Built-In Functions (BIFs)

base/bro.bif.bro

A collection of built-in functions that implement a variety of things such as general programming algorithms, string processing, math functions, introspection, type conversion, file/directory manipulation, packet filtering, inter-process communication and controlling protocol analyzer behavior.

base/const.bif.bro

Declaration of various scripting-layer constants that the Bro core uses internally. Documentation and default values for the scripting-layer variables themselves are found in base/init-bare.bro.

base/event.bif.bro

The events that the C/C++ core of Bro can generate. This is mostly consisting of high-level network events that protocol analyzers detect, but there are also several general-utility events generated by internal Bro frameworks.

base/logging.bif.bro

Internal functions and types used by the logging framework.

base/reporter.bif.bro

The reporter built-in functions allow for the scripting layer to generate messages of varying severity. If no event handlers exist for reporter messages, the messages are output to stderr. If event handlers do exist, it’s assumed they take care of determining how/where to output the messages.

See base/frameworks/reporter/main.bro for a convenient reporter message logging framework.

base/strings.bif.bro

Definitions of built-in functions related to string processing and manipulation.

base/types.bif.bro

Declaration of various types that the Bro core uses internally.