diff --git a/src/Sessions.cc b/src/Sessions.cc
index 858d71b4db..ba8231d369 100644
--- a/src/Sessions.cc
+++ b/src/Sessions.cc
@@ -1,6 +1,5 @@
 // See the file "COPYING" in the main distribution directory for copyright.
 
-
 #include "zeek-config.h"
 #include "zeek/Sessions.h"
 
diff --git a/src/analyzer/protocol/ayiya/AYIYA.h b/src/analyzer/protocol/ayiya/AYIYA.h
index c59458075e..916a88f504 100644
--- a/src/analyzer/protocol/ayiya/AYIYA.h
+++ b/src/analyzer/protocol/ayiya/AYIYA.h
@@ -1,6 +1,6 @@
 #pragma once
 
-#include "ayiya_pac.h"
+#include "analyzer/protocol/ayiya/ayiya_pac.h"
 
 namespace binpac::AYIYA { class AYIYA_Conn; }
 
diff --git a/src/analyzer/protocol/bittorrent/BitTorrent.cc b/src/analyzer/protocol/bittorrent/BitTorrent.cc
index 50cb9cdb72..1d09dfdf98 100644
--- a/src/analyzer/protocol/bittorrent/BitTorrent.cc
+++ b/src/analyzer/protocol/bittorrent/BitTorrent.cc
@@ -3,7 +3,7 @@
 #include "zeek/analyzer/protocol/bittorrent/BitTorrent.h"
 #include "zeek/analyzer/protocol/tcp/TCP_Reassembler.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/bittorrent/events.bif.h"
 
 namespace zeek::analyzer::bittorrent {
 
diff --git a/src/analyzer/protocol/bittorrent/BitTorrent.h b/src/analyzer/protocol/bittorrent/BitTorrent.h
index 217c8a932c..9060a62f78 100644
--- a/src/analyzer/protocol/bittorrent/BitTorrent.h
+++ b/src/analyzer/protocol/bittorrent/BitTorrent.h
@@ -4,7 +4,7 @@
 
 #include "zeek/analyzer/protocol/tcp/TCP.h"
 
-#include "bittorrent_pac.h"
+#include "analyzer/protocol/bittorrent/bittorrent_pac.h"
 
 namespace zeek::analyzer::bittorrent {
 
diff --git a/src/analyzer/protocol/bittorrent/BitTorrentTracker.cc b/src/analyzer/protocol/bittorrent/BitTorrentTracker.cc
index cf76e07fae..803b5d09c3 100644
--- a/src/analyzer/protocol/bittorrent/BitTorrentTracker.cc
+++ b/src/analyzer/protocol/bittorrent/BitTorrentTracker.cc
@@ -8,7 +8,7 @@
 
 #include "zeek/analyzer/protocol/tcp/TCP_Reassembler.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/bittorrent/events.bif.h"
 
 # define FMT_INT "%" PRId64
 # define FMT_UINT "%" PRIu64
diff --git a/src/analyzer/protocol/bittorrent/bittorrent.pac b/src/analyzer/protocol/bittorrent/bittorrent.pac
index dbf0efecf1..eb2fe7e579 100644
--- a/src/analyzer/protocol/bittorrent/bittorrent.pac
+++ b/src/analyzer/protocol/bittorrent/bittorrent.pac
@@ -6,7 +6,7 @@
 %extern{
 #define MSGLEN_LIMIT 0x40000
 
-#include "events.bif.h"
+#include "analyzer/protocol/bittorrent/events.bif.h"
 %}
 
 analyzer BitTorrent withcontext {
diff --git a/src/analyzer/protocol/conn-size/ConnSize.cc b/src/analyzer/protocol/conn-size/ConnSize.cc
index 8f234c52c7..98acb55f1e 100644
--- a/src/analyzer/protocol/conn-size/ConnSize.cc
+++ b/src/analyzer/protocol/conn-size/ConnSize.cc
@@ -9,7 +9,7 @@
 #include "zeek/Reporter.h"
 #include "zeek/RunState.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/conn-size/events.bif.h"
 
 namespace zeek::analyzer::conn_size {
 
diff --git a/src/analyzer/protocol/dce-rpc/DCE_RPC.h b/src/analyzer/protocol/dce-rpc/DCE_RPC.h
index 487b7636d4..500160ac15 100644
--- a/src/analyzer/protocol/dce-rpc/DCE_RPC.h
+++ b/src/analyzer/protocol/dce-rpc/DCE_RPC.h
@@ -6,8 +6,8 @@
 #include "zeek/analyzer/protocol/tcp/TCP.h"
 #include "zeek/IPAddr.h"
 
-#include "events.bif.h"
-#include "dce_rpc_pac.h"
+#include "analyzer/protocol/dce-rpc/events.bif.h"
+#include "analyzer/protocol/dce-rpc/dce_rpc_pac.h"
 
 namespace zeek::analyzer::dce_rpc {
 
diff --git a/src/analyzer/protocol/dce-rpc/dce_rpc.pac b/src/analyzer/protocol/dce-rpc/dce_rpc.pac
index 521885ea1a..f7089ace53 100644
--- a/src/analyzer/protocol/dce-rpc/dce_rpc.pac
+++ b/src/analyzer/protocol/dce-rpc/dce_rpc.pac
@@ -2,9 +2,9 @@
 %include zeek.pac
 
 %extern{
-#include "consts.bif.h"
-#include "types.bif.h"
-#include "events.bif.h"
+#include "analyzer/protocol/dce-rpc/consts.bif.h"
+#include "analyzer/protocol/dce-rpc/types.bif.h"
+#include "analyzer/protocol/dce-rpc/events.bif.h"
 %}
 
 analyzer DCE_RPC withcontext {
diff --git a/src/analyzer/protocol/dhcp/DHCP.cc b/src/analyzer/protocol/dhcp/DHCP.cc
index 6a61b35ce6..a66405fdcc 100644
--- a/src/analyzer/protocol/dhcp/DHCP.cc
+++ b/src/analyzer/protocol/dhcp/DHCP.cc
@@ -1,7 +1,7 @@
 #include "zeek/analyzer/protocol/dhcp/DHCP.h"
 
-#include "events.bif.h"
-#include "types.bif.h"
+#include "analyzer/protocol/dhcp/events.bif.h"
+#include "analyzer/protocol/dhcp/types.bif.h"
 
 namespace zeek::analyzer::dhcp {
 
diff --git a/src/analyzer/protocol/dhcp/DHCP.h b/src/analyzer/protocol/dhcp/DHCP.h
index 70c6c32703..de0d3d59d9 100644
--- a/src/analyzer/protocol/dhcp/DHCP.h
+++ b/src/analyzer/protocol/dhcp/DHCP.h
@@ -2,7 +2,7 @@
 
 #include "zeek/analyzer/protocol/udp/UDP.h"
 
-#include "dhcp_pac.h"
+#include "analyzer/protocol/dhcp/dhcp_pac.h"
 
 namespace zeek::analyzer::dhcp {
 
diff --git a/src/analyzer/protocol/dhcp/dhcp.pac b/src/analyzer/protocol/dhcp/dhcp.pac
index f67523299b..6305f15429 100644
--- a/src/analyzer/protocol/dhcp/dhcp.pac
+++ b/src/analyzer/protocol/dhcp/dhcp.pac
@@ -2,8 +2,8 @@
 %include zeek.pac
 
 %extern{
-#include "types.bif.h"
-#include "events.bif.h"
+#include "analyzer/protocol/dhcp/types.bif.h"
+#include "analyzer/protocol/dhcp/events.bif.h"
 %}
 
 analyzer DHCP withcontext {
diff --git a/src/analyzer/protocol/dnp3/DNP3.cc b/src/analyzer/protocol/dnp3/DNP3.cc
index a1bf5fbc98..0cd02d0dc5 100644
--- a/src/analyzer/protocol/dnp3/DNP3.cc
+++ b/src/analyzer/protocol/dnp3/DNP3.cc
@@ -99,7 +99,7 @@
 #include "zeek/analyzer/protocol/dnp3/DNP3.h"
 #include "zeek/Reporter.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/dnp3/events.bif.h"
 
 constexpr unsigned int PSEUDO_LENGTH_INDEX = 2;		// index of len field of DNP3 Pseudo Link Layer
 constexpr unsigned int PSEUDO_CONTROL_FIELD_INDEX = 3;	// index of ctrl field of DNP3 Pseudo Link Layer
diff --git a/src/analyzer/protocol/dnp3/DNP3.h b/src/analyzer/protocol/dnp3/DNP3.h
index fcd263e85c..bb94a881bf 100644
--- a/src/analyzer/protocol/dnp3/DNP3.h
+++ b/src/analyzer/protocol/dnp3/DNP3.h
@@ -3,7 +3,7 @@
 #include "zeek/analyzer/protocol/tcp/TCP.h"
 #include "zeek/analyzer/protocol/udp/UDP.h"
 
-#include "dnp3_pac.h"
+#include "analyzer/protocol/dnp3/dnp3_pac.h"
 
 namespace zeek::analyzer::dnp3 {
 
diff --git a/src/analyzer/protocol/dnp3/dnp3.pac b/src/analyzer/protocol/dnp3/dnp3.pac
index 4c3169f669..9810e9dfc8 100644
--- a/src/analyzer/protocol/dnp3/dnp3.pac
+++ b/src/analyzer/protocol/dnp3/dnp3.pac
@@ -3,7 +3,7 @@
 %include zeek.pac
 
