[Bro] How to use Broccoli to pull event from Bro
jsiwek at illinois.edu
Wed Aug 13 07:30:02 PDT 2014
On Aug 13, 2014, at 5:44 AM, fql <fengqingleiyue at 163.com> wrote:
> Now i have a question , can i use "Broccoli" to pull the event which looks like the lines in the log files [e.g "conn.log”]
On the Bro side, there is usually an event that corresponds to a given log line, e.g. the “Conn::log_conn” event . On the Broccoli side, there’s a general outline of what needs to be done to receive events at , which you should be able to follow to receive events whose parameters correspond to the fields of log files, e.g. “Conn::log_conn” or some other event that you’ve defined yourself in order to pick a subset of the fields that are interesting to you.
More information about the Bro