diff --git a/src/event.bif b/src/event.bif index dc5dda51bb..638a7ce141 100644 --- a/src/event.bif +++ b/src/event.bif @@ -7001,7 +7001,7 @@ event event_queue_flush_point%(%); event get_file_handle%(tag: count, c: connection, is_orig: bool%); ## Indicates that a analysis of a new file has begun. The analysis can be -## augmented at this time via :bro:see:`FileAnalysis::add_action`. +## augmented at this time via :bro:see:`FileAnalysis::add_analyzer`. ## ## f: The file. ## @@ -7024,8 +7024,8 @@ event file_over_new_connection%(f: fa_file, c: connection%); ## f: The file. ## ## .. bro:see:: file_new file_over_new_connection file_gap file_state_remove -## default_file_timeout_interval FileAnalysis::postpone_timeout -## FileAnalysis::set_timeout_interval +## default_file_timeout_interval FileAnalysis::postpone_timeout +## FileAnalysis::set_timeout_interval event file_timeout%(f: fa_file%); ## Indicates that a chunk of the file is missing. @@ -7054,8 +7054,8 @@ event file_state_remove%(f: fa_file%); ## ## hash: The result of the hashing. ## -## .. bro:see:: FileAnalysis::add_action FileAnalysis::ACTION_MD5 -## FileAnalysis::ACTION_SHA1 FileAnalysis::ACTION_SHA256 +## .. bro:see:: FileAnalysis::add_analyzer FileAnalysis::ANALYZER_MD5 +## FileAnalysis::ANALYZER_SHA1 FileAnalysis::ANALYZER_SHA256 event file_hash%(f: fa_file, kind: string, hash: string%); ## Deprecated. Will be removed. diff --git a/src/file_analysis.bif b/src/file_analysis.bif index 67e692aacf..a2ef2b3e9f 100644 --- a/src/file_analysis.bif +++ b/src/file_analysis.bif @@ -91,16 +91,14 @@ function FileAnalysis::__eof%(source: string%): any module GLOBAL; -## For use within a :bro:see:`get_file_handle` handler to return a unique -## identifier to associate with some buffered input to the file analysis -## framework. The buffered data will then immediately be allowed to pass -## pass through the file analysis framework and execute any policy hooks -## that are available. If an empty string is returned, that signifies that -## the buffered data will be discarded with no further action taken on it. +## For use within a :bro:see:`get_file_handle` handler to set a unique +## identifier to associate with the current input to the file analysis +## framework. Using an empty string for the handle signifies that the +## input will be ignored/discarded. ## ## handle: A string that uniquely identifies a file. ## -## .. bro:see:: get_file_handle FileAnalysis::policy +## .. bro:see:: get_file_handle function set_file_handle%(handle: string%): any %{ file_mgr->SetHandle(handle->CheckString());