A Bro Primer by Adam Pumphrey
Channel: Zeek
Date: 2017-09-29

Originally recorded September 12, 2017

This talk aims to help those new to Bro get more familiar with its core concepts and gain a better understanding of the various ways it can be used. Many of those working in the cybersecurity field have little to no software development background when they are introduced to Bro. Many can immediately recognize the forensic and network defense value Bro’s network traffic logs provide, but learning the programming language can seem like a daunting task. Unfortunately, a sound understanding of the Bro programming language and how it can be used to interact with captured network traffic is necessary to begin to realize Bro’s full potential. This talk seeks to provide attendees with some of the foundational knowledge and understanding that can help get up to speed quickly with the language. Functional code samples, with direct applications for practitioners will be used to illustrate core Bro language concepts, scripting tasks common to network monitoring and some helpful scripting techniques that leverage built-in functionality. Emphasis will be on real-world scenarios that new Bro users can apply to support their own monitoring objectives and all code will be made available for download (or referenced) after the presentation.

Slides: https://www.bro.org/brocon2017/slides/bro_primer.pdf