threat

The IDS formerly known as Bro IDS has been known as Zeek for a while now. In general, additions added to RITA after this rename have used Zeek while additions added in before the rename used Bro. Now, we have areas of the code where we refer to Bro and Zeek interchangeably. This could lead to confusion if someone was not aware of the name change.

As such, we should replace all of the old re

the file output bot supports message_with_type, but the docs don't mention it.

All output bots using OutputBot.export_event support the same parameters, the docs could have a section on those and then these bots' docs just refer to the section

"AA03": { "description": "Weakness in SSO Authorization", "source": (Process, Element), "target": (Process, Server), "condition": "target.implementsAuthenticationScheme is False", },

What if the Process implements BasicAuth or uses mutual TLS (neither of which is SSO)?
If the Process uses SAML or OAuth, then maybe.
Maybe authenticationScheme as a string var is neces