Generate docs

script-reference/autogenerated-script-index.rst

@@ -285,6 +285,7 @@
    base/utils/files.zeek </scripts/base/utils/files.zeek>
    base/utils/geoip-distance.zeek </scripts/base/utils/geoip-distance.zeek>
    base/utils/numbers.zeek </scripts/base/utils/numbers.zeek>
+   base/utils/packages.zeek </scripts/base/utils/packages.zeek>
    base/utils/queue.zeek </scripts/base/utils/queue.zeek>
    base/utils/strings.zeek </scripts/base/utils/strings.zeek>
    base/utils/thresholds.zeek </scripts/base/utils/thresholds.zeek>
@@ -615,6 +616,7 @@
    policy/frameworks/management/node/__load__.zeek </scripts/policy/frameworks/management/node/__load__.zeek>
    policy/frameworks/management/node/main.zeek </scripts/policy/frameworks/management/node/main.zeek>
    policy/frameworks/files/extract-all-files.zeek </scripts/policy/frameworks/files/extract-all-files.zeek>
+   policy/frameworks/signatures/iso-9660.zeek </scripts/policy/frameworks/signatures/iso-9660.zeek>
    policy/misc/dump-events.zeek </scripts/policy/misc/dump-events.zeek>
    policy/protocols/conn/speculative-service.zeek </scripts/policy/protocols/conn/speculative-service.zeek>
    policy/frameworks/spicy/resource-usage.zeek </scripts/policy/frameworks/spicy/resource-usage.zeek>

scripts/base/bif/zeek.bif.zeek.rst

@@ -93,6 +93,7 @@ Functions
 :zeek:id:`filter_subnet_table`: :zeek:type:`function`         For a set[subnet]/table[subnet], create a new table that contains all entries
                                                               that contain a given subnet.
 :zeek:id:`find_entropy`: :zeek:type:`function`                Performs an entropy test on the given data.
+:zeek:id:`find_in_zeekpath`: :zeek:type:`function`            Determine the path used by a non-relative @load directive.
 :zeek:id:`floor`: :zeek:type:`function`                       Computes the greatest integer less than the given :zeek:type:`double` value.
 :zeek:id:`flush_all`: :zeek:type:`function`                   Flushes all open files to disk.
 :zeek:id:`fmt`: :zeek:type:`function`                         Produces a formatted string à la ``printf``.
@@ -1280,6 +1281,24 @@ Functions
 
    .. zeek:see:: entropy_test_init entropy_test_add entropy_test_finish
 
+.. zeek:id:: find_in_zeekpath
+   :source-code: base/bif/zeek.bif.zeek 2676 2676
+
+   :Type: :zeek:type:`function` (p: :zeek:type:`string`) : :zeek:type:`string`
+
+   Determine the path used by a non-relative @load directive.
+
+   This function is package aware: Passing *package* will yield the
+   path to *package.zeek*, *package/__load__.zeek* or an empty string
+   if neither can be found. Note that passing a relative path or absolute
+   path is an error.
+
+
+   :param path: The filename, package or path to search for in ZEEKPATH.
+
+
+   :returns: Path of script file that would be loaded by an @load directive.
+
 .. zeek:id:: floor
    :source-code: base/bif/zeek.bif.zeek 827 827
 

scripts/base/init-bare.zeek.rst

@@ -861,6 +861,12 @@ Runtime Options
    :Type: :zeek:type:`count`
    :Attributes: :zeek:attr:`&redef`
    :Default: ``4096``
+   :Redefinition: from :doc:`/scripts/policy/frameworks/signatures/iso-9660.zeek`
+
+      ``=``::
+
+         2048 * (16 + 1)
+
 
    Default amount of bytes that file analysis will buffer in order to use
    for mime type matching.  File analyzers attached at the time of mime type

scripts/base/init-default.zeek.rst

@@ -9,7 +9,7 @@ the ``-b`` (``--bare-mode``) command line argument.  You can also copy the
 "@load" lines from this script to your own script to load only the scripts
 that you actually want.
 
