bro_intel feeds as csv file

Zeek
1

Hi all ,
Is possible to generate bro_intel txt files as a .CSV format ?

my format

#fields indicator indicator_type meta.source meta.url meta.do_notice meta.if_in meta.whitelist

Intel::ADDR binarydefense-ip - T - -

Intel::ADDR binarydefense-ip - T - -

Intel::ADDR binarydefense-ip - T - -

Intel::ADDR binarydefense-ip - T - -

Intel::ADDR binarydefense-ip - T - -

Intel::ADDR binarydefense-ip - T - -

Intel::ADDR binarydefense-ip - T - -

Need to change this feeds as a csv format

Regards,
Sunu

2

Hello Sunu,

no, it is not trivially possible to get the intel framework to read csv
files. The easiest way is to convert your format into the Bro syntax.

Alternatively, you can use the input framework yourself, specify the
delimiters that you need and manually call Intel::insert.

Johanna