Using plain LuaJIT you can extend Trisul's functionality in a number of ways.

Skeleton Lua scripts you can copy and fill out

LUA Script selector - to help you pick the type of scripting API you need to use to accomplish a variety of tasks

Bro IDS scripting vs Trisul scripting

How to structure your scripts

Links to step by step tutorials

• Tutorial 1 : A Hello World
• Tutorial 2 : A packet length counter
• Tutorial 3 : A basic TCP based DNP3 analyzer
• Tutorial 4 : A step-by-step guide to working with resources (Logs) by writing a URLHaus IOC checker

LuaJIT performance tips

Explains various programming techniques with real examples.

Trisul script to use UA-Parser regex to track HTTP User Agents

A G-QUIC (Google QUIC) analyzer that parses a UDP-443 protocol, extracts indicators, and certificates. Learn how to use LuaJIT FFI to work with decompression, BITMAUL to parse protocols, etc.

Explains the Trisul Google QUIC protocol analyzer script