[Bro-Dev] changing Notice::policy mechanism

Siwek, Jonathan Luke jsiwek at illinois.edu
Mon Nov 5 08:57:55 PST 2012


> I feel like we need to better determine just what problem we want/need to
> solve in order to then think about how to coherently provide better support
> for it.

I think the construct we need to solve the problem already exists purely in the script-layer:

    type TriggerFunc: function(n: Notice::Info): bool;
    global Notice::policy: vector of set[TriggerFunc];

I think that the issue is it being cumbersome to manipulate/redef?  So we're working around that with the new proposal, but maybe we can do more to make redefining something like that syntactically clean and easy?

    Jon


More information about the bro-dev mailing list