Analyze Error about tinycheck

[colder1989]

i think the problem might be zeek

[vollkorn1982]

Running into the same problem. It seems like the log file format of zeek has changed. The offending python code is checking trying to find tx_hosts in /tmp/<id>/assets/files.log, but that string isn't in there.

[vollkorn1982]

I changed lines 272 and 274 in /usr/share/tinycheck/analysis/classes/zeekengine.py like this:

          c = {"ip_dst": record["id.resp_h"],
                 ...
                 "port_dst": record["id.resp_p"],

Then I was able to run the analysis manually by calling sudo python3 /usr/share/tinycheck/analysis/analysis.py /tmp/<id>/ and found results in alerts.json.

I'll create a PR tomorrow.

EDIT: Fixed typo in code