Our site has been trying out some IDS packages in the last year and one
of them has been bro. After using it for over 6 months I have a number of
questions about it and thought I'd post these to the email list.
Is there a main Bro web page? (besides Vern's homepage) Anything like
www.bro-ids.org?
Does anyone keep a repository of modules, or is anyone writing/creating new
bro modules? For instance the code red one could/should easily be modified
for nimda or any other variant. Anyone done this?
How many sites are actually using Bro? How many people are on this mailing
list? I don't want to know who, but it might give people a feeling of how
many users are out there using this package.
From what experience I have using bro I think it's really good. However, I
see much more advancement/development on packages like Snort, which seem to
have a much higher (more involved?) user community.