| 09:00 - 09:05 | Welcome and Logistics (Vern Paxson) |
| 09:05 - 10:15 | Bro Design Overview (Vern Paxson) |
| 10:15 - 10:45 | Installing Bro (Robin Sommer) |
| Break | |
| 11:00 - 12:30 | Basics of Using Bro (Robin Sommer) |
| Lunch | |
| 01:30 - 02:15 | Lab Exercise 1: Running Bro (Solution) |
| 02:15 - 03:30 | Scripting Language Overview (Vern Paxson) |
| Break | |
| 04:00 - 05:00 | Lab Exercise 2: Tuning Bro's Configuration (Solution) |
| 09:00 - 10:00 | Lab Exercise 3: Writing Event Handlers (Solution) |
| 10:00 - 11:00 | Advanced Bro Scripting (Robin Sommer) |
| Break | |
| 11:30 - 12:30 | Lab Exercise 4: State Management (Solution) |
| Lunch | |
| 01:30 - 02:00 | Interfacing with Bro (Steve Chan and Craig Lant, NERSC) |
| 02:00 - 02:30 | Logging to PostgreSQL (Seth Hall, OSU) |
| 02:30 - 03:30 | Lab Exercise 5: Communication (Solution) |
| Break | |
| 04:00 - 04:30 | Bro Cluster and Cluster Shell (Robin Sommer) |
| 04:30 - 05:00 | Questions/Discussion |
| 09:00 - 09:30 | Application Performance Monitoring with a Bro-based Sensor (Randy Caldejon, nPulse Network Systems) [Canceled] |
| 09:30 - 10:00 | Interfacing Bro with the Time Machine (Robin Sommer) |
| Break | |
| 10:15 - 11:15 | Lab Exercise 6: Application-layer Analysis (Solution) |
| 11:15 - 11:45 | Integrating Application Data into Bro (Scott Campbell, NERSC) |
| Break | |
| 12:00 - 12:30 | Future Plans (Vern Paxson) |
| 12:30 - 13:00 | Wrap-up and Discussions |
Homework Exercise: Monitoring for an Activity Fingerprint (Solution)