zeek/doc/frameworks/file_analysis_02.zeek
Patrick Kelley 8fd444092b initial
2025-05-07 15:35:15 -04:00

13 lines
327 B
Plaintext

event file_sniff(f: fa_file, meta: fa_metadata)
{
if ( ! meta?$mime_type ) return;
print "new file", f$id;
if ( meta$mime_type == "text/plain" )
Files::add_analyzer(f, Files::ANALYZER_MD5);
}
event file_hash(f: fa_file, kind: string, hash: string)
{
print "file_hash", f$id, kind, hash;
}