Data Types¶

Bro/Zeek Types¶

Bro/Zeek data types.

class zlogging.types.AddrType(empty_field=None, unset_field=None, set_separator=None, *args, **kwargs)[source]¶

Bases: zlogging.types._SimpleType

Bro/Zeek addr data type.

Parameters

empty_field (bytes or str, optional) – Placeholder for empty field.
unset_field (bytes or str, optional) – Placeholder for unset field.
set_separator (bytes or str, optional) – Separator for set/vector fields.
*args – Variable length argument list.
**kwargs – Arbitrary keyword arguments.

Variables

empty_field (bytes) – Placeholder for empty field.
unset_field (bytes) – Placeholder for unset field.
set_separator (bytes) – Separator for set/vector fields.

property python_type¶

Corresponding Python type annotation.

Type: Any
Return type: Any

property zeek_type¶

Corresponding Zeek type name.

Type: str
Return type: str

parse(data)[source]¶

Parse data from string.

Parameters: data (Union[AnyStr, IPAddress]) – raw data
Return type: Optional[IPAddress]
Returns: The parsed IP address. If data is unset, None will be returned.

tojson(data)[source]¶

Serialize data as JSON log format.

Parameters: data (Optional[IPAddress]) – raw data
Returns: The JSON serialisable IP address string.
Return type: str

toascii(data)[source]¶

Serialize data as ASCII log format.

Parameters: data (Optional[IPAddress]) – raw data
Returns: The ASCII representation of the IP address.
Return type: str

class zlogging.types.BoolType(empty_field=None, unset_field=None, set_separator=None, *args, **kwargs)[source]¶

Bases: zlogging.types._SimpleType

Bro/Zeek bool data type.

Parameters

empty_field (bytes or str, optional) – Placeholder for empty field.
unset_field (bytes or str, optional) – Placeholder for unset field.
set_separator (bytes or str, optional) – Separator for set/vector fields.
*args – Variable length argument list.
**kwargs – Arbitrary keyword arguments.

Variables

empty_field (bytes) – Placeholder for empty field.
unset_field (bytes) – Placeholder for unset field.
set_separator (bytes) – Separator for set/vector fields.

property python_type¶

Corresponding Python type annotation.

Type: Any
Return type: Type[bool]

property zeek_type¶

Corresponding Zeek type name.

Type: str
Return type: Literal[“bool”]

parse(data)[source]¶

Parse data from string.

Parameters: data (Union[AnyStr, bool]) – raw data
Return type: Optional[bool]
Returns: The parsed boolean data. If data is unset, None will be returned.
Raises: ZeekValueError – If data is NOT unset and NOT T (True) nor F (False) in Bro/Zeek script language.

tojson(data)[source]¶

Serialize data as JSON log format.

Parameters: data (Optional[bool]) – raw data
Return type: Optional[bool]
Returns: The JSON serialisable boolean data.

toascii(data)[source]¶

Serialize data as ASCII log format.

Parameters: data (Optional[bool]) – raw data
Returns: T if True, F if False.
Return type: str

class zlogging.types.CountType(empty_field=None, unset_field=None, set_separator=None, *args, **kwargs)[source]¶

Bases: zlogging.types._SimpleType

Bro/Zeek count data type.

Parameters

empty_field (bytes or str, optional) – Placeholder for empty field.
unset_field (bytes or str, optional) – Placeholder for unset field.
set_separator (bytes or str, optional) – Separator for set/vector fields.
*args – Variable length argument list.
**kwargs – Arbitrary keyword arguments.

Variables

empty_field (bytes) – Placeholder for empty field.
unset_field (bytes) – Placeholder for unset field.
set_separator (bytes) – Separator for set/vector fields.

property python_type¶

Corresponding Python type annotation.

Type: Any
Return type: Type[uint64]

property zeek_type¶

Corresponding Zeek type name.

Type: str
Return type: Literal[“count”]

parse(data)[source]¶

Parse data from string.

Parameters: data (Union[AnyStr, uint64]) – raw data
Return type: Optional[uint64]
Returns: The parsed numeral data. If data is unset, None will be returned.

tojson(data)[source]¶

Serialize data as JSON log format.

Parameters: data (Optional[uint64]) – raw data
Returns: The JSON serialisable numeral data.
Return type: int

toascii(data)[source]¶

Serialize data as ASCII log format.

