Re: [DISCUSS] Upgrading HBase and Kafka support

+1 to Docker and looking at testcontainers.org On Fri, Mar 8, 2019 at 3:03 PM Otto Fowler wrote: > https://github.com/apache/metron-bro-plugin-kafka/tree/master/docker > > > On March 8, 2019 at 14:28:20, zeo...@gmail.com (zeo...@gmail.com) wrote: > > So most importantly I want to make sure to

Re: [DISCUSS] Getting to a 1.0 release

+1 to separating developer docs and user docs. How should we approach that. Have a separate doc book? I haven’t had a ton of time to contribute to code lately but I’d be happy to help write some of these. On Sat, Aug 18, 2018 at 9:48 AM Nick Allen wrote: > Personally, I think the state of our

Re: Metron User Community Meeting Call

Thanks! I'll be there. Excited to hear Ahmed's successes and challenges. -Kyle On Thu, Jan 25, 2018 at 7:44 PM zeo...@gmail.com wrote: > Thanks Otto, I'm in to attend at that time/place. > > Jon > > On Thu, Jan 25, 2018, 14:45 Otto Fowler wrote: > >>

Re: [DISCUSS] Community Meetings

+1 Thanks for organizing, Otto! -Kyle On Thu, Dec 14, 2017 at 1:56 PM, zeo...@gmail.com wrote: > This sounds great Otto, thanks. > > Jon > > On Thu, Dec 14, 2017 at 11:24 AM Laurens Vets wrote: > > > > > Sounds good to me :) > > > > On 2017-12-14 05:59,

Re: [MENTORS][DISCUSS] Release Procedure + 'Kafka Plugin for Bro'

I agree with Justin. I suggest we move forward with option (a). I see it as simpler and more flexible moving forward. -Kyle On Thu, Dec 7, 2017 at 11:44 AM, Justin Leet wrote: > Do we have any further discussion on this? Pardon me if I misstate > anyone's position, but

Re: New PMC members

Congratulations guys! Well deserved. -Kyle On Thu, Dec 7, 2017 at 10:18 AM, Nick Allen wrote: > Congrats to all 3 for joining the PMC! > > On Thu, Dec 7, 2017 at 10:12 AM, Casey Stella wrote: > > > Well, obviously, I meant Metron instead of Impala. To

Re: Wiki Docs links seem wrong

Fixed. -Kyle On Thu, Dec 7, 2017 at 7:20 AM, Simon Elliston Ball < si...@simonellistonball.com> wrote: > https://cwiki.apache.org/confluence/display/METRON/ > Metron+User+Guide+-+per+release confluence/display/METRON/Metron+User+Guide+-+per+release> > > The links

Re: [DISCUSS] - Remove Kibana

as is rather than make a change that > doesn't simplify things in the end. > > On Nov 1, 2017 6:25 PM, "Kyle Richardson" <kylerichards...@gmail.com> > wrote: > > > I'll second Otto's suggestion. I like the idea of "splitting" the ES and > >

Re: [DISCUSS] - Remove Kibana

I'll second Otto's suggestion. I like the idea of "splitting" the ES and Kibana components from the pure Metron components. I suppose that would mean having two mpacks to build for a while though. I agree with others that, at least for now, Kibana is an integral part of the Metron user

Re: Stellar support for switch/case style conditionals

make sure this fits that paradigm. > > Casey > > > On Tue, Oct 24, 2017 at 11:34 AM, Kyle Richardson < > kylerichards...@gmail.com > > wrote: > > > I guess I read it as supporting both. As a user, I certainly would prefer > > to use the less explicit synta

Re: Stellar support for switch/case style conditionals

ax must be short-circuiting IMO. > > Casey > > On Tue, Oct 24, 2017 at 11:26 AM, Kyle Richardson < > kylerichards...@gmail.com > > wrote: > > > I like the way you have this laid out. Very useful to see it in test > cases. > > I'm +1 for this syntax additio

