macOS 10.14 zeek version 3.1.2 zeek/hosom/file-extraction (installed: 2.0.3) (

Thanks for the detailed report. You need to redef <code class="notra

Thanks <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-u

Storing extracted files by file hash name about file-extraction HOT 3 CLOSED

hosom commented on September 26, 2024

Storing extracted files by file hash name

from file-extraction.

hosom commented on September 26, 2024

Thanks for the detailed report.

You need to redef path to a valid value.

The check below prevents the rename from occurring if path hasn't been defined:

Lines 7 to 8 in a8f214c

 if ( !f$info?$extracted || !f$info?$md5 || FileExtraction::path == "" ) 

 return;

from file-extraction.

hosom commented on September 26, 2024

Let me know if that doesn't fix your issue and I'll be happy to take another look!

from file-extraction.

dspruell-s01 commented on September 26, 2024

Thanks @hosom, it looks like I missed that feedback from commentary on a previous issue.

I noticed that the requirement to redef path isn't mentioned in the package documentation:

I'm wondering though if setting path is required, or if a default can be applied. Is something like either of these feasible?

No default required, because an existing default from Zeek's FileExtract module results in files being written to ./extract_files/ -- so inherit FileExtract::prefix or similar
Change the FileExtraction explicit module level default to ./extract_files/ to be operational out of the box

Although (2) is just doing what (1) would do, just not the right way.

from file-extraction.

Recommend Projects