The Bro Network Security Monitor uses CAF for Scaling Network Analysis

Bro is a state-of-the-art network security monitor, well grounded in more than 15 years of research with a large user base around the world.

At BroCon 2015 (a conference for Bro users and experts), the Bro team revealed Broker: Bro's new communication library. Broker provides a unified, well-defined publish/subscribe model for sharing events and state across independent Bro instances, as well as with external applications.

Broker uses CAF to connect Bro instances to form a single distributed system (of actors). A first beta release of Broker is available in Bro 2.4 and can be enabled with -enable-broker during build.