 %extern{
-#include "events.bif.h"
+#include "analyzer/protocol/dnp3/events.bif.h"
 %}
 
 analyzer DNP3 withcontext {
diff --git a/src/analyzer/protocol/dns/DNS.cc b/src/analyzer/protocol/dns/DNS.cc
index f667c529b9..d8c81f8571 100644
--- a/src/analyzer/protocol/dns/DNS.cc
+++ b/src/analyzer/protocol/dns/DNS.cc
@@ -15,7 +15,7 @@
 #include "zeek/Event.h"
 #include "zeek/RunState.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/dns/events.bif.h"
 
 namespace zeek::analyzer::dns {
 
diff --git a/src/analyzer/protocol/file/File.cc b/src/analyzer/protocol/file/File.cc
index bd3889fadd..8668f12bb3 100644
--- a/src/analyzer/protocol/file/File.cc
+++ b/src/analyzer/protocol/file/File.cc
@@ -7,7 +7,7 @@
 #include "zeek/Reporter.h"
 #include "zeek/util.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/file/events.bif.h"
 
 namespace zeek::analyzer::file {
 
diff --git a/src/analyzer/protocol/finger/Finger.cc b/src/analyzer/protocol/finger/Finger.cc
index 7b6226d73b..6a4763a59a 100644
--- a/src/analyzer/protocol/finger/Finger.cc
+++ b/src/analyzer/protocol/finger/Finger.cc
@@ -9,7 +9,7 @@
 #include "zeek/Event.h"
 #include "zeek/analyzer/protocol/tcp/ContentLine.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/finger/events.bif.h"
 
 namespace zeek::analyzer::finger {
 
diff --git a/src/analyzer/protocol/gnutella/Gnutella.cc b/src/analyzer/protocol/gnutella/Gnutella.cc
index d73834447f..4ba8e86243 100644
--- a/src/analyzer/protocol/gnutella/Gnutella.cc
+++ b/src/analyzer/protocol/gnutella/Gnutella.cc
@@ -12,7 +12,7 @@
 #include "zeek/analyzer/protocol/pia/PIA.h"
 #include "zeek/analyzer/Manager.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/gnutella/events.bif.h"
 
 namespace zeek::analyzer::gnutella {
 
diff --git a/src/analyzer/protocol/gssapi/GSSAPI.cc b/src/analyzer/protocol/gssapi/GSSAPI.cc
index 7a52013ef9..59988a83cf 100644
--- a/src/analyzer/protocol/gssapi/GSSAPI.cc
+++ b/src/analyzer/protocol/gssapi/GSSAPI.cc
@@ -5,7 +5,7 @@
 #include "zeek/analyzer/protocol/tcp/TCP_Reassembler.h"
 #include "zeek/Reporter.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/gssapi/events.bif.h"
 
 namespace zeek::analyzer::gssapi {
 
diff --git a/src/analyzer/protocol/gssapi/GSSAPI.h b/src/analyzer/protocol/gssapi/GSSAPI.h
index a81435cefe..e420c3b285 100644
--- a/src/analyzer/protocol/gssapi/GSSAPI.h
+++ b/src/analyzer/protocol/gssapi/GSSAPI.h
@@ -4,8 +4,8 @@
 
 #include "zeek/analyzer/protocol/tcp/TCP.h"
 
-#include "events.bif.h"
-#include "gssapi_pac.h"
+#include "analyzer/protocol/gssapi/events.bif.h"
+#include "analyzer/protocol/gssapi/gssapi_pac.h"
 
 namespace zeek::analyzer::gssapi {
 
diff --git a/src/analyzer/protocol/gssapi/gssapi.pac b/src/analyzer/protocol/gssapi/gssapi.pac
index 1fa2780ada..73ca7c5a1b 100644
--- a/src/analyzer/protocol/gssapi/gssapi.pac
+++ b/src/analyzer/protocol/gssapi/gssapi.pac
@@ -5,7 +5,7 @@
 #include "zeek/analyzer/Manager.h"
 #include "zeek/analyzer/Analyzer.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/gssapi/events.bif.h"
 %}
 
 analyzer GSSAPI withcontext {
diff --git a/src/analyzer/protocol/gtpv1/GTPv1.cc b/src/analyzer/protocol/gtpv1/GTPv1.cc
index 2725ec11ef..49276179ea 100644
--- a/src/analyzer/protocol/gtpv1/GTPv1.cc
+++ b/src/analyzer/protocol/gtpv1/GTPv1.cc
@@ -3,7 +3,7 @@
 #include "zeek/analyzer/protocol/gtpv1/GTPv1.h"
 #include "zeek/packet_analysis/protocol/iptunnel/IPTunnel.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/gtpv1/events.bif.h"
 
 namespace zeek::analyzer::gtpv1 {
 
diff --git a/src/analyzer/protocol/gtpv1/GTPv1.h b/src/analyzer/protocol/gtpv1/GTPv1.h
index 37811b4004..0f1edb0ac6 100644
--- a/src/analyzer/protocol/gtpv1/GTPv1.h
+++ b/src/analyzer/protocol/gtpv1/GTPv1.h
@@ -1,6 +1,6 @@
 #pragma once
 
-#include "gtpv1_pac.h"
+#include "analyzer/protocol/gtpv1/gtpv1_pac.h"
 
 namespace binpac::GTPv1 { class GTPv1_Conn; }
 
diff --git a/src/analyzer/protocol/gtpv1/gtpv1.pac b/src/analyzer/protocol/gtpv1/gtpv1.pac
index 66be1f475a..3910471b08 100644
--- a/src/analyzer/protocol/gtpv1/gtpv1.pac
+++ b/src/analyzer/protocol/gtpv1/gtpv1.pac
@@ -6,7 +6,7 @@
 #include "zeek/TunnelEncapsulation.h"
 #include "zeek/Reporter.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/gtpv1/events.bif.h"
 %}
 
 analyzer GTPv1 withcontext {
diff --git a/src/analyzer/protocol/http/HTTP.cc b/src/analyzer/protocol/http/HTTP.cc
index c99280e7ff..efb6ed49c3 100644
--- a/src/analyzer/protocol/http/HTTP.cc
+++ b/src/analyzer/protocol/http/HTTP.cc
@@ -14,7 +14,7 @@
 #include "zeek/analyzer/protocol/mime/MIME.h"
 #include "zeek/file_analysis/Manager.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/http/events.bif.h"
 
 namespace zeek::analyzer::http {
 
diff --git a/src/analyzer/protocol/icmp/ICMP.cc b/src/analyzer/protocol/icmp/ICMP.cc
index adb2f7c644..368d85c616 100644
--- a/src/analyzer/protocol/icmp/ICMP.cc
+++ b/src/analyzer/protocol/icmp/ICMP.cc
@@ -14,7 +14,7 @@
 #include "zeek/Desc.h"
 #include "zeek/Reporter.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/icmp/events.bif.h"
 
 namespace zeek::analyzer::icmp {
 
diff --git a/src/analyzer/protocol/ident/Ident.cc b/src/analyzer/protocol/ident/Ident.cc
index 5cb9f19849..8dbd42615e 100644
--- a/src/analyzer/protocol/ident/Ident.cc
+++ b/src/analyzer/protocol/ident/Ident.cc
@@ -9,7 +9,7 @@
 #include "zeek/NetVar.h"
 #include "zeek/Event.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/ident/events.bif.h"
 
 namespace zeek::analyzer::ident {
 
diff --git a/src/analyzer/protocol/imap/IMAP.h b/src/analyzer/protocol/imap/IMAP.h
index 0cb213fa16..7932b5d410 100644
--- a/src/analyzer/protocol/imap/IMAP.h
+++ b/src/analyzer/protocol/imap/IMAP.h
@@ -7,7 +7,7 @@
 
 #include "zeek/analyzer/protocol/tcp/TCP.h"
 
-#include "imap_pac.h"
+#include "analyzer/protocol/imap/imap_pac.h"
 
 namespace zeek::analyzer::imap {
 
diff --git a/src/analyzer/protocol/imap/imap.pac b/src/analyzer/protocol/imap/imap.pac
index d1ca57893d..bd162f0e8e 100644
--- a/src/analyzer/protocol/imap/imap.pac
+++ b/src/analyzer/protocol/imap/imap.pac
@@ -16,7 +16,7 @@ using IMAPAnalyzer = zeek::analyzer::imap::IMAP_Analyzer*;
 #include "zeek/Reporter.h"
 #include "zeek/analyzer/protocol/imap/IMAP.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/imap/events.bif.h"
 
 %}
 
diff --git a/src/analyzer/protocol/irc/IRC.cc b/src/analyzer/protocol/irc/IRC.cc
index 1b6e9cfda8..e75d2a6ac4 100644
--- a/src/analyzer/protocol/irc/IRC.cc
+++ b/src/analyzer/protocol/irc/IRC.cc
@@ -9,7 +9,7 @@
 #include "zeek/analyzer/protocol/zip/ZIP.h"
 #include "zeek/analyzer/Manager.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/irc/events.bif.h"
 
 using namespace std;
 
diff --git a/src/analyzer/protocol/krb/KRB.cc b/src/analyzer/protocol/krb/KRB.cc
index 45fbdbd871..929bfb13c9 100644
--- a/src/analyzer/protocol/krb/KRB.cc
+++ b/src/analyzer/protocol/krb/KRB.cc
@@ -4,8 +4,8 @@
 
 #include <unistd.h>
 
-#include "types.bif.h"
-#include "events.bif.h"
+#include "analyzer/protocol/krb/types.bif.h"
+#include "analyzer/protocol/krb/events.bif.h"
 
 namespace zeek::analyzer::krb {
 
diff --git a/src/analyzer/protocol/krb/KRB.h b/src/analyzer/protocol/krb/KRB.h
index ef38ba7c22..fe817e5b39 100644
--- a/src/analyzer/protocol/krb/KRB.h
+++ b/src/analyzer/protocol/krb/KRB.h
@@ -9,7 +9,7 @@
 #include <krb5.h>
 #endif
 
-#include "krb_pac.h"
+#include "analyzer/protocol/krb/krb_pac.h"
 
 namespace zeek::analyzer::krb {
 
diff --git a/src/analyzer/protocol/krb/KRB_TCP.cc b/src/analyzer/protocol/krb/KRB_TCP.cc
index 05b5174364..78b777526a 100644
--- a/src/analyzer/protocol/krb/KRB_TCP.cc
+++ b/src/analyzer/protocol/krb/KRB_TCP.cc
@@ -3,8 +3,8 @@
 #include "zeek/analyzer/protocol/krb/KRB_TCP.h"
 #include "zeek/analyzer/protocol/tcp/TCP_Reassembler.h"
 
-#include "types.bif.h"
-#include "events.bif.h"
+#include "analyzer/protocol/krb/types.bif.h"
+#include "analyzer/protocol/krb/events.bif.h"
 
 namespace zeek::analyzer::krb_tcp {
 
diff --git a/src/analyzer/protocol/krb/KRB_TCP.h b/src/analyzer/protocol/krb/KRB_TCP.h
index 6a397f4444..d0b7ba61d8 100644
--- a/src/analyzer/protocol/krb/KRB_TCP.h
+++ b/src/analyzer/protocol/krb/KRB_TCP.h
@@ -4,7 +4,7 @@
 
 #include "zeek/analyzer/protocol/tcp/TCP.h"
 
-#include "krb_TCP_pac.h"
+#include "analyzer/protocol/krb/krb_TCP_pac.h"
 
 namespace zeek::analyzer::krb_tcp {
 
diff --git a/src/analyzer/protocol/krb/krb.pac b/src/analyzer/protocol/krb/krb.pac
index 479e3c2ff6..d8a2392506 100644
--- a/src/analyzer/protocol/krb/krb.pac
+++ b/src/analyzer/protocol/krb/krb.pac
@@ -9,8 +9,8 @@ using KRBAnalyzer = zeek::analyzer::krb::KRB_Analyzer*;
 #include "zeek-config.h"
 #include "zeek/analyzer/protocol/krb/KRB.h"
 
