# This file was automatically generated by bifcl from event.bif.

global bro_init: event();
global bro_done: event();
global dns_mapping_valid: event(dm: dns_mapping);
global dns_mapping_unverified: event(dm: dns_mapping);
global dns_mapping_new_name: event(dm: dns_mapping);
global dns_mapping_lost_name: event(dm: dns_mapping);
global dns_mapping_name_changed: event(old_dm: dns_mapping, new_dm: dns_mapping);
global dns_mapping_altered: event(dm: dns_mapping, old_addrs: addr_set, new_addrs: addr_set);
global new_connection: event(c: connection);
global new_connection_contents: event(c: connection);
global new_packet: event(c: connection, p: pkt_hdr);
global connection_attempt: event(c: connection);
global connection_established: event(c: connection);
global partial_connection: event(c: connection);
global connection_partial_close: event(c: connection);
global connection_finished: event(c: connection);
global connection_half_finished: event(c: connection);
global connection_rejected: event(c: connection);
global connection_reset: event(c: connection);
global connection_pending: event(c: connection);
global connection_state_remove: event(c: connection);
global connection_SYN_packet: event(c: connection, pkt: SYN_packet);
global connection_first_ACK: event(c: connection);
global connection_timeout: event(c: connection);
global connection_reused: event(c: connection);
global connection_status_update: event(c: connection);
global connection_EOF: event(c: connection, is_orig: bool);
global connection_external: event(c: connection, tag: string);
global expected_connection_seen: event(c: connection, a: count);
global protocol_confirmation: event(c: connection, atype: count, aid: count);
global protocol_violation: event(c: connection, atype: count, aid: count, reason: string);
global packet_contents: event(c: connection, contents: string);
global tcp_packet: event(c: connection, is_orig: bool, flags: string, seq: count, ack: count, len: count, payload: string);
global tcp_option: event(c: connection, is_orig: bool, opt: count, optlen: count);
global tcp_contents: event(c: connection, is_orig: bool, seq: count, contents: string);
global tcp_rexmit: event(c: connection, is_orig: bool, seq: count, len: count, data_in_flight: count, window: count);
global udp_request: event(u: connection);
global udp_reply: event(u: connection);
global udp_contents: event(u: connection, is_orig: bool, contents: string);
global udp_session_done: event(u: connection);
global icmp_sent: event(c: connection, icmp: icmp_conn);
global icmp_echo_request: event(c: connection, icmp: icmp_conn, id: count, seq: count, payload: string);
global icmp_echo_reply: event(c: connection, icmp: icmp_conn, id: count, seq: count, payload: string);
global icmp_unreachable: event(c: connection, icmp: icmp_conn, code: count, context: icmp_context);
global icmp_time_exceeded: event(c: connection, icmp: icmp_conn, code: count, context: icmp_context);
global net_stats_update: event(t: time, ns: net_stats);
global conn_stats: event(c: connection, os: endpoint_stats, rs: endpoint_stats);
global conn_weird: event(name: string, c: connection);
global conn_weird_addl: event(name: string, c: connection, addl: string);
global flow_weird: event(name: string, src: addr, dst: addr);
global net_weird: event(name: string);
global load_sample: event(samples: load_sample_info, CPU: interval, dmem: int);
global rexmit_inconsistency: event(c: connection, t1: string, t2: string);
global ack_above_hole: event(c: connection);
global content_gap: event(c: connection, is_orig: bool, seq: count, length: count);
global inconsistent_option: event(c: connection);
global bad_option: event(c: connection);
global bad_option_termination: event(c: connection);
global arp_request: event(mac_src: string, mac_dst: string, SPA: addr, SHA: string, TPA: addr, THA: string);
global arp_reply: event(mac_src: string, mac_dst: string, SPA: addr, SHA: string, TPA: addr, THA: string);
global bad_arp: event(SPA: addr, SHA: string, TPA: addr, THA: string, explanation: string);
global bittorrent_peer_handshake: event(c: connection, is_orig: bool, reserved: string, info_hash: string, peer_id: string);
global bittorrent_peer_keep_alive: event(c: connection, is_orig: bool);
