Question about hourly reports sended by Bro-IDS

Zeek
1

Hi all,

Is it possible to change the hourly reports by daily reports?

Thanks.

2

Short answer: For Alarm Summary, yes, for Connection Summary no.
Alarm summary is modifiable if you download the git copy of Bro or wait
for the Bro 2.2 release. Connection Summary emails are tied to log
rotation, and happen hourly. If you don't have a lot of logs, you could
switch to daily rotation to change the connection summary interval to daily.

http://tracker.bro-ids.org/bro/ticket/824

Tyler

3

Many thanks Tyler ... I will try it ...