Using plain LuaJIT you can extend Trisul's functionality in a number of ways.

Skeleton Lua scripts you can copy and fill out

LUA Script selector - to help you pick the type of scripting API you need to use to accomplish a variety of tasks

Bro IDS scripting vs Trisul scripting

How to structure your scripts

Links to step by step tutorials

• Tutorial 1 : A Hello World
• Tutorial 2 : A packet length counter
• Tutorial 3 : A basic TCP based DNP3 analyzer
• Tutorial 4 : A step-by-step guide to working with resources (Logs) by writing a URLHaus IOC checker

Trisul script to use UA-Parser regex to track HTTP User Agents

LuaJIT performance tips

Explains the Trisul Google QUIC protocol analyzer script