Create ffluxDNS.bro
Update ffluxDNS.bro
Update ffluxDNS.bro
Update ffluxDNS.bro
Update ffluxDNS.bro
Create largeUpload.bro

Adjust maxTx and recordTx accordingly.  Anything over maxTx raise a Large_Outgoing_Tx alert and anything over recordTx raises a Very_Large_Outgoing_Tx alert and sends an email if enabled.

const maxNumUp = how many large uploads to or from an IP that are seen before a Multiple_Large_Outgoing_Tx notice is raised.

global ignore_domains = add any destination domains here that receive large uploads to be ignored.
global vpn_nets = add all subnets used for client VPN access to this set.
Update largeUpload.bro
Update largeUpload.bro
Merge pull request #5 from theflakes/master

Create ffluxDNS.bro