global bittorrent_peer_choke: event(c: connection, is_orig: bool);
global bittorrent_peer_unchoke: event(c: connection, is_orig: bool);
global bittorrent_peer_interested: event(c: connection, is_orig: bool);
global bittorrent_peer_not_interested: event(c: connection, is_orig: bool);
global bittorrent_peer_have: event(c: connection, is_orig: bool, piece_index: count);
global bittorrent_peer_bitfield: event(c: connection, is_orig: bool, bitfield: string);
global bittorrent_peer_request: event(c: connection, is_orig: bool, index: count, begin: count, length: count);
global bittorrent_peer_piece: event(c: connection, is_orig: bool, index: count, begin: count, piece_length: count);
global bittorrent_peer_cancel: event(c: connection, is_orig: bool, index: count, begin: count, length: count);
global bittorrent_peer_port: event(c: connection, is_orig: bool, listen_port: port);
global bittorrent_peer_unknown: event(c: connection, is_orig: bool, message_id: count, data: string);
global bittorrent_peer_weird: event(c: connection, is_orig: bool, msg: string);
global bt_tracker_request: event(c: connection, uri: string, headers: bt_tracker_headers);
global bt_tracker_response: event(c: connection, status: count, headers: bt_tracker_headers, peers: bittorrent_peer_set, benc: bittorrent_benc_dir);
global bt_tracker_response_not_ok: event(c: connection, status: count, headers: bt_tracker_headers);
global bt_tracker_weird: event(c: connection, is_orig: bool, msg: string);
global finger_request: event(c: connection, full: bool, username: string, hostname: string);
global finger_reply: event(c: connection, reply_line: string);
global gnutella_text_msg: event(c: connection, orig: bool, headers: string);
global gnutella_binary_msg: event(c: connection, orig: bool, msg_type: count, ttl: count, hops: count, msg_len: count, payload: string, payload_len: count, trunc: bool, complete: bool);
global gnutella_partial_binary_msg: event(c: connection, orig: bool, msg: string, len: count);
global gnutella_establish: event(c: connection);
global gnutella_not_establish: event(c: connection);
global gnutella_http_notify: event(c: connection);
global ident_request: event(c: connection, lport: port, rport: port);
global ident_reply: event(c: connection, lport: port, rport: port, user_id: string, system: string);
global ident_error: event(c: connection, lport: port, rport: port, line: string);
global login_failure: event(c: connection, user: string, client_user: string, password: string, line: string);
global login_success: event(c: connection, user: string, client_user: string, password: string, line: string);
global login_input_line: event(c: connection, line: string);
global login_output_line: event(c: connection, line: string);
global login_confused: event(c: connection, msg: string, line: string);
global login_confused_text: event(c: connection, line: string);
global login_terminal: event(c: connection, terminal: string);
global login_display: event(c: connection, display: string);
global login_prompt: event(c: connection, prompt: string);
global rsh_request: event(c: connection, client_user: string, server_user: string, line: string, new_session: bool);
global rsh_reply: event(c: connection, client_user: string, server_user: string, line: string);
global excessive_line: event(c: connection);
global authentication_accepted: event(name: string, c: connection);
global authentication_rejected: event(name: string, c: connection);
global authentication_skipped: event(c: connection);
global activating_encryption: event(c: connection);
global ftp_request: event(c: connection, command: string, arg: string) &group="ftp";
global ftp_reply: event(c: connection, code: count, msg: string, cont_resp: bool) &group="ftp";
global smtp_request: event(c: connection, is_orig: bool, command: string, arg: string) &group="smtp";
global smtp_reply: event(c: connection, is_orig: bool, code: count, cmd: string, msg: string, cont_resp: bool) &group="smtp";
global smtp_data: event(c: connection, is_orig: bool, data: string) &group="smtp";
global smtp_unexpected: event(c: connection, is_orig: bool, msg: string, detail: string) &group="smtp";
global mime_begin_entity: event(c: connection);
