[Bro] Determine potential events with a specific set of *.bro scripts
vern at icir.org
Fri Dec 5 14:09:22 PST 2008
> I would like to determine which events could potentially be generated
> after loading a specific set of scripts. Has anyone tried this before?
Internal to Bro there's an analysis of which declared events do not
have any means of being generated (this is the reporting enabled by
redef check_for_unused_event_handlers = T). It should be straightforward
to tweak that to report on which events *can* be generated.
> In this context, I remember seeing a script some time ago, that created
> a dependency/include graph of *.bro policy files. Unfortunately, I lost
> track of it.
(I don't recall this either.)
More information about the Bro