Greetings There is an entry in the bro.cfg file for the 'start policy'. I am guessing that this is not 'local.site.bro' because that already lives in $BROHOME/etc and apparently gets called automatically. What typically goes in the start policy? Thanks Mike