-#include "types.bif.h"
-#include "events.bif.h"
+#include "analyzer/protocol/krb/types.bif.h"
+#include "analyzer/protocol/krb/events.bif.h"
 %}
 
 extern type KRBAnalyzer;
diff --git a/src/analyzer/protocol/krb/krb_TCP.pac b/src/analyzer/protocol/krb/krb_TCP.pac
index 3649c0dc7c..d5c48395c8 100644
--- a/src/analyzer/protocol/krb/krb_TCP.pac
+++ b/src/analyzer/protocol/krb/krb_TCP.pac
@@ -9,8 +9,8 @@ using KRBTCPAnalyzer = zeek::analyzer::krb_tcp::KRB_Analyzer*;
 #include "zeek-config.h"
 #include "zeek/analyzer/protocol/krb/KRB_TCP.h"
 
-#include "types.bif.h"
-#include "events.bif.h"
+#include "analyzer/protocol/krb/types.bif.h"
+#include "analyzer/protocol/krb/events.bif.h"
 %}
 
 extern type KRBTCPAnalyzer;
diff --git a/src/analyzer/protocol/login/Login.cc b/src/analyzer/protocol/login/Login.cc
index 19c411cdc7..d2e35960bf 100644
--- a/src/analyzer/protocol/login/Login.cc
+++ b/src/analyzer/protocol/login/Login.cc
@@ -13,7 +13,7 @@
 #include "zeek/Event.h"
 #include "zeek/Var.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/login/events.bif.h"
 
 namespace zeek::analyzer::login {
 
diff --git a/src/analyzer/protocol/login/NVT.cc b/src/analyzer/protocol/login/NVT.cc
index 1407fb4e5e..341c90f224 100644
--- a/src/analyzer/protocol/login/NVT.cc
+++ b/src/analyzer/protocol/login/NVT.cc
@@ -11,7 +11,7 @@
 #include "zeek/Reporter.h"
 #include "zeek/analyzer/protocol/tcp/TCP.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/login/events.bif.h"
 
 #define IS_3_BYTE_OPTION(c) (c >= 251 && c <= 254)
 
diff --git a/src/analyzer/protocol/login/RSH.cc b/src/analyzer/protocol/login/RSH.cc
index 131a897d84..8f6a090b39 100644
--- a/src/analyzer/protocol/login/RSH.cc
+++ b/src/analyzer/protocol/login/RSH.cc
@@ -7,7 +7,7 @@
 #include "zeek/Event.h"
 #include "zeek/Reporter.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/login/events.bif.h"
 
 namespace zeek::analyzer::login {
 
diff --git a/src/analyzer/protocol/login/Rlogin.cc b/src/analyzer/protocol/login/Rlogin.cc
index 313e02442d..7bd927d797 100644
--- a/src/analyzer/protocol/login/Rlogin.cc
+++ b/src/analyzer/protocol/login/Rlogin.cc
@@ -7,7 +7,7 @@
 #include "zeek/Event.h"
 #include "zeek/Reporter.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/login/events.bif.h"
 
 namespace zeek::analyzer::login {
 
diff --git a/src/analyzer/protocol/login/Telnet.cc b/src/analyzer/protocol/login/Telnet.cc
index 0c601d0507..2fe167ff68 100644
--- a/src/analyzer/protocol/login/Telnet.cc
+++ b/src/analyzer/protocol/login/Telnet.cc
@@ -5,7 +5,7 @@
 #include "zeek/analyzer/protocol/login/Telnet.h"
 #include "zeek/analyzer/protocol/login/NVT.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/login/events.bif.h"
 
 namespace zeek::analyzer::login {
 
diff --git a/src/analyzer/protocol/mime/MIME.cc b/src/analyzer/protocol/mime/MIME.cc
index 193ca77a19..e2c96e3a4e 100644
--- a/src/analyzer/protocol/mime/MIME.cc
+++ b/src/analyzer/protocol/mime/MIME.cc
@@ -7,7 +7,7 @@
 #include "zeek/digest.h"
 #include "zeek/file_analysis/Manager.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/mime/events.bif.h"
 
 // Here are a few things to do:
 //
diff --git a/src/analyzer/protocol/modbus/Modbus.cc b/src/analyzer/protocol/modbus/Modbus.cc
index 1ca85a77c1..5803cec40c 100644
--- a/src/analyzer/protocol/modbus/Modbus.cc
+++ b/src/analyzer/protocol/modbus/Modbus.cc
@@ -1,7 +1,7 @@
 #include "zeek/analyzer/protocol/modbus/Modbus.h"
 #include "zeek/analyzer/protocol/tcp/TCP_Reassembler.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/modbus/events.bif.h"
 
 namespace zeek::analyzer::modbus {
 
diff --git a/src/analyzer/protocol/modbus/Modbus.h b/src/analyzer/protocol/modbus/Modbus.h
index abd87f1a88..9415f4ddc5 100644
--- a/src/analyzer/protocol/modbus/Modbus.h
+++ b/src/analyzer/protocol/modbus/Modbus.h
@@ -2,7 +2,7 @@
 
 #include "zeek/analyzer/protocol/tcp/TCP.h"
 
-#include "modbus_pac.h"
+#include "analyzer/protocol/modbus/modbus_pac.h"
 
 namespace zeek::analyzer::modbus {
 
diff --git a/src/analyzer/protocol/modbus/modbus.pac b/src/analyzer/protocol/modbus/modbus.pac
index 6f94e1c43b..e768840fbe 100644
--- a/src/analyzer/protocol/modbus/modbus.pac
+++ b/src/analyzer/protocol/modbus/modbus.pac
@@ -10,7 +10,7 @@
 %include zeek.pac
 
 %extern{
-#include "events.bif.h"
+#include "analyzer/protocol/modbus/events.bif.h"
 %}
 
 analyzer ModbusTCP withcontext {
diff --git a/src/analyzer/protocol/mqtt/MQTT.cc b/src/analyzer/protocol/mqtt/MQTT.cc
index cee16fcd60..2281f5fadb 100644
--- a/src/analyzer/protocol/mqtt/MQTT.cc
+++ b/src/analyzer/protocol/mqtt/MQTT.cc
@@ -4,7 +4,7 @@
 
 #include "zeek/Reporter.h"
 
-#include "mqtt_pac.h"
+#include "analyzer/protocol/mqtt/mqtt_pac.h"
 
 namespace zeek::analyzer::mqtt {
 
diff --git a/src/analyzer/protocol/mqtt/mqtt.pac b/src/analyzer/protocol/mqtt/mqtt.pac
index e50f379439..82aa991fab 100644
--- a/src/analyzer/protocol/mqtt/mqtt.pac
+++ b/src/analyzer/protocol/mqtt/mqtt.pac
@@ -5,8 +5,8 @@
 
 %extern{
 	#include "zeek/analyzer/protocol/mqtt/MQTT.h"
-	#include "events.bif.h"
-	#include "types.bif.h"
+	#include "analyzer/protocol/mqtt/events.bif.h"
+	#include "analyzer/protocol/mqtt/types.bif.h"
 %}
 
 analyzer MQTT withcontext {
diff --git a/src/analyzer/protocol/mysql/MySQL.cc b/src/analyzer/protocol/mysql/MySQL.cc
index 2e81ba8c5e..7a5ae507b2 100644
--- a/src/analyzer/protocol/mysql/MySQL.cc
+++ b/src/analyzer/protocol/mysql/MySQL.cc
@@ -5,7 +5,7 @@
 #include "zeek/analyzer/protocol/tcp/TCP_Reassembler.h"
 #include "zeek/Reporter.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/mysql/events.bif.h"
 
 namespace zeek::analyzer::mysql {
 
diff --git a/src/analyzer/protocol/mysql/MySQL.h b/src/analyzer/protocol/mysql/MySQL.h
index 8c54e7d42b..4ddb872c08 100644
--- a/src/analyzer/protocol/mysql/MySQL.h
+++ b/src/analyzer/protocol/mysql/MySQL.h
@@ -4,8 +4,8 @@
 
 #include "zeek/analyzer/protocol/tcp/TCP.h"
 
-#include "events.bif.h"
-#include "mysql_pac.h"
+#include "analyzer/protocol/mysql/events.bif.h"
+#include "analyzer/protocol/mysql/mysql_pac.h"
 
 namespace zeek::analyzer::mysql {
 
diff --git a/src/analyzer/protocol/mysql/mysql.pac b/src/analyzer/protocol/mysql/mysql.pac
index 28453cb830..1cf589c891 100644
--- a/src/analyzer/protocol/mysql/mysql.pac
+++ b/src/analyzer/protocol/mysql/mysql.pac
@@ -8,7 +8,7 @@
 %include zeek.pac
 
 %extern{
-	#include "events.bif.h"
+	#include "analyzer/protocol/mysql/events.bif.h"
 %}
 
 analyzer MySQL withcontext {
diff --git a/src/analyzer/protocol/ncp/NCP.cc b/src/analyzer/protocol/ncp/NCP.cc
index f2e51af21f..7282015cfb 100644
--- a/src/analyzer/protocol/ncp/NCP.cc
+++ b/src/analyzer/protocol/ncp/NCP.cc
@@ -9,8 +9,8 @@
 
 #include "zeek/Sessions.h"
 
-#include "events.bif.h"
-#include "consts.bif.h"
+#include "analyzer/protocol/ncp/events.bif.h"
+#include "analyzer/protocol/ncp/consts.bif.h"
 
 using namespace std;
 
diff --git a/src/analyzer/protocol/ncp/NCP.h b/src/analyzer/protocol/ncp/NCP.h
index df067868e9..4259bba8b4 100644
--- a/src/analyzer/protocol/ncp/NCP.h
+++ b/src/analyzer/protocol/ncp/NCP.h
@@ -20,7 +20,7 @@
 #include "zeek/NetVar.h"
 #include "zeek/analyzer/protocol/tcp/TCP.h"
 
-#include "ncp_pac.h"
+#include "analyzer/protocol/ncp/ncp_pac.h"
 
 namespace zeek::analyzer::ncp {
 namespace detail {
diff --git a/src/analyzer/protocol/ncp/ncp.pac b/src/analyzer/protocol/ncp/ncp.pac
index dd92672a44..d86187c2ad 100644
--- a/src/analyzer/protocol/ncp/ncp.pac
+++ b/src/analyzer/protocol/ncp/ncp.pac
@@ -3,7 +3,7 @@
 %include zeek.pac
 