Parameters: data (Optional[uint64]) – raw data
Returns: The ASCII representation of numeral data.
Return type: str

class zlogging.types.DoubleType(empty_field=None, unset_field=None, set_separator=None, *args, **kwargs)[source]¶

Bases: zlogging.types._SimpleType

Bro/Zeek double data type.

Parameters

empty_field (bytes or str, optional) – Placeholder for empty field.
unset_field (bytes or str, optional) – Placeholder for unset field.
set_separator (bytes or str, optional) – Separator for set/vector fields.
*args – Variable length argument list.
**kwargs – Arbitrary keyword arguments.

Variables

empty_field (bytes) – Placeholder for empty field.
unset_field (bytes) – Placeholder for unset field.
set_separator (bytes) – Separator for set/vector fields.

property python_type¶

Corresponding Python type annotation.

Type: Any
Return type: Type[Decimal]

property zeek_type¶

Corresponding Zeek type name.

Type: str
Return type: Literal[“double”]

parse(data)[source]¶

Parse data from string.

Parameters: data (Union[AnyStr, Decimal]) – raw data
Return type: Optional[Decimal]
Returns: The parsed numeral data. If data is unset, None will be returned.

tojson(data)[source]¶

Serialize data as JSON log format.

Parameters: data (Optional[Decimal]) – raw data
Returns: The JSON serialisable numeral data.
Return type: float

toascii(data)[source]¶

Serialize data as ASCII log format.

Parameters: data (Optional[Decimal]) – raw data
Returns: The ASCII representation of numeral data.
Return type: str

class zlogging.types.EnumType(empty_field=None, unset_field=None, set_separator=None, namespaces=None, bare=False, enum_hook=None, *args, **kwargs)[source]¶

Bases: zlogging.types._SimpleType

Bro/Zeek enum data type.

Parameters

empty_field (bytes or str, optional) – Placeholder for empty field.
unset_field (bytes or str, optional) – Placeholder for unset field.
set_separator (bytes or str, optional) – Separator for set/vector fields.
namespaces (List[str], optional) – Namespaces to be loaded.
bare (bool, optional) – If True, do not load zeek namespace by default.
enum_hook (dict mapping of str and enum.Enum, optional) – Additional enum to be included in the namespace.
*args – Variable length argument list.
**kwargs – Arbitrary keyword arguments.

Variables

empty_field (bytes) – Placeholder for empty field.
unset_field (bytes) – Placeholder for unset field.
set_separator (bytes) – Separator for set/vector fields.
enum_namespaces (dict mapping str and enum.Enum) – Global namespace for enum data type.

property python_type¶

Corresponding Python type annotation.

Type: Any
Return type: Any

property zeek_type¶

Corresponding Zeek type name.

Type: str
Return type: str

parse(data)[source]¶

Parse data from string.

Parameters: data (Union[AnyStr, Enum]) – raw data
Return type: Optional[Enum]
Returns: The parsed enum data. If data is unset, None will be returned.
Warns: ZeekValueWarning – If date is not defined in the enum namespace.

tojson(data)[source]¶

Serialize data as JSON log format.

Parameters: data (Optional[Enum]) – raw data
Returns: The JSON serialisable enum data.
Return type: str

toascii(data)[source]¶

Serialize data as ASCII log format.

Parameters: data (Optional[Enum]) – raw data
Returns: The ASCII representation of the enum data.
Return type: str

class zlogging.types.IntervalType(empty_field=None, unset_field=None, set_separator=None, *args, **kwargs)[source]¶

Bases: zlogging.types._SimpleType

Bro/Zeek interval data type.

Parameters

empty_field (bytes or str, optional) – Placeholder for empty field.
unset_field (bytes or str, optional) – Placeholder for unset field.
set_separator (bytes or str, optional) – Separator for set/vector fields.
*args – Variable length argument list.
**kwargs – Arbitrary keyword arguments.

Variables

empty_field (bytes) – Placeholder for empty field.
unset_field (bytes) – Placeholder for unset field.
set_separator (bytes) – Separator for set/vector fields.

property python_type¶

Corresponding Python type annotation.

Type: Any
Return type: Type[TimeDeltaType]

property zeek_type¶

Corresponding Zeek type name.

Type: str
Return type: Literal[“interval”]

parse(data)[source]¶

Parse data from string.

Parameters: data (Union[AnyStr, TimeDeltaType]) – raw data
Return type: Optional[TimeDeltaType]
Returns: The parsed numeral data. If data is unset, None will be returned.

tojson(data)[source]¶

Serialize data as JSON log format.

