Re: [Bro-Dev] Writing SumStats plugin

2018-08-07 Thread Jim Mellander
It seems that there's some inconsistency in SumStats plugin usage and implementation. There appear to be 2 classes of plugins with differing calling mechanisms and action: 1. Item to be measured is in the Key, and the measurement is in Observation 1. These include Average, Last X

Re: [Bro-Dev] Broker::publish API

2018-08-07 Thread Jon Siwek
On Mon, Aug 6, 2018 at 3:00 PM Robin Sommer wrote: > Overall I have to say I found it pretty hard to follow this all > because we don't have much consistency right now in how scripts > structure their communication. That's not surprising, given that we're > just starting to use all this, but it

Re: [Bro-Dev] Broker::publish API

2018-08-07 Thread Jon Siwek
On Mon, Aug 6, 2018 at 1:57 PM Robin Sommer wrote: > I have another question about this specific case: we use relay_rr() > only for sending Intel::insert_indicator. Intel::remove_indicator gets > published normally through auto_publish(). Why the difference? Potentially no reason other than no

Re: [Bro-Dev] Broker::publish API

2018-08-07 Thread Jan Grashöfer
To be honest, I have somehow lost track of the discussion. What I can recall, it's about simplifying the API in the light of multi-hop routing, which is not fully functional yet. Regarding multi-hop routing I am even not sure what the actual goal is that we are currently aiming at. However,