BroThon travis Coverage Status supported-versions license

Bro + Python = BroThon!

The BroThon package supports the ingestion, processing, and analysis of Bro IDS data with Python.

Kitware Logo

Why BroThon?

Bro IDS already has a flexible, powerful scripting language why should I use BroThon?

Offloading: Running more complex tasks (yara sigs on files, state machines, machine learning, etc..) should be offloaded from Bro IDS so that Bro can focus on the efficient processing of high volume network traffic.

Python: Pulling Bro data into Python allows us to leverage a large set of of Python modules for data analysis, statistics, machine learning and visualization options.

Data Analysis: A growing set of notebooks/examples using statistics and machine learning on Bro data.

Easy to Use

from brothon import bro_log_reader
    # Run the bro reader on a given log file
    reader = bro_log_reader.BroLogReader('dhcp.log')
    for row in reader.readrows():

Output: Each row is a nice Python Dictionary with timestamps and types properly converted.

{'assigned_ip': '',
'id.orig_h': '',
'id.orig_p': 68,
'id.resp_h': '',
'id.resp_p': 67,
'lease_time': 4294967000.0,
'mac': '00:20:18:eb:ca:54',
'trans_id': 495764278,
'ts': datetime.datetime(2012, 7, 20, 3, 14, 12, 219654),
'uid': 'CJsdG95nCNF1RXuN5'}

More Examples

  • Easy ingestion of any Bro Log into Python (dynamic tailing and log rotations are handled)
  • Bro Logs to Pandas Dataframes (and then dataframes to Machine Learning :)
  • Dynamically monitor files.log and make VirusTotal Queries
  • Dynamically monitor http.log and show ‘uncommon’ User Agents
  • Running Yara Signatures on Extracted Files
  • See BroThon Examples for more details.

Analysis Notebooks

BroThon enables the processing, analysis, and machine learning of realtime data coming from Bro IDS.

  • Risky Domain Modeling and Deployment: <coming soon>


$ pip install brothon
$ pip install brothon[all]   # Includes additional dependencies to run all examples (yara, etc)


If you have any suggestions or questions about Bro IDS Python Utilities feel free to email me at

If you encounter any errors or problems with Bro IDS Python Utilities, please let me know! Open an Issue at the GitHub main repository.