zeek-docs
zeek-docs copied to clipboard
Document Input Framework and zeek -r testing tricks
In reaction to: https://community.zeek.org/t/how-to-enrich-conn-logs-through-a-csv-file/7222/2
This is pretty tricky to be aware of unless you ran into it a few times. Unless we already have something in the docs (didn't find anything) appears valuable to document the continue/suspend pattern.