Parameters: data (Optional[TimeDeltaType]) – raw data
Returns: The JSON serialisable numeral data.
Return type: int

toascii(data)[source]¶

Serialize data as ASCII log format.

Parameters: data (Optional[TimeDeltaType]) – raw data
Returns: The ASCII representation of numeral data.
Return type: str

class zlogging.types.IntType(empty_field=None, unset_field=None, set_separator=None, *args, **kwargs)[source]¶

Bases: zlogging.types._SimpleType

Bro/Zeek int data type.

Parameters

empty_field (bytes or str, optional) – Placeholder for empty field.
unset_field (bytes or str, optional) – Placeholder for unset field.
set_separator (bytes or str, optional) – Separator for set/vector fields.
*args – Variable length argument list.
**kwargs – Arbitrary keyword arguments.

Variables

empty_field (bytes) – Placeholder for empty field.
unset_field (bytes) – Placeholder for unset field.
set_separator (bytes) – Separator for set/vector fields.

property python_type¶

Corresponding Python type annotation.

Type: Any
Return type: Type[int64]

property zeek_type¶

Corresponding Zeek type name.

Type: str
Return type: Literal[“int”]

parse(data)[source]¶

Parse data from string.

Parameters: data (Union[AnyStr, int64]) – raw data
Return type: Optional[int64]
Returns: The parsed numeral data. If data is unset, None will be returned.

tojson(data)[source]¶

Serialize data as JSON log format.

Parameters: data (Optional[int64]) – raw data
Returns: The JSON serialisable numeral data.
Return type: int

toascii(data)[source]¶

Serialize data as ASCII log format.

Parameters: data (Optional[int64]) – raw data
Returns: The ASCII representation of numeral data.
Return type: str

class zlogging.types.PortType(empty_field=None, unset_field=None, set_separator=None, *args, **kwargs)[source]¶

Bases: zlogging.types._SimpleType

Bro/Zeek port data type.

Parameters

empty_field (bytes or str, optional) – Placeholder for empty field.
unset_field (bytes or str, optional) – Placeholder for unset field.
set_separator (bytes or str, optional) – Separator for set/vector fields.
*args – Variable length argument list.
**kwargs – Arbitrary keyword arguments.

Variables

empty_field (bytes) – Placeholder for empty field.
unset_field (bytes) – Placeholder for unset field.
set_separator (bytes) – Separator for set/vector fields.

property python_type¶

Corresponding Python type annotation.

Type: Any
Return type: Type[uint16]

property zeek_type¶

Corresponding Zeek type name.

Type: str
Return type: Literal[“port”]

parse(data)[source]¶

Parse data from string.

Parameters: data (Union[AnyStr, uint16]) – raw data
Return type: Optional[uint16]
Returns: The parsed port number. If data is unset, None will be returned.

tojson(data)[source]¶

Serialize data as JSON log format.

Parameters: data (Optional[uint16]) – raw data
Returns: The JSON serialisable port number string.
Return type: int

toascii(data)[source]¶

Serialize data as ASCII log format.

Parameters: data (Optional[uint16]) – raw data
Returns: The ASCII representation of the port number.
Return type: str

class zlogging.types.RecordType(empty_field=None, unset_field=None, set_separator=None, *args, **element_mapping)[source]¶

Bases: zlogging.types._VariadicType

Bro/Zeek record data type.

Parameters

empty_field (bytes or str, optional) – Placeholder for empty field.
unset_field (bytes or str, optional) – Placeholder for unset field.
set_separator (bytes or str, optional) – Separator for set/vector fields.
*args – Variable length argument list.
**kwargs – element_mapping (dict mapping str and BaseType instance): Data type of container’s elements.

Variables

empty_field (bytes) – Placeholder for empty field.
unset_field (bytes) – Placeholder for unset field.
set_separator (bytes) – Separator for set/vector fields.
element_mapping (dict mapping str and BaseType instance) – Data type of container’s elements.

Raises

ZeekTypeError – If element_mapping is not supplied.
ZeekValueError – If element_mapping is not a valid Bro/Zeek data type; or in case of inconsistency from empty_field, unset_field and set_separator of each field.

Note

A valid element_mapping should be a simple or generic data type, i.e. a subclass of _SimpleType or _GenericType.

See also

See _aux_expand_typing() for more information about processing the fields.

property python_type¶

Corresponding Python type annotation.

