zeek.bif.zeek

GLOBAL

A collection of built-in functions that implement a variety of things such as general programming algorithms, string processing, math functions, introspection, type conversion, file/directory manipulation, packet filtering, interprocess communication and controlling protocol analyzer behavior.

You’ll find most of Zeek’s built-in functions that aren’t protocol-specific in this file.

Namespace:: GLOBAL

Summary

Functions

`__init_secondary_bifs`: `function`	An internal function that helps initialize BIFs.
`active_file`: `function`	Checks whether a given file is open.
`addr_to_counts`: `function`	Converts an `addr` to an `index_vec`.
`addr_to_ptr_name`: `function`	Converts an IP address to a reverse pointer name.
`addr_to_subnet`: `function`	Converts a `addr` to a `subnet`.
`all_set`: `function`	Tests whether all elements of a boolean vector (`vector of bool`) are true.
`anonymize_addr`: `function`	Anonymizes an IP address.
`any_set`: `function`	Tests whether a boolean vector (`vector of bool`) has any true element.
`backtrace`: `function`	Returns a representation of the call stack as a vector of call stack elements, each containing call location information.
`bare_mode`: `function`	Returns whether Zeek was started in bare mode.
`bytestring_to_count`: `function`	Converts a string of bytes to a `count`.
`bytestring_to_double`: `function`	Converts a string of bytes representing a double value (in network byte order) to a `double`.
`bytestring_to_float`: `function`	Converts a string of bytes representing a float value (in network byte order) to a `double`.
`bytestring_to_hexstr`: `function`	Converts a string of bytes into its hexadecimal representation.
`calc_next_rotate`: `function`	Calculates the duration until the next time a file is to be rotated, based on a given rotate interval.
`cat`: `function`	Returns the concatenation of the string representation of its arguments.
`cat_sep`: `function`	Concatenates all arguments, with a separator placed between each one.
`ceil`: `function`	Computes the smallest integer greater or equal than the given `double` value.
`check_subnet`: `function`	Checks if a specific subnet is a member of a set/table[subnet].
`clear_table`: `function`	Removes all elements from a set or table.
`close`: `function`	Closes an open file and flushes any buffered content.
`compress_path`: `function`	Compresses a given path by removing ‘..’s and the parent directory it references and also removing dual ‘/’s and extraneous ‘/./’s.
`connection_exists`: `function`	Checks whether a connection is (still) active.
`continue_processing`: `function`	Resumes Zeek’s packet processing.
`convert_for_pattern`: `function`	Escapes a string so that it becomes a valid `pattern` and can be used with the `string_to_pattern`.
`count_to_double`: `function`	Converts a `count` to a `double`.
`count_to_port`: `function`	Converts a `count` and `transport_proto` to a `port`.
`count_to_v4_addr`: `function`	Converts a `count` to an `addr`.
`counts_to_addr`: `function`	Converts an `index_vec` to an `addr`.
`current_analyzer`: `function`	Returns the ID of the analyzer which raised the current event.
`current_event_time`: `function`	Returns the timestamp of the last raised event.
`current_time`: `function`	Returns the current wall-clock time.
`decode_base64`: `function`	Decodes a Base64-encoded string.
`decode_base64_conn`: `function`	Decodes a Base64-encoded string that was derived from processing a connection.
`disable_analyzer`: `function`	Disables the analyzer which raised the current event (if the analyzer belongs to the given connection).
`disable_event_group`: `function`	Disabled the given event group.
`disable_module_events`: `function`	Disable all event handlers and hooks in the given module.
`do_profiling`: `function`	Enables detailed collection of profiling statistics.
`double_to_count`: `function`	Converts a `double` to a `int`.
`double_to_int`: `function`	Converts a `double` to a `count`.
`double_to_interval`: `function`	Converts a `double` to an `interval`.
`double_to_time`: `function`	Converts a `double` value to a `time`.
`dump_current_packet`: `function`	Writes the current packet to a file.
`dump_packet`: `function`	Writes a given packet to a file.
`dump_rule_stats`: `function`	Write rule matcher statistics (DFA states, transitions, memory usage, cache hits/misses) to a file.
`enable_event_group`: `function`	Enabled the given event group.
`enable_module_events`: `function`	Enable all event handlers and hooks in the given module.
`enable_raw_output`: `function`	Prevents escaping of non-ASCII characters when writing to a file.
`encode_base64`: `function`	Encodes a Base64-encoded string.
`entropy_test_add`: `function`	Adds data to an incremental entropy calculation.
`entropy_test_finish`: `function`	Finishes an incremental entropy calculation.
