dfir

In a package of ours we are accessing a Broker::Store handle in a change handler. We got bitten by "invalid Broker store handle" when the change handler is invoked during/after shutdown.

Chatting with @rsmmr / @ckreibich about change handlers and broker stores, there was slight surprise to hear that these are invoked after zeek_done() and it was suggested to open a ticket.

The following re

https://github.com/google/timesketch/blob/fce0f54e20d9385b264f2401079dbeb5ad773a38/timesketch/frontend/src/components/Common/UploadForm.vue#L124

Uploading a foobar.txt file that has CSV content would still get uploaded and errored out on the backend side, even if the Client JS should error out already.

Request Method: POST
Status Code: 500 

I was wondering the benefit of using Modular File Management vs Single Config File Management? Why do you consider it easier to use multiple files and then compile? Trying to figure out what the best case is for my use case. Thanks. #