bro_notice_correlation

https://github.com/dopheide/bro_notice_correlation
3 6 3 0 Last Push 4/25/18, 7:45 PM

This package provides a framework to correlate Bro notices together and potentially send off a higher priority notice/alarm as a result of that correlation.

This was presented at a BroCon a few years back: https://www.youtube.com/watch?v=OycQ1aiNqEM&t=3s

Package Version :

Description :

Adds support for multi-notice correlation. For more information, see http://blog.samoehlert.com/correlating-bro-notices or the talk from BroCon 2016.

Script Dir :

scripts

Tags :

correlation, notice, notices