[Bro] Bro Plugin Question

Gary Faulkner gfaulkner.nsm at gmail.com
Tue Oct 11 11:08:05 PDT 2016


Can Bro plugins that add BIFs take configuration files of their own?

An example configuration item might be to add the IP and port that 
another host listens to for output from Bro, or other app specific 
parameters. An example plugin might take the types of data being put 
into known_* scripts and adding entries to a DB on another host for a 
passive inventory. Another example might be configuring a host and port 
to send event stats to. I'd rather not hard code these values into a 
plugin if possible and I'd like to be able to change the configuration 
values without recompiling; although a Broctl install/restart would be OK.

Thanks,

Gary



More information about the Bro mailing list