global mime_next_entity: event(c: connection);
global mime_end_entity: event(c: connection);
global mime_one_header: event(c: connection, h: mime_header_rec);
global mime_all_headers: event(c: connection, hlist: mime_header_list);
global mime_segment_data: event(c: connection, length: count, data: string);
global mime_entity_data: event(c: connection, length: count, data: string);
global mime_all_data: event(c: connection, length: count, data: string);
global mime_event: event(c: connection, event_type: string, detail: string);
global mime_content_hash: event(c: connection, content_len: count, hash_value: string);
global rpc_call: event(c: connection, prog: count, ver: count, proc: count, status: count, start_time: time, call_len: count, reply_len: count);
global pm_request_null: event(r: connection);
global pm_request_set: event(r: connection, m: pm_mapping, success: bool);
global pm_request_unset: event(r: connection, m: pm_mapping, success: bool);
global pm_request_getport: event(r: connection, pr: pm_port_request, p: port);
global pm_request_dump: event(r: connection, m: pm_mappings);
global pm_request_callit: event(r: connection, call: pm_callit_request, p: port);
global pm_attempt_null: event(r: connection, status: rpc_status);
global pm_attempt_set: event(r: connection, status: rpc_status, m: pm_mapping);
global pm_attempt_unset: event(r: connection, status: rpc_status, m: pm_mapping);
global pm_attempt_getport: event(r: connection, status: rpc_status, pr: pm_port_request);
global pm_attempt_dump: event(r: connection, status: rpc_status);
global pm_attempt_callit: event(r: connection, status: rpc_status, call: pm_callit_request);
global pm_bad_port: event(r: connection, bad_p: count);
global nfs_request_null: event(n: connection);
global nfs_request_getattr: event(n: connection, fh: string, attrs: nfs3_attrs);
global nfs_request_lookup: event(n: connection, req: nfs3_lookup_args, rep: nfs3_lookup_reply);
global nfs_request_fsstat: event(n: connection, root_fh: string, stat: nfs3_fsstat);
global nfs_attempt_null: event(n: connection, status: count);
global nfs_attempt_getattr: event(n: connection, status: count, fh: string);
global nfs_attempt_lookup: event(n: connection, status: count, req: nfs3_lookup_args);
global nfs_attempt_fsstat: event(n: connection, status: count, root_fh: string);
global nfs_reply_status: event(n: connection, status: count);
global ntp_message: event(u: connection, msg: ntp_msg, excess: string);
global netbios_session_message: event(c: connection, is_orig: bool, msg_type: count, data_len: count);
global netbios_session_request: event(c: connection, msg: string);
global netbios_session_accepted: event(c: connection, msg: string);
global netbios_session_rejected: event(c: connection, msg: string);
global netbios_session_raw_message: event(c: connection, is_orig: bool, msg: string);
global netbios_session_ret_arg_resp: event(c: connection, msg: string);
global netbios_session_keepalive: event(c: connection, msg: string);
global smb_message: event(c: connection, hdr: smb_hdr, is_orig: bool, cmd: string, body_length: count, body: string);
global smb_com_tree_connect_andx: event(c: connection, hdr: smb_hdr, path: string, service: string);
global smb_com_tree_disconnect: event(c: connection, hdr: smb_hdr);
global smb_com_nt_create_andx: event(c: connection, hdr: smb_hdr, name: string);
global smb_com_transaction: event(c: connection, hdr: smb_hdr, trans: smb_trans, data: smb_trans_data, is_orig: bool);
global smb_com_transaction2: event(c: connection, hdr: smb_hdr, trans: smb_trans, data: smb_trans_data, is_orig: bool);
global smb_com_trans_mailslot: event(c: connection, hdr: smb_hdr, trans: smb_trans, data: smb_trans_data, is_orig: bool);
global smb_com_trans_rap: event(c: connection, hdr: smb_hdr, trans: smb_trans, data: smb_trans_data, is_orig: bool);
global smb_com_trans_pipe: event(c: connection, hdr: smb_hdr, trans: smb_trans, data: smb_trans_data, is_orig: bool);
global smb_com_read_andx: event(c: connection, hdr: smb_hdr, data: string);
global smb_com_write_andx: event(c: connection, hdr: smb_hdr, data: string);
global smb_get_dfs_referral: event(c: connection, hdr: smb_hdr, max_referral_level: count, file_name: string);