`entropy_test_init`: `function`	Initializes data structures for incremental entropy calculation.
`enum_names`: `function`	Returns all value names associated with an enum type.
`enum_to_int`: `function`	Converts an `enum` to an `int`.
`exit`: `function`	Shuts down the Zeek process immediately.
`exp`: `function`	Computes the exponential function.
`file_magic`: `function`	Determines the MIME type of a piece of data using Zeek’s file magic signatures.
`file_mode`: `function`	Converts UNIX file permissions given by a mode to an ASCII string.
`file_size`: `function`	Returns the size of a given file.
`filter_subnet_table`: `function`	For a set[subnet]/table[subnet], create a new table that contains all entries that contain a given subnet.
`find_entropy`: `function`	Performs an entropy test on the given data.
`find_in_zeekpath`: `function`	Determine the path used by a non-relative @load directive.
`floor`: `function`	Computes the greatest integer less than the given `double` value.
`flush_all`: `function`	Flushes all open files to disk.
`fmt`: `function`	Produces a formatted string à la `printf`.
`fnv1a32`: `function`	Returns 32-bit digest of arbitrary input values using FNV-1a hash algorithm.
`fnv1a64`: `function`	Returns 64-bit digest of arbitrary input values using FNV-1a hash algorithm.
`from_json`: `function`	A function to convert a JSON string into Zeek values of a given type.
`generate_all_events`: `function`	By default, zeek does not generate (raise) events that have not handled by any scripts.
`get_conn_transport_proto`: `function`	Extracts the transport protocol from a connection.
`get_current_packet`: `function`	Returns the currently processed PCAP packet.
`get_current_packet_header`: `function`	Function to get the raw headers of the currently processed packet.
`get_current_packet_ts`: `function`	Returns the currently processed PCAP packet’s timestamp or a 0 timestamp if there is no packet being processed at the moment.
`get_file_name`: `function`	Gets the filename associated with a file handle.
`get_port_transport_proto`: `function`	Extracts the transport protocol from a `port`.
`getenv`: `function`	Returns a system environment variable.
`gethostname`: `function`	Returns the hostname of the machine Zeek runs on.
`getpid`: `function`	Returns Zeek’s process ID.
`global_container_footprints`: `function`	Generates a table of the “footprint” of all global container variables.
`global_ids`: `function`	Generates a table with information about all global identifiers.
`global_options`: `function`	Returns a set giving the names of all global options.
`has_event_group`: `function`	Does an attribute event group with this name exist?
`has_module_events`: `function`	Does a module event group with this name exist?
`have_spicy`: `function`	Returns true if Zeek was built with support for using Spicy analyzers (which is the default).
`have_spicy_analyzers`: `function`	Returns true if Zeek was built with support for its in-tree Spicy analyzers (which is the default if Spicy support is available).
`haversine_distance`: `function`	Calculates distance between two geographic locations using the haversine formula.
`hexstr_to_bytestring`: `function`	Converts a hex-string into its binary representation.
`hrw_weight`: `function`	Calculates a weight value for use in a Rendezvous Hashing algorithm.
`identify_data`: `function`	Determines the MIME type of a piece of data using Zeek’s file magic signatures.
`install_dst_addr_filter`: `function`	Installs a filter to drop packets destined to a given IP address with a certain probability if none of a given set of TCP flags are set.
`install_dst_net_filter`: `function`	Installs a filter to drop packets destined to a given subnet with a certain probability if none of a given set of TCP flags are set.
`install_src_addr_filter`: `function`	Installs a filter to drop packets from a given IP source address with a certain probability if none of a given set of TCP flags are set.
`install_src_net_filter`: `function`	Installs a filter to drop packets originating from a given subnet with a certain probability if none of a given set of TCP flags are set.
`int_to_count`: `function`	Converts a (positive) `int` to a `count`.
`int_to_double`: `function`	Converts an `int` to a `double`.
`interval_to_double`: `function`	Converts an `interval` to a `double`.
`is_event_handled`: `function`	Check if an event is handled.
`is_file_analyzer`: `function`	Returns true if the given tag belongs to a file analyzer.
`is_icmp_port`: `function`	Checks whether a given `port` has ICMP as transport protocol.
`is_local_interface`: `function`	Checks whether a given IP address belongs to a local interface.
`is_packet_analyzer`: `function`	Returns true if the given tag belongs to a packet analyzer.
`is_processing_suspended`: `function`	Returns whether or not processing is currently suspended.
`is_protocol_analyzer`: `function`	Returns true if the given tag belongs to a protocol analyzer.
