I have successfully run the bro0.6. But it now can detect little
intrusions and it is difficult for me to list all the intrusions only
myself. Is there some intrusions .bro which had collect some intrude
behavior?
I don't really understand your question, but all of the publicly available
.bro files are included in the distribution. To see what real-time alerts
are genrated, search for uses of the "log" statement.
Vern