Phishing detection package for Bro: this package implements the technology defined in : https://people.eecs.berkeley.edu/~grantho/papers/usenix2017-spearphish.pdf
The bro package works primarily using postgres as backend where it creates and maintains reputation data. Postgres is helpful in preserving states across BRO restarts. For postgres backend support you'd need to install bro-postgresql package from: https://github.com/0xxon/bro-postgresql.git
However, you can run this without postgres support. In that case, there will be limitation on how many URLs you can store in memory and keep track of. Historically we can keep up to 300-500K URLs without much problems.
For customization specific to your site/need please see: scripts/configure-variables-in-this-file.bro
Contact : Aashish Sharma, email@example.com if you have further questions/interests