When can we expect an updated version for Add-on for Bro IDS?

[arthurbreuer]

When can we expect an updated version for the Splunk Add-on for Bro IDS?

The current version only supports Bro v2.2 and Bro v2.3 is already out for some time now. And I think the next version(s) will be out soon. Is this something Splunk is working on as a new version of Bro comes out?

[jcoates_splunk]

Hi, Bro's output format changes between versions, which makes it more time consuming. What features are you wanting to see supported?

[arthurbreuer]

Hi, it would be nice that when a new version of bro gets out, the add on for Bro gets updated too. If the output format is changed, then the add on should be updated or else it would not work anymore. And it would be very nice if new features are available too.

[cstarford]

I agree... Its been awhile since there has been an update and parsing Bro IDS logs manually is not an easy process. Please update the Add-On for the latest version of Bro.

[arthurbreuer]

Or is it simply not necessary to update the app because of the flexible setup? Like with the autotype solution?