corelight / corelight/json-streaming-logs

network_time should be current_time

Open
#8 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Zeek
Stars
31
Forks
11
PR merge metrics
No merged PRs in 30d

Description

https://github.com/corelight/json-streaming-logs/blob/4616cab465379c0f03807ebacc6ddf3701cb9703/scripts/main.zeek#L46

When running this script on a PCAP, the value for `_write_ts` will be the timestamp from the time of the packet in the PCAP and not the current time the log data is being written. According to the docs, [network_time](https://docs.zeek.org/en/master/scripts/base/bif/zeek.bif.zeek.html#id-network_time) should be used to get the time from the last processed packet. Instead, because the log file write time is not related to the time of the traffic, [current_time](https://docs.zeek.org/en/master/scripts/base/bif/zeek.bif.zeek.html#id-current_time) should be used.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.