[Bro] ANALYZER_* resolution
justin at justinthomas.name
Fri Dec 7 21:09:39 PST 2012
I'll get the hang of this one way another; thanks for the pointer.
On Fri, Dec 7, 2012 at 6:33 PM, Seth Hall <seth at icir.org> wrote:
> On Dec 7, 2012, at 8:35 PM, Justin Thomas <justin at justinthomas.name>
> > Instead of that "13" at the end, I want "ANALYZE_HTTP". But obviously, I
> don't want to just make that association manually - I'm sure there must be
> a way to get the analyzer name programmatically, I just can't seem to find
> ## Translate an analyzer type to an ASCII string.
> ## aid: The analyzer ID.
> ## Returns: The analyzer *aid* as string.
> ## .. bro:see:: expect_connection disable_analyzer current_analyzer
> function analyzer_name%(aid: count%) : string
> That should work.
> Seth Hall
> International Computer Science Institute
> (Bro) because everyone has a network
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Bro