file_analysis.bif.zeek¶

Files¶

GLOBAL¶

Internal functions and types used by the file analysis framework.

Namespaces:	Files, GLOBAL

Summary¶

Functions¶

`Files::__add_analyzer`: `function`	`Files::add_analyzer`.
`Files::__analyzer_name`: `function`	`Files::analyzer_name`.
`Files::__disable_reassembly`: `function`	`Files::disable_reassembly`.
`Files::__enable_reassembly`: `function`	`Files::enable_reassembly`.
`Files::__file_exists`: `function`	`Files::file_exists`.
`Files::__lookup_file`: `function`	`Files::lookup_file`.
`Files::__remove_analyzer`: `function`	`Files::remove_analyzer`.
`Files::__set_reassembly_buffer`: `function`	`Files::set_reassembly_buffer_size`.
`Files::__set_timeout_interval`: `function`	`Files::set_timeout_interval`.
`Files::__stop`: `function`	`Files::stop`.
`set_file_handle`: `function`	For use within a `get_file_handle` handler to set a unique identifier to associate with the current input to the file analysis framework.

Detailed Interface¶

Functions¶

Files::__add_analyzer¶

Type:	`function` (file_id: `string`, tag: `Files::Tag`, args: `any`) : `bool`

Files::add_analyzer.

Files::__analyzer_name¶

Type:	`function` (tag: `Files::Tag`) : `string`

Files::analyzer_name.

Files::__disable_reassembly¶

Type:	`function` (file_id: `string`) : `bool`

Files::disable_reassembly.

Files::__enable_reassembly¶

Type:	`function` (file_id: `string`) : `bool`

Files::enable_reassembly.

Files::__file_exists¶

Type:	`function` (fuid: `string`) : `bool`

Files::file_exists.

Files::__lookup_file¶

Type:	`function` (fuid: `string`) : `fa_file`

Files::lookup_file.

Files::__remove_analyzer¶

Type:	`function` (file_id: `string`, tag: `Files::Tag`, args: `any`) : `bool`

Files::remove_analyzer.

Files::__set_reassembly_buffer¶

Type:	`function` (file_id: `string`, max: `count`) : `bool`

Files::set_reassembly_buffer_size.

Files::__set_timeout_interval¶

Type:	`function` (file_id: `string`, t: `interval`) : `bool`

Files::set_timeout_interval.

Files::__stop¶

Type:	`function` (file_id: `string`) : `bool`

Files::stop.

set_file_handle¶

Type:	`function` (handle: `string`) : `any`

For use within a get_file_handle handler to set a unique identifier to associate with the current input to the file analysis framework. Using an empty string for the handle signifies that the input will be ignored/discarded.

Handle:	A string that uniquely identifies a file.