[Bro] Question about hourly reports sended by Bro-IDS

Tyler T. Schoenke tyler.schoenke at colorado.edu
Tue Nov 13 07:07:34 PST 2012

Short answer: For Alarm Summary, yes, for Connection Summary no.   
Alarm summary is modifiable if you download the git copy of Bro or wait
for the Bro 2.2 release.  Connection Summary emails are tied to log
rotation, and happen hourly.  If you don't have a lot of logs, you could
switch to daily rotation to change the connection summary interval to daily.



Tyler Schoenke
Network Security Manager
IT Security Office
University of Colorado at Boulder

On 11/8/12 12:05 AM, C. L. Martinez wrote:
> Hi all,
>  Is it possible to change the hourly reports by daily reports?
> Thanks.
> _______________________________________________
> Bro mailing list
> bro at bro-ids.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro

More information about the Bro mailing list