`is_remote_event`: `function`	Checks whether the last raised event came from a remote peer.
`is_tcp_port`: `function`	Checks whether a given `port` has TCP as transport protocol.
`is_udp_port`: `function`	Checks whether a given `port` has UDP as transport protocol.
`is_v4_addr`: `function`	Returns whether an address is IPv4 or not.
`is_v4_subnet`: `function`	Returns whether a subnet specification is IPv4 or not.
`is_v6_addr`: `function`	Returns whether an address is IPv6 or not.
`is_v6_subnet`: `function`	Returns whether a subnet specification is IPv6 or not.
`is_valid_ip`: `function`	Checks if a string is a valid IPv4 or IPv6 address.
`ln`: `function`	Computes the natural logarithm of a number.
`log10`: `function`	Computes the common logarithm of a number.
`log2`: `function`	Computes the base 2 logarithm of a number.
`lookup_ID`: `function`	Returns the value of a global identifier.
`lookup_addr`: `function`	Issues an asynchronous reverse DNS lookup and delays the function result.
`lookup_connection`: `function`	Returns the `connection` record for a given connection identifier.
`lookup_connection_analyzer_id`: `function`	Returns the numeric ID of the requested protocol analyzer for the given connection.
`lookup_hostname`: `function`	Issues an asynchronous DNS lookup and delays the function result.
`lookup_hostname_txt`: `function`	Issues an asynchronous TEXT DNS lookup and delays the function result.
`mask_addr`: `function`	Masks an address down to the number of given upper bits.
`match_signatures`: `function`	Manually triggers the signature engine for a given connection.
`matching_subnets`: `function`	Gets all subnets that contain a given subnet from a set/table[subnet].
`md5_hash`: `function`	Computes the MD5 hash value of the provided list of arguments.
`md5_hash_finish`: `function`	Returns the final MD5 digest of an incremental hash computation.
`md5_hash_init`: `function`	Constructs an MD5 handle to enable incremental hash computation.
`md5_hash_update`: `function`	Updates the MD5 value associated with a given index.
`md5_hmac`: `function`	Computes an HMAC-MD5 hash value of the provided list of arguments.
`mkdir`: `function`	Creates a new directory.
`network_time`: `function`	Returns the timestamp of the last packet processed.
`open`: `function`	Opens a file for writing.
`open_for_append`: `function`	Opens a file for writing or appending.
`order`: `function`	Returns the order of the elements in a vector according to some comparison function.
`packet_source`: `function`	Returns: the packet source being read by Zeek.
`paraglob_equals`: `function`	Compares two paraglobs for equality.
`paraglob_init`: `function`	Initializes and returns a new paraglob.
`paraglob_match`: `function`	Gets all the patterns inside the handle associated with an input string.
`piped_exec`: `function`	Opens a program with `popen` and writes a given string to the returned stream to send it to the opened process’s stdin.
`port_to_count`: `function`	Converts a `port` to a `count`.
`pow`: `function`	Computes the x raised to the power y.
`preserve_prefix`: `function`	Preserves the prefix of an IP address in anonymization.
`preserve_subnet`: `function`	Preserves the prefix of a subnet in anonymization.
`print_raw`: `function`	Renders a sequence of values to a string of bytes and outputs them directly to `stdout` with no additional escape sequences added.
`ptr_name_to_addr`: `function`	Converts a reverse pointer name to an address.
`rand`: `function`	Generates a random number.
`raw_bytes_to_v4_addr`: `function`	Converts a `string` of bytes into an IPv4 address.
`raw_bytes_to_v6_addr`: `function`	Converts a `string` of bytes into an IPv6 address.
`reading_live_traffic`: `function`	Checks whether Zeek reads traffic from one or more network interfaces (as opposed to from a network trace in a file).
`reading_traces`: `function`	Checks whether Zeek reads traffic from a trace file (as opposed to from a network interface).
`record_fields`: `function`	Generates metadata about a record’s fields.
`record_type_to_vector`: `function`	Converts a record type name to a vector of strings, where each element is the name of a record field.
`remask_addr`: `function`	Takes some top bits (such as a subnet address) from one address and the other bits (intra-subnet part) from a second address and merges them to get a new address.
`rename`: `function`	Renames a file from src_f to dst_f.
`resize`: `function`	Resizes a vector.
`rmdir`: `function`	Removes a directory.
`rotate_file`: `function`	Rotates a file.
`rotate_file_by_name`: `function`	Rotates a file identified by its name.
`routing0_data_to_addrs`: `function`	Converts the data field of `ip6_routing` records that have rtype of 0 into a vector of addresses.
`same_object`: `function`	Checks whether two objects reference the same internal object.
