excuse my foolness,
I use ¡°^+c¡± to terminate the Bro every time, for knowing nothing about
the right way to do that.
That is the right way. Or, your policy script can call exit(). Bro
in general is meant to run indefinitely.
Note that when you hit ^C, it will trap the signal and attempt to finish
processing any pending events. If you hit ^C again, you'll get the
message "double signal" and it will immediately exit at that point.