Type: Any
Return type: Any

property zeek_type¶

Corresponding Zeek type name.

Type: str
Return type: Literal[“record”]

element_mapping: OrderedDict[str, Union[_SimpleType, _GenericType]]¶

class zlogging.types.SetType(empty_field=None, unset_field=None, set_separator=None, element_type=None, *args, **kwargs)[source]¶

Bases: zlogging.types._GenericType, Generic[zlogging.types._S]

Bro/Zeek set data type.

Parameters

empty_field (bytes or str, optional) – Placeholder for empty field.
unset_field (bytes or str, optional) – Placeholder for unset field.
set_separator (bytes or str, optional) – Separator for set/vector fields.
element_type (BaseType instance) – Data type of container’s elements.
*args – Variable length argument list.
**kwargs – Arbitrary keyword arguments.

Variables

empty_field (bytes) – Placeholder for empty field.
unset_field (bytes) – Placeholder for unset field.
set_separator (bytes) – Separator for set/vector fields.
element_type (BaseType instance) – Data type of container’s elements.

Raises

ZeekTypeError – If element_type is not supplied.
ZeekValueError – If element_type is not a valid Bro/Zeek data type.

Example

As a generic data type, the class supports the typing proxy as introduced PEP 484:

>>> SetType[StringType]

which is the same at runtime as following:

>>> SetType(element_type=StringType())

Note

A valid element_type should be a simple data type, i.e. a subclass of _SimpleType.

property python_type¶

Corresponding Python type annotation.

Type: Any
Return type: Any

property zeek_type¶

Corresponding Zeek type name.

Type: str
Return type: str

parse(data)[source]¶

Parse data from string.

Parameters: data (Union[AnyStr, Set[_S]]) – raw data
Return type: Optional[Set[_S]]
Returns: The parsed set data. If data is unset, None will be returned.

tojson(data)[source]¶

Serialize data as JSON log format.

Parameters: data (Optional[Set[_S]]) – raw data
Returns: The JSON serialisable set data.
Return type: list

toascii(data)[source]¶

Serialize data as ASCII log format.

Parameters: data (Optional[Set[_S]]) – raw data
Returns: The ASCII representation of the set data.
Return type: str

class zlogging.types.StringType(empty_field=None, unset_field=None, set_separator=None, *args, **kwargs)[source]¶

Bases: zlogging.types._SimpleType

Bro/Zeek string data type.

Parameters

empty_field (bytes or str, optional) – Placeholder for empty field.
unset_field (bytes or str, optional) – Placeholder for unset field.
set_separator (bytes or str, optional) – Separator for set/vector fields.
*args – Variable length argument list.
**kwargs – Arbitrary keyword arguments.

Variables

empty_field (bytes) – Placeholder for empty field.
unset_field (bytes) – Placeholder for unset field.
set_separator (bytes) – Separator for set/vector fields.

property python_type¶

Corresponding Python type annotation.

Type: Any
Return type: Any

property zeek_type¶

Corresponding Zeek type name.

Type: str
Return type: Literal[“string”]

parse(data)[source]¶

Parse data from string.

Parameters: data (Union[AnyStr, ByteString]) – raw data
Return type: Optional[bytes]
Returns: The parsed string data. If data is unset, None will be returned.

tojson(data)[source]¶

Serialize data as JSON log format.

Parameters: data (Optional[ByteString]) – raw data
Returns: The JSON serialisable string data encoded in ASCII.
Return type: str

toascii(data)[source]¶

Serialize data as ASCII log format.

Parameters: data (Optional[ByteString]) – raw data
Returns: The ASCII encoded string data.
Return type: str

class zlogging.types.SubnetType(empty_field=None, unset_field=None, set_separator=None, *args, **kwargs)[source]¶

Bases: zlogging.types._SimpleType

Bro/Zeek subnet data type.

Parameters

empty_field (bytes or str, optional) – Placeholder for empty field.
unset_field (bytes or str, optional) – Placeholder for unset field.
set_separator (bytes or str, optional) – Separator for set/vector fields.
*args – Variable length argument list.
**kwargs – Arbitrary keyword arguments.

Variables

empty_field (bytes) – Placeholder for empty field.
unset_field (bytes) – Placeholder for unset field.
set_separator (bytes) – Separator for set/vector fields.

property python_type¶

Corresponding Python type annotation.

Type: Any
Return type: Any

property zeek_type¶

Corresponding Zeek type name.

