Merge branch 'topic/corelight/reporter-hook' of https://github.com/corelight/bro

* 'topic/corelight/reporter-hook' of https://github.com/corelight/bro:
  Add reporter hook.
This commit is contained in:
Jon Siwek 2017-11-21 12:19:28 -06:00
commit 787b1e6bf2
13 changed files with 287 additions and 3 deletions

View file

@ -355,6 +355,39 @@ public:
int num_fields, const threading::Field* const* fields,
threading::Value** vals) const;
/**
* Hook into reporting. This method will be called for each reporter call
* made; this includes weirds. The method cannot manipulate the data at
* the current time; however it is possible to prevent script-side events
* from being called by returning false.
*
* @param prefix The prefix passed by the reporter framework
*
* @param event The event to be called
*
* @param conn The associated connection
*
* @param addl Additional Bro values; typically will be passed to the event
* by the reporter framework.
*
* @param location True if event expects location information
*
* @param location1 First location
*
* @param location2 Second location
*
* @param time True if event expects time information
*
* @param message Message supplied by the reporter framework
*
* @return true if event should be called by the reporter framework, false
* if the event call should be skipped
*/
bool HookReporter(const std::string& prefix, const EventHandlerPtr event,
const Connection* conn, const val_list* addl, bool location,
const Location* location1, const Location* location2,
bool time, const std::string& message);
/**
* Internal method that registers a freshly instantiated plugin with
* the manager.