Note: Our current website is at www.zeek.org. This website is unmaintained and contains outdated information.

Zeek Scripting Conventions

Contents

Variable Naming
Rules for base

Variable Naming

Module Names

Camel-cased, no underscores (all uppercase for abbreviations)

Examples: FTP, SSH, Notice, Remote, Signatures

Types

Camel-cased, no underscores

Examples: Log, Connection, EntropyTestResult, GeoLocation, Packet

Variables

Lower-cased with underscores

Examples: example_variable, ftp_sessions

Enum Values

Upper-cased with underscores

Examples: KNOWN_HOSTS, SSH, NFS3_REG

Notice Names

(This is a special case of naming enum values)

Camel-cased with underscores

Examples: Off_Port_Protocol_Found, Malware_Hash_Registry_Match, Site_Exec_Success

Rules for base

Scripts that go into Zeek’s "base" scripts directory have some rules they must follow to be considered for inclusion. This is to enforce some consistency among the scripts as we move toward referring to them as the Zeek Standard Library.

No printing! Use the reporter instead (the BiFs, not the events!).

Frameworks shouldn’t cause any performance overhead merely by the act of loading them.

Protocol scripts (in base) shouldn’t generate any notices.

All consts in export sections must be tagged with &redef.

No reconfiguring variables with redef. If a default setting is incorrect for some scenario then a larger discussion may need to take place about the default value.