Our friends at Corelight have merged the new CAF streams into their current testing branch for Broker! Here’s the official announcement on the Bro mailing list:
http://mailman.icsi.berkeley.edu/pipermail/bro-dev/2018-April/012752.html
This is a big deal for CAF. The Bro user base is huge and includes many, many top IT companies. Bro user trying Broker means priceless testing in large, real-world deployments around the world.
I’m looking forward to the feedback and hope CAF isn’t breaking too badly too often. :)
Exciting times!
Best,
Dominik