Logging filter for Bro

Zeek
1

Sorry for the basic nature of this question but I seem stuck at a simple bro modification.

I intend to write a bro filter that is outlined here: http://blog.bro.org/2012/02/filtering-logs-with-bro.html (splitting DNS logs), and I have all the parameters I need. However, I am stuck on the actual execution of where and how to put the filter in place. While the article is helpful, I am not sure how to implement the logging filter. Is it just a bro script to be invoked via local.bro?

Brad

2

Actually… answered my own question by just adding the code directly to local.bro. It works!

3

You could also create a new script and place it under /share/bro/site/ and then add an @load statement to local.bro.