# Book outline

**URL:** <https://community.zeek.org/t/book-outline/1671>\
**Category:** Development\
**Tags:** development\
**Created:** [October 1, 2010, 3:33pm UTC](https://community.zeek.org/t/book-outline/1671 "2010-10-01T15:33:34Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\
**Post date:** [October 1, 2010, 3:33pm UTC](https://community.zeek.org/t/book-outline/1671/1 "2010-10-01T15:33:34Z")

</div>

Below's a first shot at a chapter outline. This is clearly not  
perfect yet, but let me know what you think. In particular, what's  
missing?

Robin

--------- cut -------------------------------------------------------

1. Introduction

&nbsp;&nbsp;&nbsp;Philosophy (aka "Bro is not Snort")

&nbsp;&nbsp;&nbsp;Features  
&nbsp;&nbsp;&nbsp;  
2. Getting Started

&nbsp;&nbsp;&nbsp;System Requirements

&nbsp;&nbsp;&nbsp;Installing Bro

&nbsp;&nbsp;&nbsp;Running Bro from the Command Line  
&nbsp;&nbsp;&nbsp;  
&nbsp;&nbsp;&nbsp;Using Bro Control

3. Using Bro

&nbsp;&nbsp;&nbsp;Understanding Bro's Output  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Notices and Alarms  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Activity Logs  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Weird Activity  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  
&nbsp;&nbsp;&nbsp;Customizing Scripts  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Building a Site Policy  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Notice Policy  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Tuning  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  
&nbsp;&nbsp;&nbsp;Standard Policy Files  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\<The most important ones\>  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  
&nbsp;&nbsp;&nbsp;Behind the Curtain:  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Capture Filters  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Dynamic Protocol Detection  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  
&nbsp;&nbsp;&nbsp;Log Rotation and Post-Processing  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  
&nbsp;&nbsp;&nbsp;Active Response  
&nbsp;&nbsp;&nbsp;  
&nbsp;&nbsp;&nbsp;Offline Analysis

&nbsp;&nbsp;&nbsp;System Tuning

4. Writing Bro Scripts  
&nbsp;&nbsp;&nbsp;  
&nbsp;&nbsp;&nbsp;Language Overview  
&nbsp;&nbsp;&nbsp;  
&nbsp;&nbsp;&nbsp;Event Handlers  
&nbsp;&nbsp;&nbsp;  
&nbsp;&nbsp;&nbsp;State Management

&nbsp;&nbsp;&nbsp;Inter-Bro Communication  
&nbsp;&nbsp;&nbsp;  
&nbsp;&nbsp;&nbsp;Signatures  
&nbsp;&nbsp;&nbsp;  
&nbsp;&nbsp;&nbsp;Profiling and Debugging

5. Scripting Idioms/Patterns

&nbsp;&nbsp;&nbsp;TODO: Collect.

6. Bro Control

7. Operating a Bro Cluster

8. Interfacing with the External World

&nbsp;&nbsp;&nbsp;Broccoli

&nbsp;&nbsp;&nbsp;Time Machine

9. Bro in Operation

&nbsp;&nbsp;&nbsp;\<Tie things together from an operational perspective\>

10. Summary

&nbsp;&nbsp;&nbsp;Getting More Information  
&nbsp;&nbsp;&nbsp;  
&nbsp;&nbsp;&nbsp;Contributing Back

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:39pm UTC](https://community.zeek.org/t/book-outline/1671/2 "2022-05-06T15:39:11Z")

</div>