-
Notifications
You must be signed in to change notification settings - Fork 136
Description
In discussing how to proceed with #1545, @mattnibs, @mason-fish, @nwt and I agreed on the plan to replace these three preferences:
...with a single Preference that the user could point at the pathname of a Brimcap config YAML file.
The Preference will start out blank. As long as it's blank, brimcap load will continue to be invoked the way it is today, which has the effect of brimcap load invoking the paths to the "stock" embedded Zeek+Suricata Runners and applying the default Suricata shaper. If the preference is populated with a valid path, the brimcap load command line instead should reference it via its -config option, and therefore whatever Zeek/Suricata/other analyzers and alternate shapers in the config YAML will be leveraged.
At one time we also discussed having an editor in the app so the user could directly edit the YAML config rather than just pointing at a path. However, the wider topic of having an editor in the app (#1521) has been waiting behind some other priorities, so for now the plan is to just point to the path.
