[Bro-Dev] design summary: porting Bro scripts to use Broker

Siwek, Jon jsiwek at illinois.edu
Wed Oct 11 10:34:23 PDT 2017

> On Oct 10, 2017, at 2:10 PM, Johanna Amann <johanna at icir.org> wrote:
> it - after you set up a store with Broker::InitStore, how do you interact
> with Software::tracked_store?

Probably best to look at this Broker script API:


e.g. you have get/push/etc. operations you can do on it, like this example:


> I am especially curious how this handles the strong typing of Bro.

All data in stores are an opaque Data type and the store operations (e.g. from API in link above) implicitly convert Bro types into that type.

Then when retrieving data from a store, to convert Data to Bro values, you can use new ‘is’ or ‘as’ operators or a new type-based-switch-statement.  Example:


- Jon

More information about the bro-dev mailing list