[
https://bro-tracker.atlassian.net/browse/BIT-1405?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Vern Paxson updated BIT-1405:
-----------------------------
Description: The [Notice
documentation|https://www.bro.org/sphinx/frameworks/notice.html] includes the
phrase "_Users should directly make modifications to the Notice::Info record
given as the argument to the hook_". Initially I read this with a presumption
that it was a typo and what was meant was instead "should *not* directly make
...". Then when I got to the example I see that it actually does mean
go-ahead-and-modify, though presumably it only makes sense to modify some
fields (such as $actions) and not others (context provided by the Info record).
So this phrasing should be clarified, maybe along the lines of "Users alter
notice processing by directly modifying certain fields in the Notice::Info
record given as the argument ...". (was: The [Notice
documentation|https://www.bro.org/sphinx/frameworks/notice.html] includes the
phrase "_Users should directly make modifications to the Notice::Info record
given as the argument to the hook_". Presumably this is inste!
ad "should *not* directly make ...")
Summary: Notice framework documentation confusion (was: Notice
framework documentation glitch)
> Notice framework documentation confusion
> ----------------------------------------
>
> Key: BIT-1405
> URL: https://bro-tracker.atlassian.net/browse/BIT-1405
> Project: Bro Issue Tracker
> Issue Type: Problem
> Components: Documentation
> Reporter: Vern Paxson
> Priority: Low
>
> The [Notice documentation|https://www.bro.org/sphinx/frameworks/notice.html]
> includes the phrase "_Users should directly make modifications to the
> Notice::Info record given as the argument to the hook_". Initially I read
> this with a presumption that it was a typo and what was meant was instead
> "should *not* directly make ...". Then when I got to the example I see that
> it actually does mean go-ahead-and-modify, though presumably it only makes
> sense to modify some fields (such as $actions) and not others (context
> provided by the Info record). So this phrasing should be clarified, maybe
> along the lines of "Users alter notice processing by directly modifying
> certain fields in the Notice::Info record given as the argument ...".
--
This message was sent by Atlassian JIRA
(v6.5-OD-04-052#65000)
_______________________________________________
bro-dev mailing list
bro-dev@bro.org
http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