-:Imports: :doc:`base/files/extract </scripts/base/files/extract/index>`, :doc:`base/files/hash </scripts/base/files/hash/index>`, :doc:`base/files/pe </scripts/base/files/pe/index>`, :doc:`base/files/x509 </scripts/base/files/x509/index>`, :doc:`base/frameworks/analyzer </scripts/base/frameworks/analyzer/index>`, :doc:`base/frameworks/cluster </scripts/base/frameworks/cluster/index>`, :doc:`base/frameworks/config </scripts/base/frameworks/config/index>`, :doc:`base/frameworks/control </scripts/base/frameworks/control/index>`, :doc:`base/frameworks/intel </scripts/base/frameworks/intel/index>`, :doc:`base/frameworks/netcontrol </scripts/base/frameworks/netcontrol/index>`, :doc:`base/frameworks/notice </scripts/base/frameworks/notice/index>`, :doc:`base/frameworks/openflow </scripts/base/frameworks/openflow/index>`, :doc:`base/frameworks/packet-filter </scripts/base/frameworks/packet-filter/index>`, :doc:`base/frameworks/reporter </scripts/base/frameworks/reporter/index>`, :doc:`base/frameworks/signatures </scripts/base/frameworks/signatures/index>`, :doc:`base/frameworks/software </scripts/base/frameworks/software/index>`, :doc:`base/frameworks/spicy </scripts/base/frameworks/spicy/index>`, :doc:`base/frameworks/sumstats </scripts/base/frameworks/sumstats/index>`, :doc:`base/frameworks/telemetry </scripts/base/frameworks/telemetry/index>`, :doc:`base/frameworks/tunnels </scripts/base/frameworks/tunnels/index>`, :doc:`base/misc/find-checksum-offloading.zeek </scripts/base/misc/find-checksum-offloading.zeek>`, :doc:`base/misc/find-filtered-trace.zeek </scripts/base/misc/find-filtered-trace.zeek>`, :doc:`base/misc/installation.zeek </scripts/base/misc/installation.zeek>`, :doc:`base/misc/version.zeek </scripts/base/misc/version.zeek>`, :doc:`base/protocols/conn </scripts/base/protocols/conn/index>`, :doc:`base/protocols/dce-rpc </scripts/base/protocols/dce-rpc/index>`, :doc:`base/protocols/dhcp </scripts/base/protocols/dhcp/index>`, :doc:`base/protocols/dnp3 </scripts/base/protocols/dnp3/index>`, :doc:`base/protocols/dns </scripts/base/protocols/dns/index>`, :doc:`base/protocols/finger </scripts/base/protocols/finger/index>`, :doc:`base/protocols/ftp </scripts/base/protocols/ftp/index>`, :doc:`base/protocols/http </scripts/base/protocols/http/index>`, :doc:`base/protocols/imap </scripts/base/protocols/imap/index>`, :doc:`base/protocols/irc </scripts/base/protocols/irc/index>`, :doc:`base/protocols/krb </scripts/base/protocols/krb/index>`, :doc:`base/protocols/ldap </scripts/base/protocols/ldap/index>`, :doc:`base/protocols/modbus </scripts/base/protocols/modbus/index>`, :doc:`base/protocols/mqtt </scripts/base/protocols/mqtt/index>`, :doc:`base/protocols/mysql </scripts/base/protocols/mysql/index>`, :doc:`base/protocols/ntlm </scripts/base/protocols/ntlm/index>`, :doc:`base/protocols/ntp </scripts/base/protocols/ntp/index>`, :doc:`base/protocols/pop3 </scripts/base/protocols/pop3/index>`, :doc:`base/protocols/quic </scripts/base/protocols/quic/index>`, :doc:`base/protocols/radius </scripts/base/protocols/radius/index>`, :doc:`base/protocols/rdp </scripts/base/protocols/rdp/index>`, :doc:`base/protocols/rfb </scripts/base/protocols/rfb/index>`, :doc:`base/protocols/sip </scripts/base/protocols/sip/index>`, :doc:`base/protocols/smb </scripts/base/protocols/smb/index>`, :doc:`base/protocols/smtp </scripts/base/protocols/smtp/index>`, :doc:`base/protocols/snmp </scripts/base/protocols/snmp/index>`, :doc:`base/protocols/socks </scripts/base/protocols/socks/index>`, :doc:`base/protocols/ssh </scripts/base/protocols/ssh/index>`, :doc:`base/protocols/ssl </scripts/base/protocols/ssl/index>`, :doc:`base/protocols/syslog </scripts/base/protocols/syslog/index>`, :doc:`base/protocols/tunnels </scripts/base/protocols/tunnels/index>`, :doc:`base/protocols/websocket </scripts/base/protocols/websocket/index>`, :doc:`base/protocols/xmpp </scripts/base/protocols/xmpp/index>`, :doc:`base/utils/active-http.zeek </scripts/base/utils/active-http.zeek>`, :doc:`base/utils/addrs.zeek </scripts/base/utils/addrs.zeek>`, :doc:`base/utils/backtrace.zeek </scripts/base/utils/backtrace.zeek>`, :doc:`base/utils/conn-ids.zeek </scripts/base/utils/conn-ids.zeek>`, :doc:`base/utils/dir.zeek </scripts/base/utils/dir.zeek>`, :doc:`base/utils/directions-and-hosts.zeek </scripts/base/utils/directions-and-hosts.zeek>`, :doc:`base/utils/email.zeek </scripts/base/utils/email.zeek>`, :doc:`base/utils/exec.zeek </scripts/base/utils/exec.zeek>`, :doc:`base/utils/files.zeek </scripts/base/utils/files.zeek>`, :doc:`base/utils/geoip-distance.zeek </scripts/base/utils/geoip-distance.zeek>`, :doc:`base/utils/hash_hrw.zeek </scripts/base/utils/hash_hrw.zeek>`, :doc:`base/utils/numbers.zeek </scripts/base/utils/numbers.zeek>`, :doc:`base/utils/paths.zeek </scripts/base/utils/paths.zeek>`, :doc:`base/utils/patterns.zeek </scripts/base/utils/patterns.zeek>`, :doc:`base/utils/queue.zeek </scripts/base/utils/queue.zeek>`, :doc:`base/utils/site.zeek </scripts/base/utils/site.zeek>`, :doc:`base/utils/strings.zeek </scripts/base/utils/strings.zeek>`, :doc:`base/utils/thresholds.zeek </scripts/base/utils/thresholds.zeek>`, :doc:`base/utils/time.zeek </scripts/base/utils/time.zeek>`, :doc:`base/utils/urls.zeek </scripts/base/utils/urls.zeek>`
+:Imports: :doc:`base/files/extract </scripts/base/files/extract/index>`, :doc:`base/files/hash </scripts/base/files/hash/index>`, :doc:`base/files/pe </scripts/base/files/pe/index>`, :doc:`base/files/x509 </scripts/base/files/x509/index>`, :doc:`base/frameworks/analyzer </scripts/base/frameworks/analyzer/index>`, :doc:`base/frameworks/cluster </scripts/base/frameworks/cluster/index>`, :doc:`base/frameworks/config </scripts/base/frameworks/config/index>`, :doc:`base/frameworks/control </scripts/base/frameworks/control/index>`, :doc:`base/frameworks/intel </scripts/base/frameworks/intel/index>`, :doc:`base/frameworks/netcontrol </scripts/base/frameworks/netcontrol/index>`, :doc:`base/frameworks/notice </scripts/base/frameworks/notice/index>`, :doc:`base/frameworks/openflow </scripts/base/frameworks/openflow/index>`, :doc:`base/frameworks/packet-filter </scripts/base/frameworks/packet-filter/index>`, :doc:`base/frameworks/reporter </scripts/base/frameworks/reporter/index>`, :doc:`base/frameworks/signatures </scripts/base/frameworks/signatures/index>`, :doc:`base/frameworks/software </scripts/base/frameworks/software/index>`, :doc:`base/frameworks/spicy </scripts/base/frameworks/spicy/index>`, :doc:`base/frameworks/sumstats </scripts/base/frameworks/sumstats/index>`, :doc:`base/frameworks/telemetry </scripts/base/frameworks/telemetry/index>`, :doc:`base/frameworks/tunnels </scripts/base/frameworks/tunnels/index>`, :doc:`base/misc/find-checksum-offloading.zeek </scripts/base/misc/find-checksum-offloading.zeek>`, :doc:`base/misc/find-filtered-trace.zeek </scripts/base/misc/find-filtered-trace.zeek>`, :doc:`base/misc/installation.zeek </scripts/base/misc/installation.zeek>`, :doc:`base/misc/version.zeek </scripts/base/misc/version.zeek>`, :doc:`base/protocols/conn </scripts/base/protocols/conn/index>`, :doc:`base/protocols/dce-rpc </scripts/base/protocols/dce-rpc/index>`, :doc:`base/protocols/dhcp </scripts/base/protocols/dhcp/index>`, :doc:`base/protocols/dnp3 </scripts/base/protocols/dnp3/index>`, :doc:`base/protocols/dns </scripts/base/protocols/dns/index>`, :doc:`base/protocols/finger </scripts/base/protocols/finger/index>`, :doc:`base/protocols/ftp </scripts/base/protocols/ftp/index>`, :doc:`base/protocols/http </scripts/base/protocols/http/index>`, :doc:`base/protocols/imap </scripts/base/protocols/imap/index>`, :doc:`base/protocols/irc </scripts/base/protocols/irc/index>`, :doc:`base/protocols/krb </scripts/base/protocols/krb/index>`, :doc:`base/protocols/ldap </scripts/base/protocols/ldap/index>`, :doc:`base/protocols/modbus </scripts/base/protocols/modbus/index>`, :doc:`base/protocols/mqtt </scripts/base/protocols/mqtt/index>`, :doc:`base/protocols/mysql </scripts/base/protocols/mysql/index>`, :doc:`base/protocols/ntlm </scripts/base/protocols/ntlm/index>`, :doc:`base/protocols/ntp </scripts/base/protocols/ntp/index>`, :doc:`base/protocols/pop3 </scripts/base/protocols/pop3/index>`, :doc:`base/protocols/quic </scripts/base/protocols/quic/index>`, :doc:`base/protocols/radius </scripts/base/protocols/radius/index>`, :doc:`base/protocols/rdp </scripts/base/protocols/rdp/index>`, :doc:`base/protocols/rfb </scripts/base/protocols/rfb/index>`, :doc:`base/protocols/sip </scripts/base/protocols/sip/index>`, :doc:`base/protocols/smb </scripts/base/protocols/smb/index>`, :doc:`base/protocols/smtp </scripts/base/protocols/smtp/index>`, :doc:`base/protocols/snmp </scripts/base/protocols/snmp/index>`, :doc:`base/protocols/socks </scripts/base/protocols/socks/index>`, :doc:`base/protocols/ssh </scripts/base/protocols/ssh/index>`, :doc:`base/protocols/ssl </scripts/base/protocols/ssl/index>`, :doc:`base/protocols/syslog </scripts/base/protocols/syslog/index>`, :doc:`base/protocols/tunnels </scripts/base/protocols/tunnels/index>`, :doc:`base/protocols/websocket </scripts/base/protocols/websocket/index>`, :doc:`base/protocols/xmpp </scripts/base/protocols/xmpp/index>`, :doc:`base/utils/active-http.zeek </scripts/base/utils/active-http.zeek>`, :doc:`base/utils/addrs.zeek </scripts/base/utils/addrs.zeek>`, :doc:`base/utils/backtrace.zeek </scripts/base/utils/backtrace.zeek>`, :doc:`base/utils/conn-ids.zeek </scripts/base/utils/conn-ids.zeek>`, :doc:`base/utils/dir.zeek </scripts/base/utils/dir.zeek>`, :doc:`base/utils/directions-and-hosts.zeek </scripts/base/utils/directions-and-hosts.zeek>`, :doc:`base/utils/email.zeek </scripts/base/utils/email.zeek>`, :doc:`base/utils/exec.zeek </scripts/base/utils/exec.zeek>`, :doc:`base/utils/files.zeek </scripts/base/utils/files.zeek>`, :doc:`base/utils/geoip-distance.zeek </scripts/base/utils/geoip-distance.zeek>`, :doc:`base/utils/hash_hrw.zeek </scripts/base/utils/hash_hrw.zeek>`, :doc:`base/utils/numbers.zeek </scripts/base/utils/numbers.zeek>`, :doc:`base/utils/packages.zeek </scripts/base/utils/packages.zeek>`, :doc:`base/utils/paths.zeek </scripts/base/utils/paths.zeek>`, :doc:`base/utils/patterns.zeek </scripts/base/utils/patterns.zeek>`, :doc:`base/utils/queue.zeek </scripts/base/utils/queue.zeek>`, :doc:`base/utils/site.zeek </scripts/base/utils/site.zeek>`, :doc:`base/utils/strings.zeek </scripts/base/utils/strings.zeek>`, :doc:`base/utils/thresholds.zeek </scripts/base/utils/thresholds.zeek>`, :doc:`base/utils/time.zeek </scripts/base/utils/time.zeek>`, :doc:`base/utils/urls.zeek </scripts/base/utils/urls.zeek>`
 
 Summary
 ~~~~~~~