Type: str
Return type: str

parse(data)[source]¶

Parse data from string.

Parameters: data (Union[AnyStr, IPNetwork]) – raw data
Return type: Optional[IPNetwork]
Returns: The parsed IP network. If data is unset, None will be returned.

tojson(data)[source]¶

Serialize data as JSON log format.

Parameters: data (Optional[IPNetwork]) – raw data
Returns: The JSON serialisable IP network string.
Return type: str

toascii(data)[source]¶

Serialize data as ASCII log format.

Parameters: data (Optional[IPNetwork]) – raw data
Returns: The ASCII representation of the IP network.
Return type: str

class zlogging.types.TimeType(empty_field=None, unset_field=None, set_separator=None, *args, **kwargs)[source]¶

Bases: zlogging.types._SimpleType

Bro/Zeek time data type.

Parameters

empty_field (bytes or str, optional) – Placeholder for empty field.
unset_field (bytes or str, optional) – Placeholder for unset field.
set_separator (bytes or str, optional) – Separator for set/vector fields.
*args – Variable length argument list.
**kwargs – Arbitrary keyword arguments.

Variables

empty_field (bytes) – Placeholder for empty field.
unset_field (bytes) – Placeholder for unset field.
set_separator (bytes) – Separator for set/vector fields.

property python_type¶

Corresponding Python type annotation.

Type: Any
Return type: Type[DateTimeType]

property zeek_type¶

Corresponding Zeek type name.

Type: str
Return type: Literal[“time”]

parse(data)[source]¶

Parse data from string.

Parameters: data (Union[AnyStr, DateTimeType]) – raw data
Return type: Optional[DateTimeType]
Returns: The parsed numeral data. If data is unset, None will be returned.

tojson(data)[source]¶

Serialize data as JSON log format.

Parameters: data (Optional[DateTimeType]) – raw data
Returns: The JSON serialisable numeral data.
Return type: float

toascii(data)[source]¶

Serialize data as ASCII log format.

Parameters: data (Optional[DateTimeType]) – raw data
Returns: The ASCII representation of numeral data.
Return type: str

class zlogging.types.VectorType(empty_field=None, unset_field=None, set_separator=None, element_type=None, *args, **kwargs)[source]¶

Bases: zlogging.types._GenericType, Generic[zlogging.types._S]

Bro/Zeek vector data type.

Parameters

empty_field (bytes or str, optional) – Placeholder for empty field.
unset_field (bytes or str, optional) – Placeholder for unset field.
set_separator (bytes or str, optional) – Separator for set/vector fields.
element_type (BaseType instance) – Data type of container’s elements.
*args – Variable length argument list.
**kwargs – Arbitrary keyword arguments.

Variables

empty_field (bytes) – Placeholder for empty field.
unset_field (bytes) – Placeholder for unset field.
set_separator (bytes) – Separator for set/vector fields.
element_type (BaseType instance) – Data type of container’s elements.

Raises

ZeekTypeError – If element_type is not supplied.
ZeekValueError – If element_type is not a valid Bro/Zeek data type.

Example

As a generic data type, the class supports the typing proxy as introduced PEP 484:

>>> VectorType[StringType]

which is the same at runtime as following:

>>> VectorType(element_type=StringType())

Note

A valid element_type should be a simple data type, i.e. a subclass of _SimpleType.

property python_type¶

Corresponding Python type annotation.

Type: Any
Return type: Any

property zeek_type¶

Corresponding Zeek type name.

Type: str
Return type: str

parse(data)[source]¶

Parse data from string.

Parameters: data (Union[AnyStr, List[_S]]) – raw data
Return type: Optional[List[_S]]
Returns: The parsed list data. If data is unset, None will be returned.

tojson(data)[source]¶

Serialize data as JSON log format.

Parameters: data (Optional[List[_S]]) – raw data
Returns: The JSON serialisable list data.
Return type: list

toascii(data)[source]¶

Serialize data as ASCII log format.

Parameters: data (Optional[List[_S]]) – raw data
Returns: The ASCII representation of the list data.
Return type: str

class zlogging.types._GenericType(empty_field=None, unset_field=None, set_separator=None, *args, **kwargs)[source]¶

Bases: zlogging.types.BaseType

Generic data type.

In Bro/Zeek script language, such generic type includes set and vector, which are also known as container types.

class zlogging.types._SimpleType(empty_field=None, unset_field=None, set_separator=None, *args, **kwargs)[source]¶

Bases: zlogging.types.BaseType

Simple data type.

