# Bro-IDS integration to sguil **URL:** \ **Category:** Zeek\ **Created:** [July 4, 2006, 2:27pm UTC](https://community.zeek.org/t/bro-ids-integration-to-sguil/989 "2006-07-04T14:27:56Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Lee\_Sheng](https://avatars.discourse-cdn.com/v4/letter/l/c6cbf5/32.png) [@Lee\_Sheng](https://community.zeek.org/u/Lee_Sheng)\ **Post date:** [July 4, 2006, 2:27pm UTC](https://community.zeek.org/t/bro-ids-integration-to-sguil/989/1 "2006-07-04T14:27:56Z")
Hi all, I think I had previously mentioned the availabilities of brooery and Christian has replied with the answer that brooery is not ready yet and recommend me to try sguil. I have been long time user of sguil under production environment, and I would like to see the integration of bro-ids to provide alert data to sguil. While sguil integrates 4 forms of data including alert data that provided by snort, I think that's possible to have bro-IDS alert data sending to sguil as well. I have talked to the core developer of sguil - Bamm, and he told me that it can be done by having bro talking to the sensor\_agent.tcl. I'm not that familiar with bro comparing to snort, thus I would like to know any pointer and reference that can help me to complete the integration of bro to sguil. Many Thanks. I think that would be lovely to have it done. ---
**Author:** ![Christian\_Kreibich3](https://avatars.discourse-cdn.com/v4/letter/c/4af34b/32.png) [@Christian\_Kreibich3](https://community.zeek.org/u/Christian_Kreibich3)\ **Post date:** [July 4, 2006, 4:20pm UTC](https://community.zeek.org/t/bro-ids-integration-to-sguil/989/2 "2006-07-04T16:20:32Z")
> Hi all, I think I had previously mentioned the > availabilities of brooery and Christian has replied > with the answer that brooery is not ready yet and > recommend me to try sguil. I have been long time user > of sguil under production environment, and I would > like to see the integration of bro-ids to provide > alert data to sguil. Yeah, that'd definitely be useful. > While sguil integrates 4 forms of data including alert > data that provided by snort, I think that's possible > to have bro-IDS alert data sending to sguil as well. I > have talked to the core developer of sguil - Bamm, and > he told me that it can be done by having bro talking > to the sensor\_agent.tcl. > > I'm not that familiar with bro comparing to snort, > thus I would like to know any pointer and reference > that can help me to complete the integration of bro to > sguil. Many Thanks. You definitely want to check out the Broccoli library -- communication with other nodes is intrinsic now in Bro, and Broccoli provides nearly full-blown Bro communications endpoint functionality to external applications:   [Broccoli — The Bro client communications library](http://www.cl.cam.ac.uk/~cpk25/broccoli/index.html) I'm not familiar with sensor\_agent.tcl but instead of hacking more support for external features into Bro, Broccoli is very likely the better alternative. Indeed if we had Broccoli bindings to more languages it'd become even easier, but finding the time is a problem right now... > I think that would be lovely to have it done. No doubt! Keep us posted. Cheers, Christian. ---
**Author:** ![Jean-Philippe\_Luigg2](https://avatars.discourse-cdn.com/v4/letter/j/aeb1de/32.png) [@Jean-Philippe\_Luigg2](https://community.zeek.org/u/Jean-Philippe_Luigg2)\ **Post date:** [July 4, 2006, 6:09pm UTC](https://community.zeek.org/t/bro-ids-integration-to-sguil/989/3 "2006-07-04T18:09:59Z")
Hello Lee, The question is what sort of data sguil is waiting for : text, binaries, syslog ? Bro is able to send data using various methods so as soon as we know what do we need to send, we'll see how doing this. Best regards. PS: i find your idea very good. Best regards. ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:37pm UTC](https://community.zeek.org/t/bro-ids-integration-to-sguil/989/4 "2022-05-06T15:37:54Z")
Closed on May 6, 2022, 3:37pm UTC