Bro

Installation Path: /opt/nsm/bro

Bro for the most part is a default installation. The following two settings are changed for Sweet Security:

Custom Configurations

Monitored Interface

Config File: /opt/nsm/bro/etc/node.cfg

interface=<chosen_interface>

This is configured during installation. If you need to change interfaces post installation, this setting will need to be modified.

Ignore Sweet Security Server

Config File: /opt/nsm/bro/etc/broctl.cfg

broargs = -f ‘not host <sweet_security_server>’

There is a lot of communication between the sensor and the server, which can cause unnecessary logs to be created by Bro. This will ignore that communication and not create logs for mundane communication between sensor and server. If you change the location of the Sweet Security Server, this setting should be modified as well.