`set_buf`: `function`	Alters the buffering behavior of a file.
`set_inactivity_timeout`: `function`	Sets an individual inactivity timeout for a connection and thus overrides the global inactivity timeout.
`set_network_time`: `function`	Sets the timestamp associated with the last packet processed.
`set_record_packets`: `function`	Controls whether packet contents belonging to a connection should be recorded (when `-w` option is provided on the command line).
`setenv`: `function`	Sets a system environment variable.
`sha1_hash`: `function`	Computes the SHA1 hash value of the provided list of arguments.
`sha1_hash_finish`: `function`	Returns the final SHA1 digest of an incremental hash computation.
`sha1_hash_init`: `function`	Constructs an SHA1 handle to enable incremental hash computation.
`sha1_hash_update`: `function`	Updates the SHA1 value associated with a given index.
`sha256_hash`: `function`	Computes the SHA256 hash value of the provided list of arguments.
`sha256_hash_finish`: `function`	Returns the final SHA256 digest of an incremental hash computation.
`sha256_hash_init`: `function`	Constructs an SHA256 handle to enable incremental hash computation.
`sha256_hash_update`: `function`	Updates the SHA256 value associated with a given index.
`skip_further_processing`: `function`	Informs Zeek that it should skip any further processing of the contents of a given connection.
`sleep`: `function`	Sleeps for the given amount of time.
`sort`: `function`	Sorts a vector in place.
`sqrt`: `function`	Computes the square root of a `double`.
`srand`: `function`	Sets the seed for subsequent `rand` calls.
`strftime`: `function`	Formats a given time value according to a format string.
`string_to_pattern`: `function`	Converts a `string` into a `pattern`.
`strptime`: `function`	Parse a textual representation of a date/time value into a `time` type value.
`subnet_to_addr`: `function`	Converts a `subnet` to an `addr` by extracting the prefix.
`subnet_width`: `function`	Returns the width of a `subnet`.
`suspend_processing`: `function`	Stops Zeek’s packet processing.
`syslog`: `function`	Send a string to syslog.
`system`: `function`	Invokes a command via the `system` function of the OS.
`system_env`: `function`	Invokes a command via the `system` function of the OS with a prepared environment.
`table_keys`: `function`	Gets all keys from a table.
`table_pattern_matcher_stats`: `function`	Return MatcherStats for a table[pattern] or set[pattern] value.
`table_values`: `function`	Gets all values from a table.
`terminate`: `function`	Gracefully shut down Zeek by terminating outstanding processing.
`time_to_double`: `function`	Converts a `time` value to a `double`.
`to_addr`: `function`	Converts a `string` to an `addr`.
`to_count`: `function`	Converts a `string` to a `count`.
`to_double`: `function`	Converts a `string` to a `double`.
`to_int`: `function`	Converts a `string` to an `int`.
`to_json`: `function`	A function to convert arbitrary Zeek data into a JSON string.
`to_port`: `function`	Converts a `string` to a `port`.
`to_subnet`: `function`	Converts a `string` to a `subnet`.
`type_aliases`: `function`	Returns all type name aliases of a value or type.
`type_name`: `function`	Returns the type name of an arbitrary Zeek variable.
`uninstall_dst_addr_filter`: `function`	Removes a destination address filter.
`uninstall_dst_net_filter`: `function`	Removes a destination subnet filter.
`uninstall_src_addr_filter`: `function`	Removes a source address filter.
`uninstall_src_net_filter`: `function`	Removes a source subnet filter.
`unique_id`: `function`	Creates an identifier that is unique with high probability.
`unique_id_from`: `function`	Creates an identifier that is unique with high probability.
`unlink`: `function`	Removes a file from a directory.
`uuid_to_string`: `function`	Converts a bytes representation of a UUID into its string form.
`val_footprint`: `function`	Computes a value’s “footprint”: the number of objects the value contains either directly or indirectly.
`write_file`: `function`	Writes data to an open file.
`zeek_args`: `function`	Returns: list of command-line arguments (`argv`) used to run Zeek.
`zeek_is_terminating`: `function`	Checks if Zeek is terminating.
`zeek_version`: `function`	Returns the Zeek version string.

Detailed Interface

Functions

__init_secondary_bifs

Type:: function () : bool

An internal function that helps initialize BIFs.

active_file

Type:: function (f: file) : bool

Checks whether a given file is open.

Parameters:: f – The file to check.
Returns:: True if f is an open file.

Todo

Rename to is_open.

addr_to_counts

Type:: function (a: addr) : index_vec

Converts an addr to an index_vec.

Parameters:: a – The address to convert into a vector of counts.
Returns:: A vector containing the host-order address representation, four elements in size for IPv6 addresses, or one element for IPv4.