Dynamically Updating Signatures With Broccoli?

Zeek
1

Greetings,

The Broccoli documentation indicates that broccoli-based applications can remotely configure Bro without the need for a restart. Would it be possible to dynamically send signature updates to Bro using Broccoli? If so, I'd be happy to implement a reference example. Please advise.

Thanks,

Randy

2

No, that's not possible. Bro doesn't have the internal
infrastructure to recompile signatures on the fly.

At the moment, the only part of the configuration which can be
(reliably) updated on the fly are script-level variables declared as
&redef.

Robin