Bro Plugin Question

Zeek
1

Can Bro plugins that add BIFs take configuration files of their own?

An example configuration item might be to add the IP and port that another host listens to for output from Bro, or other app specific parameters. An example plugin might take the types of data being put into known_* scripts and adding entries to a DB on another host for a passive inventory. Another example might be configuring a host and port to send event stats to. I'd rather not hard code these values into a plugin if possible and I'd like to be able to change the configuration values without recompiling; although a Broctl install/restart would be OK.

Thanks,

Gary

2

Hello Gary,

Can Bro plugins that add BIFs take configuration files of their own?

It depends what exactly you mean by configuration files. The way I would
go to add configuration options is to use exactly the same approach that
Bro itself uses: create scripts, which contain default values that can be
redefined.

That is something that plugins also can do - users then can redefine the
values to watever they need in their local.bro or other scripts.

If you want to get more fancy, you can also write plugins to broctl, which
might be able to automate this task (depending on what kind of
configuration options you want to set).

Johanna