Determine potential events with a specific set of *.bro scripts

Zeek
1

Hi,

I would like to determine which events could potentially be generated
after loading a specific set of scripts. Has anyone tried this before?

In this context, I remember seeing a script some time ago, that created
a dependency/include graph of *.bro policy files. Unfortunately, I lost
track of it.

   Matthias

2

I would like to determine which events could potentially be generated
after loading a specific set of scripts. Has anyone tried this before?

Internal to Bro there's an analysis of which declared events do not
have any means of being generated (this is the reporting enabled by
redef check_for_unused_event_handlers = T). It should be straightforward
to tweak that to report on which events *can* be generated.

In this context, I remember seeing a script some time ago, that created
a dependency/include graph of *.bro policy files. Unfortunately, I lost
track of it.

(I don't recall this either.)

    Vern

3

I think you're referring to the plot I made a long time ago of the @load
structure of the policy files:

  http://www.icir.org/christian/bro/brodep.pdf

Alas, I can't seem to find any of the scripts I used. It only took a few
minutes to create though, using GraphViz.

4

Thanks for the pointer, I attached a little patch that does exactly
that.

   Matthias

dump_used_event_handlers.patch (3 KB)

5

Yes, that's the labyrinthine picture I had in my mind. Crazy...

   Matthias