 %extern{
-#include "events.bif.h"
+#include "analyzer/protocol/ncp/events.bif.h"
 %}
 
 analyzer NCP withcontext {};
diff --git a/src/analyzer/protocol/netbios/NetbiosSSN.cc b/src/analyzer/protocol/netbios/NetbiosSSN.cc
index 7f441d4118..da6c91bb36 100644
--- a/src/analyzer/protocol/netbios/NetbiosSSN.cc
+++ b/src/analyzer/protocol/netbios/NetbiosSSN.cc
@@ -11,7 +11,7 @@
 #include "zeek/Event.h"
 #include "zeek/RunState.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/netbios/events.bif.h"
 
 constexpr double netbios_ssn_session_timeout = 15.0;
 
diff --git a/src/analyzer/protocol/ntlm/NTLM.cc b/src/analyzer/protocol/ntlm/NTLM.cc
index eb442350b5..a12625db29 100644
--- a/src/analyzer/protocol/ntlm/NTLM.cc
+++ b/src/analyzer/protocol/ntlm/NTLM.cc
@@ -5,7 +5,7 @@
 #include "zeek/analyzer/protocol/tcp/TCP_Reassembler.h"
 #include "zeek/Reporter.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/ntlm/events.bif.h"
 
 namespace zeek::analyzer::ntlm {
 
diff --git a/src/analyzer/protocol/ntlm/NTLM.h b/src/analyzer/protocol/ntlm/NTLM.h
index 63c43c9bdb..79658fec6c 100644
--- a/src/analyzer/protocol/ntlm/NTLM.h
+++ b/src/analyzer/protocol/ntlm/NTLM.h
@@ -4,8 +4,8 @@
 
 #include "zeek/analyzer/protocol/tcp/TCP.h"
 
-#include "events.bif.h"
-#include "ntlm_pac.h"
+#include "analyzer/protocol/ntlm/events.bif.h"
+#include "analyzer/protocol/ntlm/ntlm_pac.h"
 
 namespace zeek::analyzer::ntlm {
 
diff --git a/src/analyzer/protocol/ntlm/ntlm.pac b/src/analyzer/protocol/ntlm/ntlm.pac
index 550cf91095..a686f306a2 100644
--- a/src/analyzer/protocol/ntlm/ntlm.pac
+++ b/src/analyzer/protocol/ntlm/ntlm.pac
@@ -5,8 +5,8 @@
 #include "zeek/analyzer/Manager.h"
 #include "zeek/analyzer/Analyzer.h"
 
-#include "types.bif.h"
-#include "events.bif.h"
+#include "analyzer/protocol/ntlm/types.bif.h"
+#include "analyzer/protocol/ntlm/events.bif.h"
 %}
 
 analyzer NTLM withcontext {
diff --git a/src/analyzer/protocol/ntp/NTP.cc b/src/analyzer/protocol/ntp/NTP.cc
index 2962010024..b5dbcae06e 100644
--- a/src/analyzer/protocol/ntp/NTP.cc
+++ b/src/analyzer/protocol/ntp/NTP.cc
@@ -2,7 +2,7 @@
 
 #include "zeek/Reporter.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/ntp/events.bif.h"
 
 namespace zeek::analyzer::ntp {
 
diff --git a/src/analyzer/protocol/ntp/NTP.h b/src/analyzer/protocol/ntp/NTP.h
index 46a4de40d1..c737fdff6f 100644
--- a/src/analyzer/protocol/ntp/NTP.h
+++ b/src/analyzer/protocol/ntp/NTP.h
@@ -2,9 +2,9 @@
 
 #include "zeek/analyzer/protocol/udp/UDP.h"
 
-#include "events.bif.h"
-#include "types.bif.h"
-#include "ntp_pac.h"
+#include "analyzer/protocol/ntp/events.bif.h"
+#include "analyzer/protocol/ntp/types.bif.h"
+#include "analyzer/protocol/ntp/ntp_pac.h"
 
 namespace zeek::analyzer::ntp {
 
diff --git a/src/analyzer/protocol/ntp/ntp.pac b/src/analyzer/protocol/ntp/ntp.pac
index 6f4343a246..807082b491 100644
--- a/src/analyzer/protocol/ntp/ntp.pac
+++ b/src/analyzer/protocol/ntp/ntp.pac
@@ -3,8 +3,8 @@
 %include zeek.pac
 
 %extern{
-	#include "types.bif.h"
-	#include "events.bif.h"
+	#include "analyzer/protocol/ntp/types.bif.h"
+	#include "analyzer/protocol/ntp/events.bif.h"
 %}
 
 analyzer NTP withcontext {
diff --git a/src/analyzer/protocol/pop3/POP3.cc b/src/analyzer/protocol/pop3/POP3.cc
index 77d86259fc..8c5ff60203 100644
--- a/src/analyzer/protocol/pop3/POP3.cc
+++ b/src/analyzer/protocol/pop3/POP3.cc
@@ -12,7 +12,7 @@
 #include "zeek/Reporter.h"
 #include "zeek/analyzer/Manager.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/pop3/events.bif.h"
 
 namespace zeek::analyzer::pop3 {
 
diff --git a/src/analyzer/protocol/radius/RADIUS.cc b/src/analyzer/protocol/radius/RADIUS.cc
index 6e32eee2a7..cb5d5541b3 100644
--- a/src/analyzer/protocol/radius/RADIUS.cc
+++ b/src/analyzer/protocol/radius/RADIUS.cc
@@ -2,7 +2,7 @@
 
 #include "zeek/Reporter.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/radius/events.bif.h"
 
 namespace zeek::analyzer::radius {
 
diff --git a/src/analyzer/protocol/radius/RADIUS.h b/src/analyzer/protocol/radius/RADIUS.h
index 50ca050f9f..0ce1c14a22 100644
--- a/src/analyzer/protocol/radius/RADIUS.h
+++ b/src/analyzer/protocol/radius/RADIUS.h
@@ -2,8 +2,8 @@
 
 #include "zeek/analyzer/protocol/udp/UDP.h"
 
-#include "events.bif.h"
-#include "radius_pac.h"
+#include "analyzer/protocol/radius/events.bif.h"
+#include "analyzer/protocol/radius/radius_pac.h"
 
 namespace zeek::analyzer::radius {
 
diff --git a/src/analyzer/protocol/radius/radius.pac b/src/analyzer/protocol/radius/radius.pac
index 6da1813ba7..0a9c64b560 100644
--- a/src/analyzer/protocol/radius/radius.pac
+++ b/src/analyzer/protocol/radius/radius.pac
@@ -6,7 +6,7 @@
 %include zeek.pac
 
 %extern{
-	#include "events.bif.h"
+	#include "analyzer/protocol/radius/events.bif.h"
 %}
 
 analyzer RADIUS withcontext {
diff --git a/src/analyzer/protocol/rdp/RDP.cc b/src/analyzer/protocol/rdp/RDP.cc
index 321a541300..585cca7d2b 100644
--- a/src/analyzer/protocol/rdp/RDP.cc
+++ b/src/analyzer/protocol/rdp/RDP.cc
@@ -2,8 +2,8 @@
 #include "zeek/analyzer/protocol/tcp/TCP_Reassembler.h"
 #include "zeek/Reporter.h"
 
-#include "events.bif.h"
-#include "types.bif.h"
+#include "analyzer/protocol/rdp/events.bif.h"
+#include "analyzer/protocol/rdp/types.bif.h"
 
 namespace zeek::analyzer::rdp {
 
diff --git a/src/analyzer/protocol/rdp/RDP.h b/src/analyzer/protocol/rdp/RDP.h
index d3e3ffcb6a..cedd8729df 100644
--- a/src/analyzer/protocol/rdp/RDP.h
+++ b/src/analyzer/protocol/rdp/RDP.h
@@ -3,8 +3,8 @@
 #include "zeek/analyzer/protocol/tcp/TCP.h"
 #include "zeek/analyzer/protocol/pia/PIA.h"
 
-#include "events.bif.h"
-#include "rdp_pac.h"
+#include "analyzer/protocol/rdp/events.bif.h"
+#include "analyzer/protocol/rdp/rdp_pac.h"
 
 namespace zeek::analyzer::rdp {
 
diff --git a/src/analyzer/protocol/rdp/RDPEUDP.cc b/src/analyzer/protocol/rdp/RDPEUDP.cc
index 875d8c312c..5f70e80c7f 100644
--- a/src/analyzer/protocol/rdp/RDPEUDP.cc
+++ b/src/analyzer/protocol/rdp/RDPEUDP.cc
@@ -2,8 +2,8 @@
 
 #include "zeek/Reporter.h"
 
-#include "events.bif.h"
-#include "rdpeudp_pac.h"
+#include "analyzer/protocol/rdp/events.bif.h"
+#include "analyzer/protocol/rdp/rdpeudp_pac.h"
 
 namespace zeek::analyzer::rdpeudp {
 
diff --git a/src/analyzer/protocol/rdp/RDPEUDP.h b/src/analyzer/protocol/rdp/RDPEUDP.h
index 088ab14b03..5449685847 100644
--- a/src/analyzer/protocol/rdp/RDPEUDP.h
+++ b/src/analyzer/protocol/rdp/RDPEUDP.h
@@ -2,8 +2,8 @@
 
 #include "zeek/analyzer/protocol/udp/UDP.h"
 
-#include "events.bif.h"
-#include "rdpeudp_pac.h"
+#include "analyzer/protocol/rdp/events.bif.h"
+#include "analyzer/protocol/rdp/rdpeudp_pac.h"
 
 namespace zeek::analyzer::rdpeudp {
 
diff --git a/src/analyzer/protocol/rdp/rdp-analyzer.pac b/src/analyzer/protocol/rdp/rdp-analyzer.pac
index bb1220cfef..3984bdd89f 100644
--- a/src/analyzer/protocol/rdp/rdp-analyzer.pac
+++ b/src/analyzer/protocol/rdp/rdp-analyzer.pac
@@ -2,7 +2,7 @@
 #include "zeek/Desc.h"
 #include "zeek/file_analysis/Manager.h"
 
-#include "types.bif.h"
+#include "analyzer/protocol/rdp/types.bif.h"
 %}
 
 refine flow RDP_Flow += {
diff --git a/src/analyzer/protocol/rdp/rdp.pac b/src/analyzer/protocol/rdp/rdp.pac
index 58e0c3a61f..5f267dbe13 100644
--- a/src/analyzer/protocol/rdp/rdp.pac
+++ b/src/analyzer/protocol/rdp/rdp.pac
@@ -2,7 +2,7 @@
 %include zeek.pac
 
