diff --git a/salt/common/tools/packetloss.py b/salt/bro/cron/packetloss.sh
similarity index 100%
rename from salt/common/tools/packetloss.py
rename to salt/bro/cron/packetloss.sh
diff --git a/salt/bro/init.sls b/salt/bro/init.sls
index 36e6803bb..fa167c4f9 100644
--- a/salt/bro/init.sls
+++ b/salt/bro/init.sls
@@ -65,6 +65,16 @@ nodecfgsync:
     - group: 939
     - template: jinja
 
+brocron:
+  cron.present:
+    - name: docker exec -it so-bro /opt/bro/bin/broctl netstats | awk -F '[ =]' '{RCVD += $5;DRP += $7;TTL += $9} END { print "rcvd: " RCVD, "dropped: " DRP, "total: " TTL}' >> /nsm/bro/logs/packetloss.log
+    - user: root
+    - minute: '*/10'
+    - hour: '*'
+    - daymonth: '*'
+    - month: '*'
+    - dayweek: '*'
+
 # Sync local.bro
 {% if salt['pillar.get']('static:broversion', '') == 'COMMUNITY' %}
 localbrosync: