Can a bro script run an external (linux ) command from an event handler ?
I think you’re looking for exec.
Here's a sample script (for better or worse) that I wrote a while back
that looks up files in Virustotal.
You can also check out the ActiveHTTP module to see how the Exec framework uses curl to make http connections from Bro.