 %extern{
-	#include "events.bif.h"
+	#include "analyzer/protocol/rdp/events.bif.h"
 %}
 
 analyzer RDP withcontext {
diff --git a/src/analyzer/protocol/rdp/rdpeudp.pac b/src/analyzer/protocol/rdp/rdpeudp.pac
index 1ece356231..61a90f9aca 100644
--- a/src/analyzer/protocol/rdp/rdpeudp.pac
+++ b/src/analyzer/protocol/rdp/rdpeudp.pac
@@ -2,7 +2,7 @@
 %include zeek.pac
 
 %extern{
-	#include "events.bif.h"
+	#include "analyzer/protocol/rdp/events.bif.h"
 %}
 
 analyzer RDPEUDP withcontext {
diff --git a/src/analyzer/protocol/rfb/RFB.cc b/src/analyzer/protocol/rfb/RFB.cc
index 84cb6ad11f..f3f29ad45a 100644
--- a/src/analyzer/protocol/rfb/RFB.cc
+++ b/src/analyzer/protocol/rfb/RFB.cc
@@ -3,7 +3,7 @@
 #include "zeek/analyzer/protocol/tcp/TCP_Reassembler.h"
 #include "zeek/Reporter.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/rfb/events.bif.h"
 
 namespace zeek::analyzer::rfb {
 
diff --git a/src/analyzer/protocol/rfb/RFB.h b/src/analyzer/protocol/rfb/RFB.h
index fe06a70c14..e35c387ceb 100644
--- a/src/analyzer/protocol/rfb/RFB.h
+++ b/src/analyzer/protocol/rfb/RFB.h
@@ -2,8 +2,8 @@
 
 #include "zeek/analyzer/protocol/tcp/TCP.h"
 
-#include "events.bif.h"
-#include "rfb_pac.h"
+#include "analyzer/protocol/rfb/events.bif.h"
+#include "analyzer/protocol/rfb/rfb_pac.h"
 
 namespace zeek::analyzer::rfb {
 
diff --git a/src/analyzer/protocol/rfb/rfb.pac b/src/analyzer/protocol/rfb/rfb.pac
index e03e3fb383..fa80c8c3bd 100644
--- a/src/analyzer/protocol/rfb/rfb.pac
+++ b/src/analyzer/protocol/rfb/rfb.pac
@@ -6,7 +6,7 @@
 %include zeek.pac
 
 %extern{
-	#include "events.bif.h"
+	#include "analyzer/protocol/rfb/events.bif.h"
 %}
 
 analyzer RFB withcontext {
diff --git a/src/analyzer/protocol/rpc/MOUNT.cc b/src/analyzer/protocol/rpc/MOUNT.cc
index 79d870996f..5a5f6a2503 100644
--- a/src/analyzer/protocol/rpc/MOUNT.cc
+++ b/src/analyzer/protocol/rpc/MOUNT.cc
@@ -11,7 +11,7 @@
 #include "zeek/analyzer/protocol/rpc/XDR.h"
 #include "zeek/Event.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/rpc/events.bif.h"
 
 namespace zeek::analyzer::rpc {
 namespace detail {
diff --git a/src/analyzer/protocol/rpc/NFS.cc b/src/analyzer/protocol/rpc/NFS.cc
index ec1e0edbda..c7a77ae0a5 100644
--- a/src/analyzer/protocol/rpc/NFS.cc
+++ b/src/analyzer/protocol/rpc/NFS.cc
@@ -11,7 +11,7 @@
 #include "zeek/analyzer/protocol/rpc/XDR.h"
 #include "zeek/Event.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/rpc/events.bif.h"
 
 namespace zeek::analyzer::rpc {
 namespace detail {
diff --git a/src/analyzer/protocol/rpc/Portmap.cc b/src/analyzer/protocol/rpc/Portmap.cc
index a22a7b9135..6d5644c736 100644
--- a/src/analyzer/protocol/rpc/Portmap.cc
+++ b/src/analyzer/protocol/rpc/Portmap.cc
@@ -7,7 +7,7 @@
 #include "zeek/Event.h"
 #include "zeek/analyzer/protocol/rpc/XDR.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/rpc/events.bif.h"
 
 #define PMAPPROC_NULL 0
 #define PMAPPROC_SET 1
diff --git a/src/analyzer/protocol/rpc/RPC.cc b/src/analyzer/protocol/rpc/RPC.cc
index 0eaa21f7c3..61ee54b861 100644
--- a/src/analyzer/protocol/rpc/RPC.cc
+++ b/src/analyzer/protocol/rpc/RPC.cc
@@ -12,7 +12,7 @@
 #include "zeek/Sessions.h"
 #include "zeek/RunState.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/rpc/events.bif.h"
 
 namespace { // local namespace
 	const bool DEBUG_rpc_resync = false;
diff --git a/src/analyzer/protocol/rpc/XDR.cc b/src/analyzer/protocol/rpc/XDR.cc
index 93141fcafa..2cd417a8d9 100644
--- a/src/analyzer/protocol/rpc/XDR.cc
+++ b/src/analyzer/protocol/rpc/XDR.cc
@@ -6,7 +6,7 @@
 #include <string.h>
 #include <algorithm>
 
-#include "events.bif.h"
+#include "analyzer/protocol/rpc/events.bif.h"
 
 uint32_t zeek::analyzer::rpc::extract_XDR_uint32(const u_char*& buf, int& len)
 	{
diff --git a/src/analyzer/protocol/sip/SIP.cc b/src/analyzer/protocol/sip/SIP.cc
index 388fcacf48..893c976799 100644
--- a/src/analyzer/protocol/sip/SIP.cc
+++ b/src/analyzer/protocol/sip/SIP.cc
@@ -1,6 +1,6 @@
 #include "zeek/analyzer/protocol/sip/SIP.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/sip/events.bif.h"
 
 namespace zeek::analyzer::sip {
 
diff --git a/src/analyzer/protocol/sip/SIP.h b/src/analyzer/protocol/sip/SIP.h
index ad686f02c4..d4a3177b0e 100644
--- a/src/analyzer/protocol/sip/SIP.h
+++ b/src/analyzer/protocol/sip/SIP.h
@@ -2,8 +2,8 @@
 
 #include "zeek/analyzer/protocol/udp/UDP.h"
 
-#include "events.bif.h"
-#include "sip_pac.h"
+#include "analyzer/protocol/sip/events.bif.h"
+#include "analyzer/protocol/sip/sip_pac.h"
 
 namespace zeek::analyzer::sip{
 
diff --git a/src/analyzer/protocol/sip/SIP_TCP.cc b/src/analyzer/protocol/sip/SIP_TCP.cc
index e99f7fbe6e..4be1b5657e 100644
--- a/src/analyzer/protocol/sip/SIP_TCP.cc
+++ b/src/analyzer/protocol/sip/SIP_TCP.cc
@@ -6,7 +6,7 @@
 #include "zeek/analyzer/protocol/sip/SIP_TCP.h"
 #include "zeek/analyzer/protocol/tcp/TCP_Reassembler.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/sip/events.bif.h"
 
 namespace zeek::analyzer::sip_tcp {
 
diff --git a/src/analyzer/protocol/sip/SIP_TCP.h b/src/analyzer/protocol/sip/SIP_TCP.h
index 9bf9396c63..8524d0577e 100644
--- a/src/analyzer/protocol/sip/SIP_TCP.h
+++ b/src/analyzer/protocol/sip/SIP_TCP.h
@@ -7,7 +7,7 @@
 
 #include "zeek/analyzer/protocol/tcp/TCP.h"
 
-#include "sip_TCP_pac.h"
+#include "analyzer/protocol/sip/sip_TCP_pac.h"
 
 namespace zeek::analyzer::sip_tcp {
 
diff --git a/src/analyzer/protocol/sip/sip.pac b/src/analyzer/protocol/sip/sip.pac
index 7198cfe22c..833fc4e517 100644
--- a/src/analyzer/protocol/sip/sip.pac
+++ b/src/analyzer/protocol/sip/sip.pac
@@ -5,7 +5,7 @@
 %include zeek.pac
 
 %extern{
-#include "events.bif.h"
+#include "analyzer/protocol/sip/events.bif.h"
 %}
 
 analyzer SIP withcontext {
diff --git a/src/analyzer/protocol/sip/sip_TCP.pac b/src/analyzer/protocol/sip/sip_TCP.pac
index d38b271a5e..10a0dd5fa7 100644
--- a/src/analyzer/protocol/sip/sip_TCP.pac
+++ b/src/analyzer/protocol/sip/sip_TCP.pac
@@ -8,7 +8,7 @@
 %include zeek.pac
 
 %extern{
-#include "events.bif.h"
+#include "analyzer/protocol/sip/events.bif.h"
 %}
 
 analyzer SIP_TCP withcontext {
diff --git a/src/analyzer/protocol/smb/SMB.h b/src/analyzer/protocol/smb/SMB.h
index c9c4c6c777..86ccaedb1c 100644
--- a/src/analyzer/protocol/smb/SMB.h
+++ b/src/analyzer/protocol/smb/SMB.h
@@ -1,7 +1,7 @@
 #pragma once
 
 #include "zeek/analyzer/protocol/tcp/TCP.h"
-#include "smb_pac.h"
+#include "analyzer/protocol/smb/smb_pac.h"
 
 namespace zeek::analyzer::smb {
 
diff --git a/src/analyzer/protocol/smb/smb.pac b/src/analyzer/protocol/smb/smb.pac
index 246733b0f0..d679591503 100644
--- a/src/analyzer/protocol/smb/smb.pac
+++ b/src/analyzer/protocol/smb/smb.pac
@@ -5,42 +5,42 @@
 #include "zeek/analyzer/Manager.h"
 #include "zeek/analyzer/Analyzer.h"
 
-#include "smb1_events.bif.h"
-#include "smb2_events.bif.h"
+#include "analyzer/protocol/smb/smb1_events.bif.h"
+#include "analyzer/protocol/smb/smb2_events.bif.h"
 
-#include "types.bif.h"
-#include "events.bif.h"
-#include "consts.bif.h"
+#include "analyzer/protocol/smb/types.bif.h"
+#include "analyzer/protocol/smb/events.bif.h"
+#include "analyzer/protocol/smb/consts.bif.h"
 