global smb_com_negotiate: event(c: connection, hdr: smb_hdr);
global smb_com_negotiate_response: event(c: connection, hdr: smb_hdr, dialect_index: count);
global smb_com_setup_andx: event(c: connection, hdr: smb_hdr);
global smb_com_generic_andx: event(c: connection, hdr: smb_hdr);
global smb_com_close: event(c: connection, hdr: smb_hdr);
global smb_com_logoff_andx: event(c: connection, hdr: smb_hdr);
global smb_error: event(c: connection, hdr: smb_hdr, cmd: count, cmd_str: string, data: string);
global dns_message: event(c: connection, is_orig: bool, msg: dns_msg, len: count) &group="dns";
global dns_request: event(c: connection, msg: dns_msg, query: string, qtype: count, qclass: count) &group="dns";
global dns_full_request: event() &group="dns";
global dns_rejected: event(c: connection, msg: dns_msg, query: string, qtype: count, qclass: count) &group="dns";
global dns_A_reply: event(c: connection, msg: dns_msg, ans: dns_answer, a: addr) &group="dns";
global dns_AAAA_reply: event(c: connection, msg: dns_msg, ans: dns_answer, a: addr, astr: string) &group="dns";
global dns_NS_reply: event(c: connection, msg: dns_msg, ans: dns_answer, name: string) &group="dns";
global dns_CNAME_reply: event(c: connection, msg: dns_msg, ans: dns_answer, name: string) &group="dns";
global dns_PTR_reply: event(c: connection, msg: dns_msg, ans: dns_answer, name: string) &group="dns";
global dns_SOA_reply: event(c: connection, msg: dns_msg, ans: dns_answer, soa: dns_soa) &group="dns";
global dns_WKS_reply: event(c: connection, msg: dns_msg, ans: dns_answer) &group="dns";
global dns_HINFO_reply: event(c: connection, msg: dns_msg, ans: dns_answer) &group="dns";
global dns_MX_reply: event(c: connection, msg: dns_msg, ans: dns_answer, name: string, preference: count) &group="dns";
global dns_TXT_reply: event(c: connection, msg: dns_msg, ans: dns_answer, str: string) &group="dns";
global dns_SRV_reply: event(c: connection, msg: dns_msg, ans: dns_answer) &group="dns";
global dns_EDNS: event(c: connection, msg: dns_msg, ans: dns_answer) &group="dns";
global dns_EDNS_addl: event(c: connection, msg: dns_msg, ans: dns_edns_additional) &group="dns";
global dns_TSIG_addl: event(c: connection, msg: dns_msg, ans: dns_tsig_additional) &group="dns";
global dns_end: event(c: connection, msg: dns_msg) &group="dns";
global dns_query_reply: event(c: connection, msg: dns_msg, query: string, qtype: count, qclass: count) &group="dns";
global non_dns_request: event(c: connection, msg: string) &group="dns";
global dhcp_discover: event(c: connection, msg: dhcp_msg, req_addr: addr);
global dhcp_offer: event(c: connection, msg: dhcp_msg, mask: addr, router: dhcp_router_list, lease: interval, serv_addr: addr);
global dhcp_request: event(c: connection, msg: dhcp_msg, req_addr: addr, serv_addr: addr);
global dhcp_decline: event(c: connection, msg: dhcp_msg);
global dhcp_ack: event(c: connection, msg: dhcp_msg, mask: addr, router: dhcp_router_list, lease: interval, serv_addr: addr);
global dhcp_nak: event(c: connection, msg: dhcp_msg);
global dhcp_release: event(c: connection, msg: dhcp_msg);
global dhcp_inform: event(c: connection, msg: dhcp_msg);
global http_request: event(c: connection, method: string, original_URI: string, unescaped_URI: string, version: string) &group="http-request";
global http_reply: event(c: connection, version: string, code: count, reason: string) &group="http-reply";
global http_header: event(c: connection, is_orig: bool, name: string, value: string) &group="http-header";
global http_all_headers: event(c: connection, is_orig: bool, hlist: mime_header_list) &group="http-header";
global http_begin_entity: event(c: connection, is_orig: bool) &group="http-body";
global http_end_entity: event(c: connection, is_orig: bool) &group="http-body";
global http_content_type: event(c: connection, is_orig: bool, ty: string, subty: string) &group="http-body";
global http_entity_data: event(c: connection, is_orig: bool, length: count, data: string) &group="http-body";
global http_message_done: event(c: connection, is_orig: bool, stat: http_message_stat) &group="http-body";
global http_event: event(c: connection, event_type: string, detail: string);
