diff --git a/NEWS b/NEWS index 128fc161ba..c5271f3a92 100644 --- a/NEWS +++ b/NEWS @@ -91,6 +91,19 @@ New Functionality To disable this functionality, pass ``--disable-javascript`` to configure. +- Zeek now comes with Spicy support built in, meaning it can now + leverage any analyzers written in Spicy out of the box. While the + interface layer connecting Zeek and Spicy used to be implemented + through an external Zeek plugin, that code has now moved into the + Zeek code base itself. We also added infrastructure to Zeek that + enables its built-in standard analyzers to use Spicy instead of + Binpac. As initial (simple) examples, Zeek's Syslog and Finger + analyzers are now implemented in Spicy. While their legacy versions + remain available as fallbacks for now in case Spicy gets explicitly + disabled at build time, their use is deprecated and their code won't + be maintained any further. (Some of these Spicy updates were part of + Zeek 5.2 already, but hadn't been included in its NEWS section.) + - Zeek events now hold network timestamps. For scheduled events, the timestamp represents the network time for which the event was scheduled for, otherwise it is the network time at event creation. A new bif ``current_event_time()``