-#include "smb1_com_check_directory.bif.h"
-#include "smb1_com_close.bif.h"
-#include "smb1_com_create_directory.bif.h"
-#include "smb1_com_echo.bif.h"
-#include "smb1_com_logoff_andx.bif.h"
-#include "smb1_com_negotiate.bif.h"
-#include "smb1_com_nt_cancel.bif.h"
-#include "smb1_com_nt_create_andx.bif.h"
-#include "smb1_com_query_information.bif.h"
-#include "smb1_com_read_andx.bif.h"
-#include "smb1_com_session_setup_andx.bif.h"
-#include "smb1_com_transaction.bif.h"
-#include "smb1_com_transaction_secondary.bif.h"
-#include "smb1_com_transaction2.bif.h"
-#include "smb1_com_transaction2_secondary.bif.h"
-#include "smb1_com_tree_connect_andx.bif.h"
-#include "smb1_com_tree_disconnect.bif.h"
-#include "smb1_com_write_andx.bif.h"
+#include "analyzer/protocol/smb/smb1_com_check_directory.bif.h"
+#include "analyzer/protocol/smb/smb1_com_close.bif.h"
+#include "analyzer/protocol/smb/smb1_com_create_directory.bif.h"
+#include "analyzer/protocol/smb/smb1_com_echo.bif.h"
+#include "analyzer/protocol/smb/smb1_com_logoff_andx.bif.h"
+#include "analyzer/protocol/smb/smb1_com_negotiate.bif.h"
+#include "analyzer/protocol/smb/smb1_com_nt_cancel.bif.h"
+#include "analyzer/protocol/smb/smb1_com_nt_create_andx.bif.h"
+#include "analyzer/protocol/smb/smb1_com_query_information.bif.h"
+#include "analyzer/protocol/smb/smb1_com_read_andx.bif.h"
+#include "analyzer/protocol/smb/smb1_com_session_setup_andx.bif.h"
+#include "analyzer/protocol/smb/smb1_com_transaction.bif.h"
+#include "analyzer/protocol/smb/smb1_com_transaction_secondary.bif.h"
+#include "analyzer/protocol/smb/smb1_com_transaction2.bif.h"
+#include "analyzer/protocol/smb/smb1_com_transaction2_secondary.bif.h"
+#include "analyzer/protocol/smb/smb1_com_tree_connect_andx.bif.h"
+#include "analyzer/protocol/smb/smb1_com_tree_disconnect.bif.h"
+#include "analyzer/protocol/smb/smb1_com_write_andx.bif.h"
 
-#include "smb2_com_close.bif.h"
-#include "smb2_com_create.bif.h"
-#include "smb2_com_negotiate.bif.h"
-#include "smb2_com_read.bif.h"
-#include "smb2_com_session_setup.bif.h"
-#include "smb2_com_set_info.bif.h"
-#include "smb2_com_tree_connect.bif.h"
-#include "smb2_com_tree_disconnect.bif.h"
-#include "smb2_com_write.bif.h"
-#include "smb2_com_transform_header.bif.h"
+#include "analyzer/protocol/smb/smb2_com_close.bif.h"
+#include "analyzer/protocol/smb/smb2_com_create.bif.h"
+#include "analyzer/protocol/smb/smb2_com_negotiate.bif.h"
+#include "analyzer/protocol/smb/smb2_com_read.bif.h"
+#include "analyzer/protocol/smb/smb2_com_session_setup.bif.h"
+#include "analyzer/protocol/smb/smb2_com_set_info.bif.h"
+#include "analyzer/protocol/smb/smb2_com_tree_connect.bif.h"
+#include "analyzer/protocol/smb/smb2_com_tree_disconnect.bif.h"
+#include "analyzer/protocol/smb/smb2_com_write.bif.h"
+#include "analyzer/protocol/smb/smb2_com_transform_header.bif.h"
 %}
 
 analyzer SMB withcontext {
diff --git a/src/analyzer/protocol/smtp/SMTP.cc b/src/analyzer/protocol/smtp/SMTP.cc
index 8eb4d921cb..22aaf7ec06 100644
--- a/src/analyzer/protocol/smtp/SMTP.cc
+++ b/src/analyzer/protocol/smtp/SMTP.cc
@@ -10,7 +10,7 @@
 #include "zeek/Reporter.h"
 #include "zeek/analyzer/Manager.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/smtp/events.bif.h"
 
 #undef SMTP_CMD_DEF
 #define SMTP_CMD_DEF(cmd)	#cmd,
diff --git a/src/analyzer/protocol/snmp/SNMP.cc b/src/analyzer/protocol/snmp/SNMP.cc
index e2ebcca4e8..d3aeb9c8fd 100644
--- a/src/analyzer/protocol/snmp/SNMP.cc
+++ b/src/analyzer/protocol/snmp/SNMP.cc
@@ -4,8 +4,8 @@
 #include "zeek/Func.h"
 #include "zeek/Reporter.h"
 
-#include "types.bif.h"
-#include "events.bif.h"
+#include "analyzer/protocol/snmp/types.bif.h"
+#include "analyzer/protocol/snmp/events.bif.h"
 
 namespace zeek::analyzer::snmp {
 
diff --git a/src/analyzer/protocol/snmp/SNMP.h b/src/analyzer/protocol/snmp/SNMP.h
index d7074d9b62..828b31f490 100644
--- a/src/analyzer/protocol/snmp/SNMP.h
+++ b/src/analyzer/protocol/snmp/SNMP.h
@@ -2,7 +2,7 @@
 
 #pragma once
 
-#include "snmp_pac.h"
+#include "analyzer/protocol/snmp/snmp_pac.h"
 
 namespace zeek::analyzer::snmp {
 
diff --git a/src/analyzer/protocol/snmp/snmp.pac b/src/analyzer/protocol/snmp/snmp.pac
index ca14bff429..e32a9610cf 100644
--- a/src/analyzer/protocol/snmp/snmp.pac
+++ b/src/analyzer/protocol/snmp/snmp.pac
@@ -3,8 +3,8 @@
 
 %extern{
 #include "zeek/Reporter.h"
-#include "types.bif.h"
-#include "events.bif.h"
+#include "analyzer/protocol/snmp/types.bif.h"
+#include "analyzer/protocol/snmp/events.bif.h"
 %}
 
 analyzer SNMP withcontext {
diff --git a/src/analyzer/protocol/socks/SOCKS.cc b/src/analyzer/protocol/socks/SOCKS.cc
index e670309b08..e4a1a48a7b 100644
--- a/src/analyzer/protocol/socks/SOCKS.cc
+++ b/src/analyzer/protocol/socks/SOCKS.cc
@@ -2,8 +2,8 @@
 
 #include "zeek/analyzer/protocol/tcp/TCP_Reassembler.h"
 
-#include "socks_pac.h"
-#include "events.bif.h"
+#include "analyzer/protocol/socks/socks_pac.h"
+#include "analyzer/protocol/socks/events.bif.h"
 
 namespace zeek::analyzer::socks {
 
diff --git a/src/analyzer/protocol/socks/socks.pac b/src/analyzer/protocol/socks/socks.pac
index d3de8625ad..8778527193 100644
--- a/src/analyzer/protocol/socks/socks.pac
+++ b/src/analyzer/protocol/socks/socks.pac
@@ -5,7 +5,7 @@
 #include "zeek/analyzer/protocol/socks/SOCKS.h"
 #include "zeek/Reporter.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/socks/events.bif.h"
 %}
 
 analyzer SOCKS withcontext {
diff --git a/src/analyzer/protocol/ssh/SSH.cc b/src/analyzer/protocol/ssh/SSH.cc
index c05dd406f8..2b1fca11ef 100644
--- a/src/analyzer/protocol/ssh/SSH.cc
+++ b/src/analyzer/protocol/ssh/SSH.cc
@@ -5,8 +5,8 @@
 #include "zeek/analyzer/protocol/tcp/TCP_Reassembler.h"
 #include "zeek/Reporter.h"
 
-#include "types.bif.h"
-#include "events.bif.h"
+#include "analyzer/protocol/ssh/types.bif.h"
+#include "analyzer/protocol/ssh/events.bif.h"
 
 namespace zeek::analyzer::ssh {
 
diff --git a/src/analyzer/protocol/ssh/SSH.h b/src/analyzer/protocol/ssh/SSH.h
index aa42d93a86..e68dbec35e 100644
--- a/src/analyzer/protocol/ssh/SSH.h
+++ b/src/analyzer/protocol/ssh/SSH.h
@@ -4,8 +4,8 @@
 
 #include "zeek/analyzer/protocol/tcp/TCP.h"
 
-#include "events.bif.h"
-#include "ssh_pac.h"
+#include "analyzer/protocol/ssh/events.bif.h"
+#include "analyzer/protocol/ssh/ssh_pac.h"
 
 namespace zeek::analyzer::ssh {
 
diff --git a/src/analyzer/protocol/ssh/ssh.pac b/src/analyzer/protocol/ssh/ssh.pac
index 6fbab0105c..5fe486d966 100644
--- a/src/analyzer/protocol/ssh/ssh.pac
+++ b/src/analyzer/protocol/ssh/ssh.pac
@@ -8,8 +8,8 @@
 %include zeek.pac
 
 %extern{
-	#include "types.bif.h"
-	#include "events.bif.h"
+	#include "analyzer/protocol/ssh/types.bif.h"
+	#include "analyzer/protocol/ssh/events.bif.h"
 %}
 
 analyzer SSH withcontext {
diff --git a/src/analyzer/protocol/ssl/dtls.pac b/src/analyzer/protocol/ssl/dtls.pac
index 31021ed6bb..025d1ee261 100644
--- a/src/analyzer/protocol/ssl/dtls.pac
+++ b/src/analyzer/protocol/ssl/dtls.pac
@@ -10,8 +10,8 @@ using DTLSAnalyzer = zeek::analyzer::dtls::DTLS_Analyzer*;
 
 #include "zeek/analyzer/protocol/ssl/DTLS.h"
 
-#include "events.bif.h"
-#include "consts.bif.h"
+#include "analyzer/protocol/ssl/events.bif.h"
+#include "analyzer/protocol/ssl/consts.bif.h"
 %}
 
 extern type DTLSAnalyzer;
diff --git a/src/analyzer/protocol/ssl/ssl-defs.pac b/src/analyzer/protocol/ssl/ssl-defs.pac
index e13d6ca169..9c84c52c90 100644
--- a/src/analyzer/protocol/ssl/ssl-defs.pac
+++ b/src/analyzer/protocol/ssl/ssl-defs.pac
@@ -87,9 +87,9 @@ function version_ok(vers : uint16) : bool
 
 %extern{
 #include <string>
-using std::string;
+#include "analyzer/protocol/ssl/events.bif.h"
 
