# Blacklist querying using Bro script **URL:** \ **Category:** Zeek\ **Created:** [March 28, 2012, 11:24am UTC](https://community.zeek.org/t/blacklist-querying-using-bro-script/2272 "2012-03-28T11:24:41Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Sheharbano\_Khattak](https://avatars.discourse-cdn.com/v4/letter/s/958977/32.png) [@Sheharbano\_Khattak](https://community.zeek.org/u/Sheharbano_Khattak)\ **Post date:** [March 28, 2012, 11:24am UTC](https://community.zeek.org/t/blacklist-querying-using-bro-script/2272/1 "2012-03-28T11:24:41Z")
Dear Bro Team, I maintain blacklists of botnet C&C servers, spam sources etc. These are usually distributed as text files. Every once in a while, i need to update these by re-downloading them or better yet, by using rsync. In other cases, the database is too large to be locally maintained e.g. DNSBL and i would rather make an online query. I want this process to be completely automated. That is to say, i want to provide Bro with a list of URL’s from where these lists can be obtained at the time of invocation. In my Bro script, i want to handle reading these files and also ‘refresh’ the lists say every 24 hours. Occasionally, i want to be able to make online queries about the ‘sanity’ of certain IP addresses. Can i do this using Bro Script? If not, how do i go about doing this? Regards, ---
**Author:** ![Martin\_Holste](https://avatars.discourse-cdn.com/v4/letter/m/dc4da7/32.png) [@Martin\_Holste](https://community.zeek.org/u/Martin_Holste)\ **Post date:** [March 28, 2012, 1:01pm UTC](https://community.zeek.org/t/blacklist-querying-using-bro-script/2272/2 "2012-03-28T13:01:09Z")
I highly recommend checking out the Collective Intelligence Framework ([http://code.google.com/p/collective-intelligence-framework/](http://code.google.com/p/collective-intelligence-framework/)) as a way to manage your blacklists. Of particular importance is its ability to store and share to authorized parties your org’s own custom blacklists in a seamless way with other blacklists. ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [March 28, 2012, 3:07pm UTC](https://community.zeek.org/t/blacklist-querying-using-bro-script/2272/3 "2012-03-28T15:07:39Z")
Sounds like there are two parts to this: (1) downloading/organizing/maintaining the information, and (2) then getting it into Bro. The former might be best done outside of Bro with something like CIF (as Martin wrote) or even just some simple shell scripts. For the latter, we're working on much better support than is currenty available: the next version will have a new input framework that can read and parse files dynamically at runtime (including dynamic updatess) and map the content into tables or events. It also supports querying other sources like a DB or doing external queries. There's a working prototype in git if you want to give it a try: branch topic/johanna/input-threads. Feel free to send questions and feedback to the development list, we're still working on finalizing the specifics. Robin ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:40pm UTC](https://community.zeek.org/t/blacklist-querying-using-bro-script/2272/4 "2022-05-06T15:40:16Z")