Andrew Klaus wrote:
I was hoping to have a new Zeek script written for the Zeek contest,
doesn't look like modules that need source code modifications will be
On Tue, Aug 27, 2019 at 7:02 PM Seth Hall <seth(a)corelight.com> wrote:
> I believe that this isn't available since (as your already
> the analyzer strips whitespace. The only option would be to modify
> analyzer or write a new one.
> On 25 Aug 2019, at 0:32, Andrew Klaus wrote:
>> I'd like to write a script for HTTP requests, but I need the raw and
>> untruncated headers to do this. I can't seem to find an event that
>> give me this data to work with. I've looked at http_all_headers and
>> http_header, but they still strip whitespace.
>> Is there any (current) way of doing this? It'd be nice to be able to
>> this without having to modify the analyzer.
>> Zeek mailing list
> Seth Hall * Corelight, Inc * www.corelight.com
Seth Hall * Corelight, Inc * www.corelight.com