Bro Manual

Introduction Section

• Introduction
  • Overview
  • Features
  • History
  • Architecture
• Bro Cluster Architecture
  • Architecture
  • Frontend Options
• Installation
  • Installing Bro
  • Upgrading Bro
• Quick Start Guide
  • Managing Bro with BroControl
  • Bro as a Command-Line Utility
• Cluster Configuration
  • Preparing to Setup a Cluster
  • Basic Cluster Configuration
  • PF_RING Cluster Configuration

Using Bro Section

• Bro Logging
  • Working with Log Files
• Monitoring HTTP Traffic with Bro
  • Introduction to the HTTP log
  • Detecting a Proxy Server
  • Inspecting Files
• Bro IDS
  • Detecting an FTP Brute-force Attack and Notifying
  • Other Attacks
• MIME Type Statistics
  • MIME Statistics with Sumstats
• Writing Bro Scripts
  • Understanding Bro Scripts
  • The Event Queue and Event Handlers
  • The Connection Record Data Type
  • Data Types and Data Structures
  • Custom Logging
  • Raising Notices

Reference Section

• Frameworks
  • File Analysis
  • GeoLocation
  • Input Framework
  • Intelligence Framework
  • Logging Framework
  • NetControl Framework
  • Notice Framework
  • Signature Framework
  • Summary Statistics
  • Broker-Enabled Communication Framework
• Script Reference
  • Operators
  • Types
  • Attributes
  • Declarations and Statements
  • Directives
  • Log Files
  • Notices
  • Protocol Analyzers
  • File Analyzers
  • Bro Package Index
  • Bro Script Index
  • Broxygen Example Script
• Subcomponents
  • BinPAC - A protocol parser generator
  • Broccoli - The Bro Client Communication Library (README)
  • Broccoli - User Manual
  • Broccoli Python Bindings
  • Broccoli Ruby Bindings
  • Broker - Bro's (New) Messaging Library (README)
  • Broker - User Manual
  • BroControl - Interactive Bro management shell
  • Bro-Aux - Small auxiliary tools for Bro
  • Bro-Plugins - A collection of plugins for Bro
  • BTest - A unit testing framework
  • Capstats - Command-line packet statistic tool
  • PySubnetTree - Python module for CIDR lookups
  • trace-summary - Script for generating break-downs of network traffic

Development

• Writing Bro Plugins
  • Quick Start
  • Plugin Directory Layout
  • init-plugin
  • Activating a Plugin
  • Plugin Components
  • Hooks
  • Testing Plugins
  • Debugging Plugins
  • Documenting Plugins

• General Index
• Search Page