global http_stats: event(c: connection, stats: http_stats_rec);
global ssh_client_version: event(c: connection, version: string);
global ssh_server_version: event(c: connection, version: string);
global ssl_certificate_seen: event(c: connection, is_server: bool);
global ssl_certificate: event(c: connection, cert: X509, is_server: bool);
global ssl_conn_attempt: event(c: connection, version: count, ciphers: cipher_suites_list);
global ssl_conn_server_reply: event(c: connection, version: count, ciphers: cipher_suites_list);
global ssl_conn_established: event(c: connection, version: count, cipher_suite: count);
global ssl_conn_reused: event(c: connection, session_id: SSL_sessionID);
global ssl_conn_alert: event(c: connection, version: count, level: count, description: count);
global ssl_conn_weak: event(name: string, c: connection);
global ssl_session_insertion: event(c: connection, id: SSL_sessionID);
global process_X509_extensions: event(c: connection, ex: X509_extension);
global ssl_X509_error: event(c: connection, err: int, err_string: string);
global stp_create_endp: event(c: connection, e: int, is_orig: bool);
global stp_resume_endp: event(e: int);
global stp_correlate_pair: event(e1: int, e2: int);
global stp_remove_pair: event(e1: int, e2: int);
global stp_remove_endp: event(e: int);
global dce_rpc_message: event(c: connection, is_orig: bool, ptype: dce_rpc_ptype, msg: string);
global dce_rpc_bind: event(c: connection, uuid: string);
global dce_rpc_request: event(c: connection, opnum: count, stub: string);
global dce_rpc_response: event(c: connection, opnum: count, stub: string);
global epm_map_response: event(c: connection, uuid: string, p: port, h: addr);
global ncp_request: event(c: connection, frame_type: count, length: count, func: count);
global ncp_reply: event(c: connection, frame_type: count, length: count, req_frame: count, req_func: count, completion_code: count);
global interconn_stats: event(c: connection, os: interconn_endp_stats, rs: interconn_endp_stats);
global interconn_remove_conn: event(c: connection);
global backdoor_stats: event(c: connection, os: backdoor_endp_stats, rs: backdoor_endp_stats);
global backdoor_remove_conn: event(c: connection);
global ssh_signature_found: event(c: connection, is_orig: bool);
global telnet_signature_found: event(c: connection, is_orig: bool, len: count);
global rlogin_signature_found: event(c: connection, is_orig: bool, num_null: count, len: count);
global root_backdoor_signature_found: event(c: connection);
global ftp_signature_found: event(c: connection);
global napster_signature_found: event(c: connection);
global gnutella_signature_found: event(c: connection);
global kazaa_signature_found: event(c: connection);
global http_signature_found: event(c: connection);
global http_proxy_signature_found: event(c: connection);
global smtp_signature_found: event(c: connection);
global irc_signature_found: event(c: connection);
global gaobot_signature_found: event(c: connection);
global pop3_request: event(c: connection, is_orig: bool, command: string, arg: string);
global pop3_reply: event(c: connection, is_orig: bool, cmd: string, msg: string);
global pop3_data: event(c: connection, is_orig: bool, data: string);
global pop3_unexpected: event(c: connection, is_orig: bool, msg: string, detail: string);
global pop3_terminate: event(c: connection, is_orig: bool, msg: string);
global pop3_login_success: event(c: connection, is_orig: bool, user: string, password: string);
global pop3_login_failure: event(c: connection, is_orig: bool, user: string, password: string);
global irc_client: event(c: connection, prefix: string, data: string);
global irc_server: event(c: connection, prefix: string, data: string);
global irc_request: event(c: connection, prefix: string, command: string, arguments: string);
global irc_reply: event(c: connection, prefix: string, code: count, params: string);
global irc_message: event(c: connection, prefix: string, command: string, message: string);
global irc_enter_message: event(c: connection, nick: string, real_name: string);
global irc_quit_message: event(c: connection, nick: string, message: string);
global irc_privmsg_message: event(c: connection, source: string, target: string, message: string);
