Bro/SiLK Integration by George Warnagiris
Channel: Zeek
Date: 2014-04-15

The purpose of this talk is to share the results of an investigation into using Bro as a flowmeter and to demonstrate the utility of using network flow records to index Bro data. In order to prove the concept, we configured Bro to feed flow records to the System for Internet Level Knowledge (SiLK), the OSS traffic analysis tools developed by CERT. We then looked at three aspects: how Bro can most efficiently export to SiLK, how can SiLK manipulate Bro data and how can SiLK hook back into Bro with analysis results. We found the potential for synergy between Bro/SiLK, but more work needs to be done in order to achieve results in large production environments.