[Bro-Dev] How to use Broker::Data in an event handler?
Jon Siwek
jsiwek at corelight.com
Tue Sep 11 08:09:58 PDT 2018
On Tue, Sep 11, 2018 at 5:52 AM Matthias Vallentin <vallentin at icir.org> wrote:
> One more question: how would I capture a default-constructed
> broker::Data() in a case statement? This would happen when I publish
> just "None" on the Python side. In Bro, it shows up on the command
> line as "broker::data{nil}".
There's no nil/null/none type in Bro, so only way I can think to do it
at the moment is:
function is_nil(x: any): bool
{
if ( ! (x is Broker::Data) )
return F;
local d = x as Broker::Data;
if ( ! d?$data )
return T;
if ( cat(d$data) != "broker::data{nil}" )
return F;
return T;
}
Or in switch case, it's like:
case type Broker::Data as d:
print "Broker::Data, expected to be nil", d?$data, d?$data ?
cat(d$data) : "nil";
# or use the same logic from the is_nil() function above
- Jon
More information about the bro-dev
mailing list