I just wanna clarify that , is the backdoor event engine(which does all
the signature detection) eventually invokes the corresponding event
engine and the Analyser .
The backdoor analyzer is separate from Bro's signature engine. The analyzer
only generates backdoor events - not other signature events, and not protocol
parsing events.
Vern