<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>Bro offers:</p>
<p>1) Metadata logging for more protocols than suricata currently,
however this gap is shrinking with the upcoming 4.1 suricata
release. Also, the new rust support allows for adding support for
new protocols in a more generic fashion (vs. having to build it
into the engine). <br>
</p>
<p>2) A Turing complete scripting language. So in theory you can
write a bro policy script to detect any event or sequence of
events observed on a network. You can partially duplicate this
functionality with suricata signatures, flowbits and Lua, however
it isn't as generic as Bro. Since suricata is built around
finite-state machines, it's detection engine is orders of
magnitude faster.<br>
</p>
<p>I replaced our (multiple) snort and bro instances with a single
suricata sensor, given it's multithreaded architecture. I was
only using bro for protocol logging some common stuff, which
suricata has supported for years. I personally see bro as more a
tool for network forensics, (like argus), vs. a pure IDS these
days. So many run both on the same machine and use bro to review
suricata alerts in context. <br>
</p>
<p>-Coop<br>
</p>
<br>
<div class="moz-cite-prefix">On 7/25/2018 11:50 AM, Charles Devoe
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:372E6883-5045-485F-9467-768603D83B4F@cisecurity.org">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered
medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">I have seen
several implementations that combine Suricata and Bro on the
same machine. I am curious to know what does Bro do that
Suricata does not?
<o:p></o:p></span></p>
</div>
This message and attachments may contain confidential information.
If it appears that this message was sent to you by mistake, any
retention, dissemination, distribution or copying of this message
and attachments is strictly prohibited. Please notify the sender
immediately and permanently delete the message and any
attachments.
<br>
<br>
. . . . .
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Suricata IDS Users mailing list: <a class="moz-txt-link-abbreviated" href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</a>
Site: <a class="moz-txt-link-freetext" href="http://suricata-ids.org">http://suricata-ids.org</a> | Support: <a class="moz-txt-link-freetext" href="http://suricata-ids.org/support/">http://suricata-ids.org/support/</a>
List: <a class="moz-txt-link-freetext" href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a>
Conference: <a class="moz-txt-link-freetext" href="https://suricon.net">https://suricon.net</a>
Trainings: <a class="moz-txt-link-freetext" href="https://suricata-ids.org/training/">https://suricata-ids.org/training/</a></pre>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
Cooper Nelson
Network Security Analyst
UCSD ITS Security Team
<a class="moz-txt-link-abbreviated" href="mailto:cnelson@ucsd.edu">cnelson@ucsd.edu</a> x41042</pre>
</body>
</html>