mirror of
https://github.com/zeek/zeek.git
synced 2025-10-03 15:18:20 +00:00
7e9d48f532
The broxygen-generated files now live in the git repo, have tests that check that they are up-to-date, and a script to re-generate them on-demand.
466 lines
11 KiB
ReStructuredText
466 lines
11 KiB
ReStructuredText
:orphan:
|
|
|
|
Package: base/bif
|
|
=================
|
|
|
|
|
|
:doc:`/scripts/base/bif/const.bif.bro`
|
|
|
|
Declaration of various scripting-layer constants that the Bro core uses
|
|
internally. Documentation and default values for the scripting-layer
|
|
variables themselves are found in :doc:`/scripts/base/init-bare.bro`.
|
|
|
|
:doc:`/scripts/base/bif/types.bif.bro`
|
|
|
|
Declaration of various types that the Bro core uses internally.
|
|
|
|
:doc:`/scripts/base/bif/bro.bif.bro`
|
|
|
|
A collection of built-in functions that implement a variety of things
|
|
such as general programming algorithms, string processing, math functions,
|
|
introspection, type conversion, file/directory manipulation, packet
|
|
filtering, interprocess communication and controlling protocol analyzer
|
|
behavior.
|
|
|
|
You'll find most of Bro's built-in functions that aren't protocol-specific
|
|
in this file.
|
|
|
|
:doc:`/scripts/base/bif/stats.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/reporter.bif.bro`
|
|
|
|
The reporter built-in functions allow for the scripting layer to
|
|
generate messages of varying severity. If no event handlers
|
|
exist for reporter messages, the messages are output to stderr.
|
|
If event handlers do exist, it's assumed they take care of determining
|
|
how/where to output the messages.
|
|
|
|
See :doc:`/scripts/base/frameworks/reporter/main.bro` for a convenient
|
|
reporter message logging framework.
|
|
|
|
:doc:`/scripts/base/bif/strings.bif.bro`
|
|
|
|
Definitions of built-in functions related to string processing and
|
|
manipulation.
|
|
|
|
:doc:`/scripts/base/bif/option.bif.bro`
|
|
|
|
Definitions of built-in functions that allow the scripting layer to
|
|
change the value of options and to be notified when option values change.
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_SNMP.types.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_KRB.types.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/event.bif.bro`
|
|
|
|
The protocol-independent events that the C/C++ core of Bro can generate.
|
|
|
|
This is mostly events not related to a specific transport- or
|
|
application-layer protocol, but also includes a few that may be generated
|
|
by more than one protocols analyzer (like events generated by both UDP and
|
|
TCP analysis.)
|
|
|
|
:doc:`/scripts/base/bif/logging.bif.bro`
|
|
|
|
Internal functions and types used by the logging framework.
|
|
|
|
:doc:`/scripts/base/bif/comm.bif.bro`
|
|
|
|
Functions and events regarding Bro's broker communication mechanisms.
|
|
|
|
:doc:`/scripts/base/bif/messaging.bif.bro`
|
|
|
|
Functions for peering and various messaging patterns.
|
|
|
|
:doc:`/scripts/base/bif/data.bif.bro`
|
|
|
|
Functions for inspecting and manipulating broker data.
|
|
|
|
:doc:`/scripts/base/bif/store.bif.bro`
|
|
|
|
Functions to interface with broker's distributed data store.
|
|
|
|
:doc:`/scripts/base/bif/input.bif.bro`
|
|
|
|
Internal functions and types used by the input framework.
|
|
|
|
:doc:`/scripts/base/bif/analyzer.bif.bro`
|
|
|
|
Internal functions and types used by the analyzer framework.
|
|
|
|
:doc:`/scripts/base/bif/file_analysis.bif.bro`
|
|
|
|
Internal functions and types used by the file analysis framework.
|
|
|
|
:doc:`/scripts/base/bif/__load__.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/broxygen.bif.bro`
|
|
|
|
Functions for querying script, package, or variable documentation.