In Bro/Zeek script language, such simple type includes bool, count, int, double, time, interval, string, addr, port, subnet and enum.

To support arbitrary typing as required in JSONParser, any, the arbitrary date type is also included.

class zlogging.types._VariadicType(empty_field=None, unset_field=None, set_separator=None, *args, **kwargs)[source]¶

Bases: zlogging.types.BaseType

Variadic data type.

In Bro/Zeek script language, such variadic type refers to record, which is also a container type.

element_mapping: OrderedDict[str, Union[_SimpleType, _GenericType]]¶

parse(data)[source]¶

Not supported for a variadic data type.

Parameters: data (Any) – data to process
Raises: ZeekNotImplemented – If try to call such method.
Return type: NoReturn

tojson(data)[source]¶

Not supported for a variadic data type.

Parameters: data (Any) – data to process
Raises: ZeekNotImplemented – If try to call such method.
Return type: NoReturn

toascii(data)[source]¶

Not supported for a variadic data type.

Parameters: data (Any) – data to process
Raises: ZeekNotImplemented – If try to call such method.
Return type: NoReturn

Abstract Base Types¶

class zlogging.types.BaseType(empty_field=None, unset_field=None, set_separator=None, *args, **kwargs)[source]¶

Bases: object

Base Bro/Zeek data type.

Parameters

empty_field (bytes or str, optional) – Placeholder for empty field.
unset_field (bytes or str, optional) – Placeholder for unset field.
set_separator (bytes or str, optional) – Separator for set/vector fields.
*args – Variable length argument list.
**kwargs – Arbitrary keyword arguments.

Variables

empty_field (bytes) – Placeholder for empty field.
unset_field (bytes) – Placeholder for unset field.
set_separator (bytes) – Separator for set/vector fields.

abstract property python_type¶

Corresponding Python type annotation.

Type: Any
Return type: Any

abstract property zeek_type¶

Corresponding Zeek type name.

Type: str
Return type: str

property bro_type¶

Corresponding Bro type name.

Type: str
Return type: str

__call__(data)[source]¶

Parse data from string.

This is a proxy method which calls to parse() of the type implementation.

Return type: Any
Parameters: data (Any) –

__str__()[source]¶

Returns the corresponding Zeek type name.

Return type: str

abstract parse(data)[source]¶

Parse data from string.

Return type: Any
Parameters: data (Any) –

abstract tojson(data)[source]¶

Serialize data as JSON log format.

Return type: Any
Parameters: data (Any) –

abstract toascii(data)[source]¶

Serialize data as ASCII log format.

Return type: str
Parameters: data (Any) –

class zlogging.types._SimpleType(empty_field=None, unset_field=None, set_separator=None, *args, **kwargs)[source]¶

Bases: zlogging.types.BaseType

Simple data type.

In Bro/Zeek script language, such simple type includes bool, count, int, double, time, interval, string, addr, port, subnet and enum.

To support arbitrary typing as required in JSONParser, any, the arbitrary date type is also included.

class zlogging.types._GenericType(empty_field=None, unset_field=None, set_separator=None, *args, **kwargs)[source]¶

Bases: zlogging.types.BaseType

Generic data type.

In Bro/Zeek script language, such generic type includes set and vector, which are also known as container types.

class zlogging.types._VariadicType(empty_field=None, unset_field=None, set_separator=None, *args, **kwargs)[source]¶

Bases: zlogging.types.BaseType

Variadic data type.

In Bro/Zeek script language, such variadic type refers to record, which is also a container type.

element_mapping: OrderedDict[str, Union[_SimpleType, _GenericType]]¶

parse(data)[source]¶

Not supported for a variadic data type.

Parameters: data (Any) – data to process
Raises: ZeekNotImplemented – If try to call such method.
Return type: NoReturn

tojson(data)[source]¶

Not supported for a variadic data type.

Parameters: data (Any) – data to process
Raises: ZeekNotImplemented – If try to call such method.
Return type: NoReturn

toascii(data)[source]¶

Not supported for a variadic data type.

Parameters: data (Any) – data to process
Raises: ZeekNotImplemented – If try to call such method.
Return type: NoReturn

Data Types¶

Bro/Zeek Types¶

Abstract Base Types¶

Internal Data¶

ZLogging

Navigation

Related Topics