-#include "events.bif.h"
+using std::string;
 %}
 
 # a maximum of 100k for one record seems safe
diff --git a/src/analyzer/protocol/ssl/ssl.pac b/src/analyzer/protocol/ssl/ssl.pac
index 4619d27908..d0c06a3a4c 100644
--- a/src/analyzer/protocol/ssl/ssl.pac
+++ b/src/analyzer/protocol/ssl/ssl.pac
@@ -16,7 +16,7 @@ using SSLAnalyzer = zeek::analyzer::ssl::SSL_Analyzer*;
 #include "zeek/Desc.h"
 #include "zeek/analyzer/protocol/ssl/SSL.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/ssl/events.bif.h"
 %}
 
 extern type SSLAnalyzer;
diff --git a/src/analyzer/protocol/ssl/tls-handshake.pac b/src/analyzer/protocol/ssl/tls-handshake.pac
index d6ee3e162b..4ceb759ae5 100644
--- a/src/analyzer/protocol/ssl/tls-handshake.pac
+++ b/src/analyzer/protocol/ssl/tls-handshake.pac
@@ -6,8 +6,8 @@
 %extern{
 #include "zeek/Desc.h"
 
-#include "types.bif.h"
-#include "events.bif.h"
+#include "analyzer/protocol/ssl/types.bif.h"
+#include "analyzer/protocol/ssl/events.bif.h"
 %}
 
 analyzer TLSHandshake withcontext {
diff --git a/src/analyzer/protocol/stepping-stone/SteppingStone.cc b/src/analyzer/protocol/stepping-stone/SteppingStone.cc
index 174c9ef565..191c67fdeb 100644
--- a/src/analyzer/protocol/stepping-stone/SteppingStone.cc
+++ b/src/analyzer/protocol/stepping-stone/SteppingStone.cc
@@ -12,7 +12,7 @@
 #include "zeek/Sessions.h"
 #include "zeek/util.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/stepping-stone/events.bif.h"
 
 namespace zeek::analyzer::stepping_stone {
 
diff --git a/src/analyzer/protocol/syslog/Syslog.cc b/src/analyzer/protocol/syslog/Syslog.cc
index 1b51a4058a..ab9748ee6c 100644
--- a/src/analyzer/protocol/syslog/Syslog.cc
+++ b/src/analyzer/protocol/syslog/Syslog.cc
@@ -1,7 +1,7 @@
 #include "zeek/analyzer/protocol/syslog/Syslog.h"
 #include "zeek/analyzer/protocol/tcp/TCP_Reassembler.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/syslog/events.bif.h"
 
 namespace zeek::analyzer::syslog {
 
diff --git a/src/analyzer/protocol/syslog/syslog.pac b/src/analyzer/protocol/syslog/syslog.pac
index 3784d333b9..c5a9e251a7 100644
--- a/src/analyzer/protocol/syslog/syslog.pac
+++ b/src/analyzer/protocol/syslog/syslog.pac
@@ -3,7 +3,7 @@
 %include zeek.pac
 
 %extern{
-#include "events.bif.h"
+#include "analyzer/protocol/syslog/events.bif.h"
 %}
 
 analyzer Syslog withcontext {
diff --git a/src/analyzer/protocol/tcp/ContentLine.cc b/src/analyzer/protocol/tcp/ContentLine.cc
index fbef0f206b..1e5953dfe2 100644
--- a/src/analyzer/protocol/tcp/ContentLine.cc
+++ b/src/analyzer/protocol/tcp/ContentLine.cc
@@ -3,7 +3,7 @@
 #include "zeek/analyzer/protocol/tcp/TCP.h"
 #include "zeek/Reporter.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/tcp/events.bif.h"
 
 namespace zeek::analyzer::tcp {
 
diff --git a/src/analyzer/protocol/tcp/Stats.cc b/src/analyzer/protocol/tcp/Stats.cc
index c4fe33f866..73d65551b7 100644
--- a/src/analyzer/protocol/tcp/Stats.cc
+++ b/src/analyzer/protocol/tcp/Stats.cc
@@ -2,7 +2,7 @@
 
 #include "zeek/File.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/tcp/events.bif.h"
 
 namespace zeek::analyzer::tcp {
 
diff --git a/src/analyzer/protocol/tcp/TCP.cc b/src/analyzer/protocol/tcp/TCP.cc
index cf3d5062c6..bea7dd0209 100644
--- a/src/analyzer/protocol/tcp/TCP.cc
+++ b/src/analyzer/protocol/tcp/TCP.cc
@@ -16,8 +16,8 @@
 #include "zeek/Sessions.h"
 #include "zeek/DebugLogger.h"
 
-#include "events.bif.h"
-#include "types.bif.h"
+#include "analyzer/protocol/tcp/events.bif.h"
+#include "analyzer/protocol/tcp/types.bif.h"
 
 namespace { // local namespace
 	const bool DEBUG_tcp_data_sent = false;
diff --git a/src/analyzer/protocol/tcp/TCP_Endpoint.cc b/src/analyzer/protocol/tcp/TCP_Endpoint.cc
index 479d6ca85c..aeb9f2d822 100644
--- a/src/analyzer/protocol/tcp/TCP_Endpoint.cc
+++ b/src/analyzer/protocol/tcp/TCP_Endpoint.cc
@@ -14,7 +14,7 @@
 #include "zeek/File.h"
 #include "zeek/Val.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/tcp/events.bif.h"
 
 namespace zeek::analyzer::tcp {
 
diff --git a/src/analyzer/protocol/tcp/TCP_Reassembler.cc b/src/analyzer/protocol/tcp/TCP_Reassembler.cc
index ea65d6cc22..8d87ad36db 100644
--- a/src/analyzer/protocol/tcp/TCP_Reassembler.cc
+++ b/src/analyzer/protocol/tcp/TCP_Reassembler.cc
@@ -10,7 +10,7 @@
 #include "zeek/Reporter.h"
 #include "zeek/RuleMatcher.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/tcp/events.bif.h"
 
 namespace zeek::analyzer::tcp {
 
diff --git a/src/analyzer/protocol/udp/UDP.cc b/src/analyzer/protocol/udp/UDP.cc
index 7c478cbd92..ae4e2c89af 100644
--- a/src/analyzer/protocol/udp/UDP.cc
+++ b/src/analyzer/protocol/udp/UDP.cc
@@ -11,7 +11,7 @@
 #include "zeek/Reporter.h"
 #include "zeek/Conn.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/udp/events.bif.h"
 
 namespace zeek::analyzer::udp {
 
diff --git a/src/analyzer/protocol/vxlan/VXLAN.cc b/src/analyzer/protocol/vxlan/VXLAN.cc
index 3a3bfb73f7..a66a3b17fc 100644
--- a/src/analyzer/protocol/vxlan/VXLAN.cc
+++ b/src/analyzer/protocol/vxlan/VXLAN.cc
@@ -15,7 +15,7 @@ extern "C" {
 #include "zeek/packet_analysis/Manager.h"
 #include "zeek/packet_analysis/protocol/iptunnel/IPTunnel.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/vxlan/events.bif.h"
 
 namespace zeek::analyzer::vxlan {
 
diff --git a/src/analyzer/protocol/xmpp/XMPP.h b/src/analyzer/protocol/xmpp/XMPP.h
index a96bd2d50c..58b1e617ea 100644
--- a/src/analyzer/protocol/xmpp/XMPP.h
+++ b/src/analyzer/protocol/xmpp/XMPP.h
@@ -4,7 +4,7 @@
 
 #include "zeek/analyzer/protocol/tcp/TCP.h"
 
-#include "xmpp_pac.h"
+#include "analyzer/protocol/xmpp/xmpp_pac.h"
 
 namespace zeek::analyzer::xmpp {
 
diff --git a/src/analyzer/protocol/xmpp/xmpp.pac b/src/analyzer/protocol/xmpp/xmpp.pac
index ba102709a9..a81751583b 100644
--- a/src/analyzer/protocol/xmpp/xmpp.pac
+++ b/src/analyzer/protocol/xmpp/xmpp.pac
@@ -16,7 +16,7 @@ using XMPPAnalyzer = zeek::analyzer::xmpp::XMPP_Analyzer*;
 #include "zeek/Reporter.h"
 #include "zeek/analyzer/protocol/xmpp/XMPP.h"
 
-#include "events.bif.h"
+#include "analyzer/protocol/xmpp/events.bif.h"
 %}
 
 extern type XMPPAnalyzer;
diff --git a/src/file_analysis/analyzer/entropy/Entropy.h b/src/file_analysis/analyzer/entropy/Entropy.h
index 5b58567d9b..c6b3df96f8 100644
--- a/src/file_analysis/analyzer/entropy/Entropy.h
+++ b/src/file_analysis/analyzer/entropy/Entropy.h
@@ -9,7 +9,7 @@
 #include "zeek/file_analysis/File.h"
 #include "zeek/file_analysis/Analyzer.h"
 
-#include "events.bif.h"
+#include "file_analysis/analyzer/entropy/events.bif.h"
 
 namespace zeek::file_analysis::detail {
 
diff --git a/src/file_analysis/analyzer/hash/Hash.h b/src/file_analysis/analyzer/hash/Hash.h
index 1042cbd7a8..927673b2cb 100644
--- a/src/file_analysis/analyzer/hash/Hash.h
+++ b/src/file_analysis/analyzer/hash/Hash.h
@@ -9,7 +9,7 @@
 #include "zeek/file_analysis/File.h"
 #include "zeek/file_analysis/Analyzer.h"
 
-#include "events.bif.h"
+#include "file_analysis/analyzer/hash/events.bif.h"
 
 namespace zeek::file_analysis::detail {
 
diff --git a/src/file_analysis/analyzer/pe/PE.h b/src/file_analysis/analyzer/pe/PE.h
index f11eb8bdc5..86d5326a29 100644
--- a/src/file_analysis/analyzer/pe/PE.h
+++ b/src/file_analysis/analyzer/pe/PE.h
@@ -4,7 +4,7 @@
 
 #include "zeek/Val.h"
 #include "zeek/File.h"
-#include "pe_pac.h"
+#include "file_analysis/analyzer/pe/pe_pac.h"
 
 namespace zeek::file_analysis::detail {
 
diff --git a/src/file_analysis/analyzer/pe/pe-analyzer.pac b/src/file_analysis/analyzer/pe/pe-analyzer.pac
index e50642a6ab..8b02aa3661 100644
--- a/src/file_analysis/analyzer/pe/pe-analyzer.pac
+++ b/src/file_analysis/analyzer/pe/pe-analyzer.pac
@@ -2,7 +2,7 @@
 #include "zeek/Event.h"
 #include "zeek/file_analysis/File.h"
 
