corelight / corelight/json-streaming-logs
network_time should be current_time
- Dominant language
- Zeek
- Stars
- 31
- Forks
- 11
- PR merge metrics
- No merged PRs in 30d
Description
https://github.com/corelight/json-streaming-logs/blob/4616cab465379c0f03807ebacc6ddf3701cb9703/scripts/main.zeek#L46
When running this script on a PCAP, the value for `_write_ts` will be the timestamp from the time of the packet in the PCAP and not the current time the log data is being written. According to the docs, [network_time](https://docs.zeek.org/en/master/scripts/base/bif/zeek.bif.zeek.html#id-network_time) should be used to get the time from the last processed packet. Instead, because the log file write time is not related to the time of the traffic, [current_time](https://docs.zeek.org/en/master/scripts/base/bif/zeek.bif.zeek.html#id-current_time) should be used.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.