From 48d965f85cdcf4b0a4b7f27726313a7b0fa99818 Mon Sep 17 00:00:00 2001
From: Arne Welzel <arne.welzel@corelight.com>
Date: Mon, 28 Apr 2025 13:34:07 +0200
Subject: [PATCH] NEWS: Add HookPublishEvent() note

---
 NEWS | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/NEWS b/NEWS
index 2b92732fd7..4204851c6e 100644
--- a/NEWS
+++ b/NEWS
@@ -14,6 +14,21 @@ Breaking Changes
 New Functionality
 -----------------
 
+- A new plugin hook, ``HookPublishEvent()``, has been added for intercepting
+  publishing of Zeek events. This hook may be used for monitoring purposes,
+  modifying or rerouting remote events.
+
+  Plugins can implement and enable this hook by calling the following method
+  within their Configure() implementation.
+
+	EnableHook(HOOK_PUBLISH_EVENT)
+
+  The signature of ``HookPublishEvent()`` is as follows.
+
+	bool HookPublishEvent(zeek::cluster::Backend& backend,
+	                      const std::string& topic,
+	                      zeek::cluster::detail::Event& event);
+
 Changed Functionality
 ---------------------