[Bro] Connections and Crossed_Threshold-Event

[fatema bannatwala]

Just out of curiosity, have you tried playing with the
https://github.com/theflakes/bro-large_uploads/blob/master/large_uploads.bro
script?
Works well, and it's pretty good at producing different kinds of notices
for large uploads to the internet, also it can easily be tweaked for
detecting the large downloads as well, if that's included in your use-case.
Also, you can change the limits of total byte transfer to whatever you
would like.

Thanks,
Fatema.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20170710/ea290807/attachment.html