bro-scripts: add cif.bro and files in test.