# Can Bro Anonymize the Data it Captures?

**URL:** <https://community.zeek.org/t/can-bro-anonymize-the-data-it-captures/2032>\
**Category:** Zeek\
**Created:** [September 27, 2011, 11:11am UTC](https://community.zeek.org/t/can-bro-anonymize-the-data-it-captures/2032 "2011-09-27T11:11:46Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Wathsala\_Vithanage](https://avatars.discourse-cdn.com/v4/letter/w/b19c9b/32.png) [@Wathsala\_Vithanage](https://community.zeek.org/u/Wathsala_Vithanage)\
**Post date:** [September 27, 2011, 11:11am UTC](https://community.zeek.org/t/can-bro-anonymize-the-data-it-captures/2032/1 "2011-09-27T11:11:46Z")

</div>

Hi,

Is Bro capable of anonymizing the logs it generate?

Thanks.

---

<div class="post-metadata">

**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\
**Post date:** [September 27, 2011, 3:49pm UTC](https://community.zeek.org/t/can-bro-anonymize-the-data-it-captures/2032/2 "2011-09-27T15:49:03Z")

</div>

Kind of. Bro 1.5 comes with the anonymization systems described in  
this paper:

&nbsp;&nbsp;&nbsp;&nbsp;[http://conferences.sigcomm.org/sigcomm/2003/papers/p339-pang.pdf](http://conferences.sigcomm.org/sigcomm/2003/papers/p339-pang.pdf)

This is very cool stuff. However, the code hasn't been maintained for  
a long time already and, due to bit rot, there are various pieces here  
and there that aren't working right anymore. For the upcoming release,  
we have thus completely removed that functionality.

Robin

---

<div class="post-metadata">

**Author:** ![Wathsala\_Vithanage](https://avatars.discourse-cdn.com/v4/letter/w/b19c9b/32.png) [@Wathsala\_Vithanage](https://community.zeek.org/u/Wathsala_Vithanage)\
**Post date:** [September 27, 2011, 4:55pm UTC](https://community.zeek.org/t/can-bro-anonymize-the-data-it-captures/2032/3 "2011-09-27T16:55:49Z")

</div>

Thanks Robin,

> Kind of. Bro 1.5 comes with the anonymization systems described in  
> this paper:

I have already installed Bro version 2.0. I'm happy to revert back to  
version 1.5 if it has the logging framework that will be available in  
version 2.0.

> This is very cool stuff. However, the code hasn't been maintained for  
> a long time already and, due to bit rot, there are various pieces here  
> and there that aren't working right anymore.

Cool stuff indeed! Can you provide me few pointers to the relevant code?

Thanks

---

<div class="post-metadata">

**Author:** ![Gregor\_Maier](https://avatars.discourse-cdn.com/v4/letter/g/94ad74/32.png) [@Gregor\_Maier](https://community.zeek.org/u/Gregor_Maier)\
**Post date:** [September 27, 2011, 5:55pm UTC](https://community.zeek.org/t/can-bro-anonymize-the-data-it-captures/2032/4 "2011-09-27T17:55:04Z")

</div>

> Kind of. Bro 1.5 comes with the anonymization systems described in  
> this paper:
> 
> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;[http://conferences.sigcomm.org/sigcomm/2003/papers/p339-pang.pdf](http://conferences.sigcomm.org/sigcomm/2003/papers/p339-pang.pdf)
> 
> This is very cool stuff. However, the code hasn't been maintained for  
> a long time already and, due to bit rot, there are various pieces here  
> and there that aren't working right anymore. For the upcoming release,  
> we have thus completely removed that functionality.

Hmm. I'm actually wondering whether all the flexibility of the new logging framework would enable us to anonymize log files as a transparent add-on on the script layer.....

I guess that in any case one could always modify / anonymize the c$PROTOCOL record just before it gets logged....

cu  
Gregor

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:39pm UTC](https://community.zeek.org/t/can-bro-anonymize-the-data-it-captures/2032/5 "2022-05-06T15:39:51Z")

</div>

Closed on May 6, 2022, 3:39pm UTC