[Bro] How to use Broccoli to pull event from Bro

[Siwek, Jon]

On Aug 13, 2014, at 5:44 AM, fql <fengqingleiyue at 163.com> wrote:

> Now i have a question , can i use "Broccoli" to pull the event which looks like the lines in the log files [e.g "conn.log”]

On the Bro side, there is usually an event that corresponds to a given log line, e.g. the “Conn::log_conn” event [1].  On the Broccoli side, there’s a general outline of what needs to be done to receive events at [2], which you should be able to follow to receive events whose parameters correspond to the fields of log files, e.g. “Conn::log_conn” or some other event that you’ve defined yourself in order to pick a subset of the fields that are interesting to you.

- Jon

[1] http://www.bro.org/sphinx-git/scripts/base/protocols/conn/main.bro.html#id-Conn::log_conn
[2] http://www.bro.org/sphinx-git/components/broccoli/broccoli-manual.html#receiving-events