# Bro policy script language documentation

**URL:** <https://community.zeek.org/t/bro-policy-script-language-documentation/2036>\
**Category:** Zeek\
**Created:** [September 28, 2011, 8:41pm UTC](https://community.zeek.org/t/bro-policy-script-language-documentation/2036 "2011-09-28T20:41:17Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Roger\_Larsen](https://avatars.discourse-cdn.com/v4/letter/r/b2d939/32.png) [@Roger\_Larsen](https://community.zeek.org/u/Roger_Larsen)\
**Post date:** [September 28, 2011, 8:41pm UTC](https://community.zeek.org/t/bro-policy-script-language-documentation/2036/1 "2011-09-28T20:41:17Z")

</div>

Dear Bro Team/Community,

I am studying information security in Gjøvik University College ([www.hig.no](http://www.hig.no)), master degree.

Present I am writing an article about Bro. In this case I struggle in finding detailed documentation regarding The Bro Policy Script Language.

Can You please help me in this matter?

Thanks!

Best Regards,

Roger Larsen

Network manager & student J

---

<div class="post-metadata">

**Author:** ![Marcos\_Rodriguez](https://avatars.discourse-cdn.com/v4/letter/m/ce73a5/32.png) [@Marcos\_Rodriguez](https://community.zeek.org/u/Marcos_Rodriguez)\
**Post date:** [September 28, 2011, 9:14pm UTC](https://community.zeek.org/t/bro-policy-script-language-documentation/2036/2 "2011-09-28T21:14:08Z")

</div>

2011/9/28 Roger Larsen - Høgskolen i Gjøvik \<[roger.larsen@hig.no](mailto:roger.larsen@hig.no)\>

> Dear Bro Team/Community,
> 
> I am studying information security in Gjøvik University College ([www.hig.no](http://www.hig.no)), master degree.
> 
> Present I am writing an article about Bro. In this case I struggle in finding detailed documentation regarding The Bro Policy Script Language.
> 
> Can You please help me in this matter?
> 
> Thanks!
> 
> Best Regards,
> 
> Roger Larsen
> 
> Network manager & student J
> 
> * * *
> 
> Bro mailing list  
> [bro@bro-ids.org](mailto:bro@bro-ids.org)  
> [http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro](http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro)

Hi Roger,

The Bro team is overhauling their documentation, but all is not lost! My first suggestion would be to check out their workshop here:

[http://www-old.bro-ids.org/bro-workshop-2009-2/agenda.html](http://www-old.bro-ids.org/bro-workshop-2009-2/agenda.html)

Also, the documentation is included in the 1.5.3 tarball, however, the docs are dated to about 2004. [http://www-old.bro-ids.org](http://www-old.bro-ids.org) has a wiki with more updated docs (2007, I believe).

Also, get a feel for the scripts included with the tarball, as they are very illuminating. They are the \*.bro files in the /policy directory after you’ve extracted the tarball.

Bro is very powerful from what little I’ve seen so far. I’m a Snort and Suricata guy, and just recently read Vern Paxson’s, et al, **“Robust TCP Reassembly in the Presence of Adversaries”** paper and had to dive into Bro.

Martin Holste is a frequent poster here, and has actually written some nice posts on his blog regarding Bro setup and clustering. Check it out here: [http://ossectools.blogspot.com/](http://ossectools.blogspot.com/)

Hope this helps!

marcos

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:39pm UTC](https://community.zeek.org/t/bro-policy-script-language-documentation/2036/3 "2022-05-06T15:39:51Z")

</div>