Github user ottobackwards commented on a diff in the pull request:
https://github.com/apache/metron/pull/530#discussion_r121518286
--- Diff:
metron-extensions/metron-parser-extensions/metron-parser-bro-extension/metron-parser-bro/src/main/config/zookeeper/enrichments/bro.json
---
@@ -0,0 +1,17 @@
+{
+ "enrichment" : {
--- End diff --
This isn't really a where it is loaded problem. It is a production
deployment with no assumptions vs a default virtual box deployment or a 'demo'
environment. And the issue is not new to this PR. The pre-pr behavior
installs bro yaf and snort, and most likely has non-default things in there.
If it is OK with you, I think the Demo System Feature should be another jira.
The decision then is do we keep the status quo ante behavior wrt the default
bro, yaf and snort or not? I will remove the archetype enrichments.... or
maybe add a sample configurations resource... I want to think about it
I think we should add a specific 'demo' environment that installs the
non-default configurations, and etc. Explicitly the demo env as a feature.
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at [email protected] or file a JIRA ticket
with INFRA.
---
