Unknown MIME Type Discovery
This package is for Zeek to help network analysts improve Zeek
by using their network to discover unknown file types. It
does this by creating a log named
unknown_mime_type_discovery.log that will log a
configurable amount of data from the beginning of any files not
found to already have a file type detection signature in Zeek.
zkg refresh zkg install sethhall/unknown-mime-type-discovery
If you would like to log a different amount of the beginning of files
with unknown mime types you can use the following configuration option in `local.zeek` or another script you are loading. The default is to log 1000 bytes.
redef UnknownMimeTypeDiscovery::max_content_extraction = 250;