Re: Stellar support for switch/case style conditionals

I like the way you have this laid out. Very useful to see it in test cases. I'm +1 for this syntax addition. -Kyle On Mon, Oct 23, 2017 at 4:16 PM, Otto Fowler wrote: > What I would like to do for the first PR is introduce match with the > following syntax > > > match{

Re: [DISCUSS] Release Process Update

+1 I agree with Matt and Justin. The Travis build widget doesn't make sense in the published release documentation. No sense in fixing retrospectively. -Kyle On Mon, Oct 23, 2017 at 3:13 PM Matt Foley wrote: > I agree with Justin. This micro-feature is intended as a

Re: Can we close old inactive PR’s

I was wondering that too. There are quite a few that have had no response in a long time. -Kyle On Tue, Oct 17, 2017 at 9:00 AM, Otto Fowler wrote: > Can we close PR’s that are inactive for long periods of time, with no > response to queries? > > Looking at :

Re: ENRICHMENT_GET from REPL throwing exception

Thanks to Casey for some fast diagnosis on IRC. This is patched in master via METRON-1185 (PR#755). Updates to $METRON_HOME/bin/stellar from that PR fixed the issue. Thanks again! -Kyle On Tue, Oct 10, 2017 at 12:27 PM, Kyle Richardson <kylerichards...@gmail.com > wrote: > Ok

ENRICHMENT_GET from REPL throwing exception

Ok, so I've admittedly been absent for a while and may have missed a few things here and there, but I've run into an error that I'm looking for some input on. Might be a bug, might be user error. Short background info. I created and populated an HBase table called 'threatintel_ip' with IOCs that

Re: [DISCUSS] Community meeting on Tuesday, Sept.23 10AM PST

I've been stretched a little thin lately but am trying to jump back in. 2:30pm EDT works well for me too. -Kyle On Mon, Sep 25, 2017 at 8:38 PM, Otto Fowler wrote: > 11:30 your time. Sorry I have to pick my kids up from school. 2:30 mine. > > > On September 25, 2017

Re: [ANNOUNCE] Metron community meeting

Unfortunately I have a conflict. Will there be a recording posted afterward like previous meetings? -Kyle On Mon, Aug 21, 2017 at 10:35 AM Otto Fowler wrote: > Sounds good > > > On August 21, 2017 at 09:43:25, James Sirota (jsir...@apache.org) wrote: > > Hi Jon, > >

Re: [DISCUSS] Relocate Docker

I completely support the idea of moving metron-docker down in the tree. I do like the idea of a contrib/ area for things like this that are not as frequently updated or maintained. Are there any other pieces of the code base that would fit into this type of area? -Kyle On Thu, Jul 13, 2017 at

[REQUEST] Wiki Edit Rights

Could a PMC member please grant my account edit rights to the Metron space in Confluence? I'd like to start helping with the clean up efforts there. Thanks, Kyle

Re: Question about Metron-Docker

I use it occasionally. I like it for quickly testing parser tweaks. Unfortunately I've had zero time lately so haven't run it off master for a while. -Kyle > On Jun 28, 2017, at 11:10 AM, Otto Fowler wrote: > > Has anyone run it off master? > Is anyone using it? > >

Re: performance benchmarks on the asa parser

I like the pre-compile idea. One concern is I see the number of grok objects growing over time. This parser does not account for nearly all of the possible ASA message types, currently only the most common ones. Is there a middle ground implementation where we can compile on first use of a grok

Re: Infrastructure migrated

Thanks, Casey! -Kyle On Mon, May 15, 2017 at 10:02 AM, Otto Fowler wrote: > Thanks Casey. > > > On May 15, 2017 at 09:51:21, Casey Stella (ceste...@gmail.com) wrote: > > It appears that committers who are not PMC members did not have their > committer status migrated

Re: [DISCUSS] Code Style

+1 Thanks, Justin. I'm all for adopting the Google style guide. -Kyle On Mon, May 8, 2017 at 10:24 AM, Justin Leet wrote: > Sigh, the message was hidden below the fold. > > Part of what I've been playing around with is doing this. It's pretty easy > to set up both