-#include "events.bif.h"
+#include "file_analysis/analyzer/pe/events.bif.h"
 %}
 
 %header{
diff --git a/src/file_analysis/analyzer/unified2/Unified2.h b/src/file_analysis/analyzer/unified2/Unified2.h
index a6f010b757..e79302cd36 100644
--- a/src/file_analysis/analyzer/unified2/Unified2.h
+++ b/src/file_analysis/analyzer/unified2/Unified2.h
@@ -7,7 +7,7 @@
 #include "zeek/Val.h"
 #include "zeek/file_analysis/File.h"
 #include "zeek/file_analysis/Analyzer.h"
-#include "unified2_pac.h"
+#include "file_analysis/analyzer/unified2/unified2_pac.h"
 
 namespace zeek::file_analysis::detail {
 
diff --git a/src/file_analysis/analyzer/unified2/unified2-analyzer.pac b/src/file_analysis/analyzer/unified2/unified2-analyzer.pac
index 6860d0f7da..f1af68ea00 100644
--- a/src/file_analysis/analyzer/unified2/unified2-analyzer.pac
+++ b/src/file_analysis/analyzer/unified2/unified2-analyzer.pac
@@ -4,8 +4,8 @@
 #include "zeek/file_analysis/File.h"
 #include "zeek/IPAddr.h"
 
-#include "events.bif.h"
-#include "types.bif.h"
+#include "file_analysis/analyzer/unified2/events.bif.h"
+#include "file_analysis/analyzer/unified2/types.bif.h"
 %}
 
 %code{
diff --git a/src/file_analysis/analyzer/x509/OCSP.cc b/src/file_analysis/analyzer/x509/OCSP.cc
index 98988945be..dda8dd50d6 100644
--- a/src/file_analysis/analyzer/x509/OCSP.cc
+++ b/src/file_analysis/analyzer/x509/OCSP.cc
@@ -16,8 +16,8 @@
 #include "zeek/file_analysis/File.h"
 #include "zeek/file_analysis/Manager.h"
 
-#include "types.bif.h"
-#include "ocsp_events.bif.h"
+#include "file_analysis/analyzer/x509/types.bif.h"
+#include "file_analysis/analyzer/x509/ocsp_events.bif.h"
 
 // helper function of sk_X509_value to avoid namespace problem
 // sk_X509_value(X,Y) = > SKM_sk_value(X509,X,Y)
diff --git a/src/file_analysis/analyzer/x509/X509.cc b/src/file_analysis/analyzer/x509/X509.cc
index 8716b72291..47a8a4a14c 100644
--- a/src/file_analysis/analyzer/x509/X509.cc
+++ b/src/file_analysis/analyzer/x509/X509.cc
@@ -18,8 +18,8 @@
 #include "zeek/file_analysis/File.h"
 #include "zeek/file_analysis/Manager.h"
 
-#include "events.bif.h"
-#include "types.bif.h"
+#include "file_analysis/analyzer/x509/events.bif.h"
+#include "file_analysis/analyzer/x509/types.bif.h"
 
 namespace zeek::file_analysis::detail {
 
diff --git a/src/file_analysis/analyzer/x509/X509Common.cc b/src/file_analysis/analyzer/x509/X509Common.cc
index 6cc1742bca..71bd69be59 100644
--- a/src/file_analysis/analyzer/x509/X509Common.cc
+++ b/src/file_analysis/analyzer/x509/X509Common.cc
@@ -10,10 +10,10 @@
 
 #include "zeek/Reporter.h"
 
-#include "x509-extension_pac.h"
-#include "events.bif.h"
-#include "ocsp_events.bif.h"
-#include "types.bif.h"
+#include "file_analysis/analyzer/x509/x509-extension_pac.h"
+#include "file_analysis/analyzer/x509/events.bif.h"
+#include "file_analysis/analyzer/x509/ocsp_events.bif.h"
+#include "file_analysis/analyzer/x509/types.bif.h"
 
 namespace zeek::file_analysis::detail {
 
diff --git a/src/file_analysis/analyzer/x509/functions.bif b/src/file_analysis/analyzer/x509/functions.bif
index a7fc60dbd4..21916c02f3 100644
--- a/src/file_analysis/analyzer/x509/functions.bif
+++ b/src/file_analysis/analyzer/x509/functions.bif
@@ -9,7 +9,7 @@
 #include "zeek/file_analysis/analyzer/x509/X509.h"
 #include "zeek/net_util.h"
 
-#include "types.bif.h"
+#include "file_analysis/analyzer/x509/types.bif.h"
 
 // construct an error record
 static zeek::RecordValPtr x509_result_record(uint64_t num, const char* reason, zeek::ValPtr chainVector = nullptr)
diff --git a/src/file_analysis/analyzer/x509/x509-extension.pac b/src/file_analysis/analyzer/x509/x509-extension.pac
index ee95cad648..b98e6a31b2 100644
--- a/src/file_analysis/analyzer/x509/x509-extension.pac
+++ b/src/file_analysis/analyzer/x509/x509-extension.pac
@@ -7,8 +7,8 @@
 %extern{
 #include "zeek/file_analysis/File.h"
 
-#include "types.bif.h"
-#include "events.bif.h"
+#include "file_analysis/analyzer/x509/types.bif.h"
+#include "file_analysis/analyzer/x509/events.bif.h"
 %}
 
 analyzer X509Extension withcontext {
diff --git a/src/input/readers/ascii/Ascii.cc b/src/input/readers/ascii/Ascii.cc
index 08f65f1fb9..330cbc9f5a 100644
--- a/src/input/readers/ascii/Ascii.cc
+++ b/src/input/readers/ascii/Ascii.cc
@@ -10,7 +10,7 @@
 
 #include "zeek/threading/SerialTypes.h"
 
-#include "ascii.bif.h"
+#include "input/readers/ascii/ascii.bif.h"
 
 using namespace std;
 using zeek::threading::Value;
diff --git a/src/input/readers/benchmark/Benchmark.cc b/src/input/readers/benchmark/Benchmark.cc
index 736d7d87e6..1cd2b2c6da 100644
--- a/src/input/readers/benchmark/Benchmark.cc
+++ b/src/input/readers/benchmark/Benchmark.cc
@@ -10,7 +10,7 @@
 #include "zeek/threading/SerialTypes.h"
 #include "zeek/threading/Manager.h"
 
-#include "benchmark.bif.h"
+#include "input/readers/benchmark/benchmark.bif.h"
 
 using threading::Value;
 using threading::Field;
diff --git a/src/input/readers/config/Config.cc b/src/input/readers/config/Config.cc
index b014b9ea64..0a3d33811c 100644
--- a/src/input/readers/config/Config.cc
+++ b/src/input/readers/config/Config.cc
@@ -13,7 +13,7 @@
 #include "zeek/input/Manager.h"
 #include "zeek/threading/SerialTypes.h"
 
-#include "config.bif.h"
+#include "input/readers/config/config.bif.h"
 
 using zeek::threading::Value;
 using zeek::threading::Field;
diff --git a/src/iosource/PktSrc.cc b/src/iosource/PktSrc.cc
index 1c4821aff0..d6e053fa1a 100644
--- a/src/iosource/PktSrc.cc
+++ b/src/iosource/PktSrc.cc
@@ -14,7 +14,7 @@
 #include "zeek/packet_analysis/Manager.h"
 #include "zeek/iosource/BPF_Program.h"
 
-#include "pcap/pcap.bif.h"
+#include "iosource/pcap/pcap.bif.h"
 
 namespace zeek::iosource {
 
diff --git a/src/iosource/pcap/Dumper.cc b/src/iosource/pcap/Dumper.cc
index d05a3fb274..e84fbef861 100644
--- a/src/iosource/pcap/Dumper.cc
+++ b/src/iosource/pcap/Dumper.cc
@@ -8,7 +8,7 @@
 #include "zeek/iosource/PktSrc.h"
 #include "zeek/RunState.h"
 
-#include "pcap.bif.h"
+#include "iosource/pcap/pcap.bif.h"
 
 namespace zeek::iosource::pcap {
 
diff --git a/src/iosource/pcap/Source.cc b/src/iosource/pcap/Source.cc
index 905b689b21..3f6fc9d777 100644
--- a/src/iosource/pcap/Source.cc
+++ b/src/iosource/pcap/Source.cc
@@ -11,7 +11,7 @@
 #include "zeek/iosource/BPF_Program.h"
 #include "zeek/Event.h"
 
-#include "pcap.bif.h"
+#include "iosource/pcap/pcap.bif.h"
 
 namespace zeek::iosource::pcap {
 
diff --git a/src/logging/Manager.cc b/src/logging/Manager.cc
index 617cb6fd0b..889d4630f6 100644
--- a/src/logging/Manager.cc
+++ b/src/logging/Manager.cc
@@ -26,7 +26,7 @@
 #include "zeek/plugin/Plugin.h"
 #include "zeek/plugin/Manager.h"
 
-#include "logging.bif.h"
+#include "logging/logging.bif.h"
 
 using namespace std;
 
diff --git a/src/logging/writers/ascii/Ascii.cc b/src/logging/writers/ascii/Ascii.cc
index a2a50fd0c7..a032381f0a 100644
--- a/src/logging/writers/ascii/Ascii.cc
+++ b/src/logging/writers/ascii/Ascii.cc
@@ -21,7 +21,7 @@
 #include "zeek/logging/Manager.h"
 #include "zeek/threading/SerialTypes.h"
 
-#include "ascii.bif.h"
+#include "logging/writers/ascii/ascii.bif.h"
 
 using namespace std;
 using zeek::threading::Value;
diff --git a/src/logging/writers/none/None.cc b/src/logging/writers/none/None.cc
index c123de1106..ab02c12cef 100644
--- a/src/logging/writers/none/None.cc
+++ b/src/logging/writers/none/None.cc
@@ -3,7 +3,7 @@
 #include <algorithm>
 #include <iostream>
 
-#include "none.bif.h"
+#include "logging/writers/none/none.bif.h"
 
 namespace zeek::logging::writer::detail {
 
diff --git a/src/logging/writers/sqlite/SQLite.cc b/src/logging/writers/sqlite/SQLite.cc
index 899bbaf6d6..e3977d32d8 100644
--- a/src/logging/writers/sqlite/SQLite.cc
+++ b/src/logging/writers/sqlite/SQLite.cc
@@ -9,7 +9,7 @@
 
 #include "zeek/threading/SerialTypes.h"
 
-#include "sqlite.bif.h"
+#include "logging/writers/sqlite/sqlite.bif.h"
 
 using namespace std;
 using zeek::threading::Value;
diff --git a/src/packet_analysis/protocol/arp/ARP.cc b/src/packet_analysis/protocol/arp/ARP.cc
index 822a10f4de..0edf0816dd 100644
--- a/src/packet_analysis/protocol/arp/ARP.cc
+++ b/src/packet_analysis/protocol/arp/ARP.cc
@@ -15,7 +15,7 @@
 
 #include "zeek/Event.h"
 
-#include "events.bif.h"
+#include "packet_analysis/protocol/arp/events.bif.h"
 
 using namespace zeek::packet_analysis::ARP;