Github user ottobackwards commented on a diff in the pull request: https://github.com/apache/metron/pull/530#discussion_r121518286 --- Diff: metron-extensions/metron-parser-extensions/metron-parser-bro-extension/metron-parser-bro/src/main/config/zookeeper/enrichments/bro.json --- @@ -0,0 +1,17 @@ +{ + "enrichment" : { --- End diff -- This isn't really a where it is loaded problem. It is a production deployment with no assumptions vs a default virtual box deployment or a 'demo' environment. And the issue is not new to this PR. The pre-pr behavior installs bro yaf and snort, and most likely has non-default things in there. If it is OK with you, I think the Demo System Feature should be another jira. The decision then is do we keep the status quo ante behavior wrt the default bro, yaf and snort or not? I will remove the archetype enrichments.... or maybe add a sample configurations resource... I want to think about it I think we should add a specific 'demo' environment that installs the non-default configurations, and etc. Explicitly the demo env as a feature.
--- If your project is set up for it, you can reply to this email and have your reply appear on GitHub as well. If your project does not have this feature enabled and wishes so, or if the feature is enabled but not working, please contact infrastructure at infrastruct...@apache.org or file a JIRA ticket with INFRA. ---