# Bro Anomaly Detection

**URL:** <https://community.zeek.org/t/bro-anomaly-detection/3001>\
**Category:** Zeek\
**Created:** [February 14, 2014, 5:57am UTC](https://community.zeek.org/t/bro-anomaly-detection/3001 "2014-02-14T05:57:19Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mr\_Smith](https://avatars.discourse-cdn.com/v4/letter/m/d26b3c/32.png) [@Mr\_Smith](https://community.zeek.org/u/Mr_Smith)\
**Post date:** [February 14, 2014, 5:57am UTC](https://community.zeek.org/t/bro-anomaly-detection/3001/1 "2014-02-14T05:57:19Z")

</div>

Hi, I have two questions regarding the Bro anomaly detection capability.  
1.How does the Bro detect anomalies? Using writing rules(anomaly rules) or using a separate module ?  
2.Is it possible to run the signature-based and anomaly-based parts of Bro separately?  
I mean, can the Bro be used only for the detection of anomalies.If it is possible, how?

Thanks

---

<div class="post-metadata">

**Author:** ![Mr\_Smith](https://avatars.discourse-cdn.com/v4/letter/m/d26b3c/32.png) [@Mr\_Smith](https://community.zeek.org/u/Mr_Smith)\
**Post date:** [February 14, 2014, 6:02am UTC](https://community.zeek.org/t/bro-anomaly-detection/3001/2 "2014-02-14T06:02:31Z")

</div>

Hi, I have two questions regarding the Bro anomaly detection capability.  
1.How does the Bro detect anomalies? Using writing rules(anomaly rules) or using a separate module ?  
2.Is it possible to run the signature-based and anomaly-based parts of Bro separately?  
I mean, can the Bro be used only for the detection of anomalies.If it is possible, how?

Thanks

---

<div class="post-metadata">

**Author:** ![anthony\_kasza1](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@anthony\_kasza1](https://community.zeek.org/u/anthony_kasza1)\
**Post date:** [February 14, 2014, 6:21am UTC](https://community.zeek.org/t/bro-anomaly-detection/3001/3 "2014-02-14T06:21:01Z")

</div>

Technically, many of Bro’s protocol identification capabilities (use by Bro’s anomaly detection capabilities) utilize Bro’s signature framework.

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:41pm UTC](https://community.zeek.org/t/bro-anomaly-detection/3001/4 "2022-05-06T15:41:35Z")

</div>