diff --git a/scripts/base/frameworks/intel/input.zeek b/scripts/base/frameworks/intel/input.zeek index 0a61a0a052..49ab260e23 100644 --- a/scripts/base/frameworks/intel/input.zeek +++ b/scripts/base/frameworks/intel/input.zeek @@ -21,16 +21,37 @@ export { ## additionally. const path_prefix = "" &redef; - event Intel::read_entry(desc: Input::EventDescription, tpe: Input::Event, item: Intel::Item) - { - Intel::insert(item); - } + ## This event is raised each time the intel framework reads a new line + ## from an intel file. It is used in the intel framework but can + ## also be used in custom scripts for further checks. + ## + ## desc: The :zeek:type:`Input::EventDescription` record which generated the event. + ## + ## tpe: The type of input event. + ## + ## item: The intel item being read (of type :zeek:type:`Intel::Item`). + ## + global read_entry: event(desc: Input::EventDescription, tpe: Input::Event, item: Intel::Item); - event Intel::read_error(desc: Input::EventDescription, message: string, level: Reporter::Level) - { - } + ## This event is raised each time the input framework detects an error + ## while reading the intel file. It can be used to implement further checks + ## in custom scripts. Errors can be of different levels (information, warning, errors). + ## + ## desc: The :zeek:type:`Input::EventDescription` record which generated the error. + ## + ## message: An error message. + ## + ## level: The :zeek:type:`Reporter::Level` of the error. + ## + global read_error: event(desc: Input::EventDescription, message: string, level: Reporter::Level); } +event Intel::read_entry(desc: Input::EventDescription, tpe: Input::Event, item: Intel::Item) + { + Intel::insert(item); + } + + event zeek_init() &priority=5 { if ( ! Cluster::is_enabled() ||