# need help on bro

**URL:** <https://community.zeek.org/t/need-help-on-bro/1260>\
**Category:** Zeek\
**Created:** [November 8, 2007, 1:35am UTC](https://community.zeek.org/t/need-help-on-bro/1260 "2007-11-08T01:35:56Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![kanthi\_myneni](https://avatars.discourse-cdn.com/v4/letter/k/bcef8e/32.png) [@kanthi\_myneni](https://community.zeek.org/u/kanthi_myneni)\
**Post date:** [November 8, 2007, 1:35am UTC](https://community.zeek.org/t/need-help-on-bro/1260/1 "2007-11-08T01:35:56Z")

</div>

Thanks for reply.

Actually very recently I started bro on linux. Its working with  
installing some missed packages. I am enthusiastic to know how is it  
working.

Yeah I mean about anomaly detection. This must have been done based on  
some site policies right. What are those policies based on. Like they  
vary from site to site right. How those are taken.

Thanks&Regards,  
Kanthi Myneni.

---

<div class="post-metadata">

**Author:** ![Jean-Philippe\_Luigg2](https://avatars.discourse-cdn.com/v4/letter/j/aeb1de/32.png) [@Jean-Philippe\_Luigg2](https://community.zeek.org/u/Jean-Philippe_Luigg2)\
**Post date:** [November 8, 2007, 12:42pm UTC](https://community.zeek.org/t/need-help-on-bro/1260/2 "2007-11-08T12:42:37Z")

</div>

Hello,

The "anomaly detection" idea isn't so easy to both  
understand and use.

If one disregards concepts as neural networks, SOM, etc. it would  
already be necessary to define what is the normality from a network  
point of view, which is normal for then giving alarms on what leaves the  
framework.

Best regards,

Jean-philippe.

---

<div class="post-metadata">

**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\
**Post date:** [November 8, 2007, 4:15pm UTC](https://community.zeek.org/t/need-help-on-bro/1260/3 "2007-11-08T16:15:39Z")

</div>

> already be necessary to define what is the normality from a network  
> point of view, which is normal for then giving alarms on what leaves the  
> framework.

Yes, this is a powerful approach, and one for which Bro is well suited.  
In the research world it's termed specification-based intrusion detection,  
but this hasn't yet caught on as a term in the commercial world.

&nbsp;&nbsp;&nbsp;&nbsp;Vern

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:38pm UTC](https://community.zeek.org/t/need-help-on-bro/1260/4 "2022-05-06T15:38:25Z")

</div>