|
|
|
|
:doc:`/scripts/base/bif/pcap.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/bloom-filter.bif.bro`
|
|
|
|
Functions to create and manipulate Bloom filters.
|
|
|
|
:doc:`/scripts/base/bif/cardinality-counter.bif.bro`
|
|
|
|
Functions to create and manipulate probabilistic cardinality counters.
|
|
|
|
:doc:`/scripts/base/bif/top-k.bif.bro`
|
|
|
|
Functions to probabilistically determine top-k elements.
|
|
|
|
:doc:`/scripts/base/bif/plugins/__load__.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_ARP.events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_BackDoor.events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_BitTorrent.events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_ConnSize.events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_ConnSize.functions.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_DCE_RPC.consts.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_DCE_RPC.types.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_DCE_RPC.events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_DHCP.events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_DHCP.types.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_DNP3.events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_DNS.events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_File.events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_Finger.events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_FTP.events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_FTP.functions.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_Gnutella.events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_GSSAPI.events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_GTPv1.events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_HTTP.events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_HTTP.functions.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_ICMP.events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_Ident.events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_IMAP.events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_InterConn.events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_IRC.events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_KRB.events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_Login.events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_Login.functions.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_MIME.events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_Modbus.events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_MySQL.events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_NCP.events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_NCP.consts.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_NetBIOS.events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_NetBIOS.functions.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_NTLM.types.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_NTLM.events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_NTP.events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_POP3.events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_RADIUS.events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_RDP.events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_RDP.types.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_RFB.events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_RPC.events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_SIP.events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_SNMP.events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_SMB.smb1_com_check_directory.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_SMB.smb1_com_close.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_SMB.smb1_com_create_directory.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_SMB.smb1_com_echo.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_SMB.smb1_com_logoff_andx.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_SMB.smb1_com_negotiate.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_SMB.smb1_com_nt_create_andx.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_SMB.smb1_com_nt_cancel.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_SMB.smb1_com_query_information.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_SMB.smb1_com_read_andx.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_SMB.smb1_com_session_setup_andx.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_SMB.smb1_com_transaction.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_SMB.smb1_com_transaction_secondary.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_SMB.smb1_com_transaction2.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_SMB.smb1_com_transaction2_secondary.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_SMB.smb1_com_tree_connect_andx.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_SMB.smb1_com_tree_disconnect.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_SMB.smb1_com_write_andx.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_SMB.smb1_events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_SMB.smb2_com_close.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_SMB.smb2_com_create.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_SMB.smb2_com_negotiate.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_SMB.smb2_com_read.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_SMB.smb2_com_session_setup.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_SMB.smb2_com_set_info.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_SMB.smb2_com_tree_connect.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_SMB.smb2_com_tree_disconnect.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_SMB.smb2_com_write.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_SMB.smb2_events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_SMB.events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_SMB.consts.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_SMB.types.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_SMTP.events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_SMTP.functions.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_SOCKS.events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_SSH.types.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_SSH.events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_SSL.types.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_SSL.events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_SSL.functions.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_SteppingStone.events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_Syslog.events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_TCP.events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_TCP.functions.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_Teredo.events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_UDP.events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_XMPP.events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_FileEntropy.events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_FileExtract.events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_FileExtract.functions.bif.bro`
|
|
|
|
Internal functions used by the extraction file analyzer.
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_FileHash.events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_PE.events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_Unified2.events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_Unified2.types.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_X509.events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_X509.types.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_X509.functions.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_X509.ocsp_events.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_AsciiReader.ascii.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_BenchmarkReader.benchmark.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_BinaryReader.binary.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_ConfigReader.config.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_RawReader.raw.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_SQLiteReader.sqlite.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_AsciiWriter.ascii.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_NoneWriter.none.bif.bro`
|
|
|
|
|
|
:doc:`/scripts/base/bif/plugins/Bro_SQLiteWriter.sqlite.bif.bro`
|
|
|
|
|