Null / None / undef in Bro policy scripts


is there a NULL (or nil, None, undef) for the policy layer for record
types? I would like to have an event, with a record type in its
parameter list. But the record can be NULL....
How can I do this?


There isn't a way to specify a missing record, but you could do a record with all optional and default fields. Or maybe even something like this...

type whatever: record {
  empty: bool &default=T; of data...

You could test for the empty key being set to T and when you fill out the record in your analyzer you would make sure to set the empty value to F.