This package provides a means of creating rules which are applied to connection records. It is an extension to the Intel framework. If a connection record matches criteria in a rule, a notice is raised.
Rules can consist of a group of indicators, a group or rules, or groups of both. Rules include logical operations which are applied across a rule's indicators, nested rules, or both,
See example/ for how this package can be used. Try running:
bro example.bro -Cr sample.pcap