dns.json.gz will not open

[zschmerber]

[philrz]

@zschmerber: It looks like you're trying to open it by clicking on it in macOS Finder. I'm not an expert with Finder, but it looks like it doesn't automatically recognize and unpack GZIP-compressed files such as this. I'd recommend dropping to the shell and running gunzip on it.

[zschmerber]

strange the other files work like the conn log

[zschmerber]

On a side note I am trying to get a large sample dataset list here for the OCSF. https://github.com/ocsf/examples/tree/main/raw_sample_log_dataset

[philrz]

Hmm. I'm on macOS as well and double-clicking the conn.json.gz in Finder gave me the same problem as you showed with dns.json.gz. Not sure why we'd have different experiences there.

Regarding your goal for a "large" sample dataset, as you probably saw in this repo's README, this particular set of logs is generated from a modest set of the WRCCDC pcaps so I don't think of it as particularly large. But we also have at times generated larger data sets from more of the pcaps. If you think that might suit your needs I could arrange to upload them somewhere for you. It might be best if you flag me down on our community Slack (I'm @Phil there) since it would probably be easier to discuss details that way rather than in Issue comments.