diff --git a/NEWS b/NEWS index 72bae2258c..be99983751 100644 --- a/NEWS +++ b/NEWS @@ -25,9 +25,9 @@ Breaking Changes metadata to justify the complexity of treating it separate. - The ``current_event_time()`` builtin function as well as ``Event::Time()`` - and ``EventMgr::CurrentEventTime()`` now return ``-1.0`` if not timestamp + and ``EventMgr::CurrentEventTime()`` now return ``-1.0`` if no timestamp metadata is available for the current event, or if no event is being - dispatched. Previously this would've likely been 0.0, or the previously + dispatched. Previously this would've been 0.0, or the timestamp of the previously dispatched event. - Missing network timestamp metadata on remote events is not set to the local @@ -40,6 +40,10 @@ Breaking Changes New Functionality ----------------- +- Generic event metadata support. A new ``EventMetadata`` module was added allowing + to register generic event metadata types and accessing the current event's metadata + using the functions ``current()`` and ``current_all()`` of this module. + - A new plugin hook, ``HookPublishEvent()``, has been added for intercepting publishing of Zeek events. This hook may be used for monitoring purposes, modifying or rerouting remote events.