> 1. What is the proper procedure for having bifs (built-in-functions) added > to the core of bro? Send me contextual diffs and a bit of text documenting the functionality. > 2. In short, in the .97 build how do you write to the syslog from a ".bro" > policy script? The "log" statement is now called "alarm". Vern