I have read the whole Bro Reference Manual and others in www.bro-ids.org. The bro is running normally when using policy. I know how to write a signature, but these signatures had never been matched. I have used the local.lite.bro to activate Signature Engine, and the signature.log is nothing even using the simplest signature. I didn’t find the reason.
Someone can help me!
Thanks!
eyoung