global irc_notice_message: event(c: connection, source: string, target: string, message: string);
global irc_squery_message: event(c: connection, source: string, target: string, message: string);
global irc_join_message: event(c: connection, info_list: irc_join_list);
global irc_part_message: event(c: connection, nick: string, chans: string_set, message: string);
global irc_nick_message: event(c: connection, who: string, newnick: string);
global irc_invalid_nick: event(c: connection);
global irc_network_info: event(c: connection, users: count, services: count, servers: count);
global irc_server_info: event(c: connection, users: count, services: count, servers: count);
global irc_channel_info: event(c: connection, chans: count);
global irc_who_line: event(c: connection, target_nick: string, channel: string, user: string, host: string, server: string, nick: string, params: string, hops: count, real_name: string);
global irc_who_message: event(c: connection, mask: string, oper: bool);
global irc_whois_message: event(c: connection, server: string, users: string);
global irc_whois_user_line: event(c: connection, nick: string, user: string, host: string, real_name: string);
global irc_whois_operator_line: event(c: connection, nick: string);
global irc_whois_channel_line: event(c: connection, nick: string, chans: string_set);
global irc_oper_message: event(c: connection, user: string, password: string);
global irc_oper_response: event(c: connection, got_oper: bool);
global irc_kick_message: event(c: connection, prefix: string, chans: string, users: string, comment: string);
global irc_error_message: event(c: connection, prefix: string, message: string);
global irc_invite_message: event(c: connection, prefix: string, nickname: string, channel: string);
global irc_mode_message: event(c: connection, prefix: string, params: string);
global irc_squit_message: event(c: connection, prefix: string, server: string, message: string);
global irc_names_info: event(c: connection, c_type: string, channel: string, users: string_set);
global irc_dcc_message: event(c: connection, prefix: string, target: string, dcc_type: string, argument: string, address: addr, dest_port: count, size: count);
global irc_global_users: event(c: connection, prefix: string, msg: string);
global irc_user_message: event(c: connection, user: string, host: string, server: string, real_name: string);
global irc_channel_topic: event(c: connection, channel: string, topic: string);
global irc_password_message: event(c: connection, password: string);
global file_transferred: event(c: connection, prefix: string, descr: string, mime_type: string);
global file_virus: event(c: connection, virname: string);
global signature_match: event(state: signature_state, msg: string, data: string);
global software_version_found: event(c: connection, host: addr, s: software, descr: string);
global software_parse_error: event(c: connection, host: addr, descr: string);
global software_unparsed_version_found: event(c: connection, host: addr, str: string);
global OS_version_found: event(c: connection, host: addr, OS: OS_version);
global anonymization_mapping: event(orig: addr, mapped: addr);
global remote_connection_established: event(p: event_peer);
global remote_connection_closed: event(p: event_peer);
global remote_connection_handshake_done: event(p: event_peer);
global remote_event_registered: event(p: event_peer, name: string);
global remote_connection_error: event(p: event_peer, reason: string);
global remote_capture_filter: event(p: event_peer, filter: string);
global finished_send_state: event(p: event_peer);
global remote_state_inconsistency: event(operation: string, id: string, expected_old: string, real_old: string);
global remote_log: event(level: count, src: count, msg: string);
global remote_pong: event(p: event_peer, seq: count, d1: interval, d2: interval, d3: interval);
global remote_state_access_performed: event(id: string, v: any);
global profiling_update: event(f: file, expensive: bool);
global print_hook: event(f: file, s: string);
global rotate_interval: event(f: file);
global rotate_size: event(f: file);
global netflow_v5_header: event(h: nf_v5_header);
global netflow_v5_record: event(r: nf_v5_record);
