# Quickstart for Bro Cluster **URL:** \ **Category:** Zeek\ **Created:** [September 27, 2011, 3:17pm UTC](https://community.zeek.org/t/quickstart-for-bro-cluster/2033 "2011-09-27T15:17:42Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Martin\_Holste](https://avatars.discourse-cdn.com/v4/letter/m/dc4da7/32.png) [@Martin\_Holste](https://community.zeek.org/u/Martin_Holste)\ **Post date:** [September 27, 2011, 3:17pm UTC](https://community.zeek.org/t/quickstart-for-bro-cluster/2033/1 "2011-09-27T15:17:42Z")
I'm cross-posting this because I think Bro is a very helpful supplement to anyone running an IDS, and it sounded like that was pretty much the consensus at RAID 2011. If you're looking to get Bro up and running as a proof-of-concept, check out my first post on it here: [http://ossectools.blogspot.com/2011/08/monitoring-ssl-connections-with-bro.html](http://ossectools.blogspot.com/2011/08/monitoring-ssl-connections-with-bro.html). If you want it to scale up to a large pipe (anything over 80 Mb/sec), check out my new post on Bro cluster ([http://ossectools.blogspot.com/2011/09/bro-quickstart-cluster-edition.html](http://ossectools.blogspot.com/2011/09/bro-quickstart-cluster-edition.html)) which will show how to set it up to take advantage of a multi-core system and forward its logs to an SIEM or central syslog. If you're not currently using Bro and are wondering why you should bother, consider that Bro provides a great way to survey the SSL traffic that's on your network, and a lot of malware uses SSL for command-and-control channels. It's a terrific way of seeing what email and attachments are being transferred, which can help you spot suspicious attachments, phishing, etc. In addition, it will record the MD5 and URL of every executable downloaded, which can be a real help during incident response. It has many more features (like being able to receive Snort alerts), but these are just some of the immediate benefits you get from running it alongside your current IDS. Thanks, Martin ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [September 27, 2011, 6:00pm UTC](https://community.zeek.org/t/quickstart-for-bro-cluster/2033/2 "2011-09-27T18:00:18Z")
Thanks for writing that quickstart guide Martin! 🙂   .Seth ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:39pm UTC](https://community.zeek.org/t/quickstart-for-bro-cluster/2033/3 "2022-05-06T15:39:51Z")