Is there a way when bro logs the suspicious traffics
in pcap format but with separated files. Currently bro
is logging it into the same files and that's hard to
tell which is which. Is there any workaround or I'm
overlooking because I'm just wondering how it can be
done by logging different suscipicious traffics in
different files.
There's no out-of-the-box solution for this but Bro provides the
functions dump_packet(pkt: pcap_packet, file_name: string) and
get_current_packet() which can be used to achieve this. However, due
to the packets being passed to the script-layer this with is most
suitable for capturing a few selected packets, not a large bunch of
them.