# BRO intel framework **URL:** \ **Category:** Zeek\ **Created:** [April 28, 2015, 7:39am UTC](https://community.zeek.org/t/bro-intel-framework/3574 "2015-04-28T07:39:35Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Giedrius\_Ramas](https://avatars.discourse-cdn.com/v4/letter/g/59ef9b/32.png) [@Giedrius\_Ramas](https://community.zeek.org/u/Giedrius_Ramas)\ **Post date:** [April 28, 2015, 7:39am UTC](https://community.zeek.org/t/bro-intel-framework/3574/1 "2015-04-28T07:39:35Z")
Hi all , I am using BRO intel framework and have some doubts about intel.dat file . Currently I have in my script following : redef Intel::read\_files += { “/opt/bro/share/bro/intel/intel.dat” }; How can I append data to /intel.dat ? Can I just overwrite it by using mv linux command ? Is it necessary to reload bro once /intel.dat changed ? Please shed some light on how bro works with that file . ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [April 28, 2015, 4:10pm UTC](https://community.zeek.org/t/bro-intel-framework/3574/2 "2015-04-28T16:10:00Z")
> How can I append data to /intel.dat ? Can I just overwrite it by using mv linux command ? Yes, that’s the best option. > Is it necessary to reload bro once /intel.dat changed ? Nope. Bro will pick up the changes automatically. If you are running on a cluster, it will pick them up on the manager and distribute them out to the workers. Also, the internal intelligence representation is accumulative. If you remove something from that file, Bro is still watching for it.   .Seth ---
**Author:** ![Giedrius\_Ramas](https://avatars.discourse-cdn.com/v4/letter/g/59ef9b/32.png) [@Giedrius\_Ramas](https://community.zeek.org/u/Giedrius_Ramas)\ **Post date:** [April 29, 2015, 5:43am UTC](https://community.zeek.org/t/bro-intel-framework/3574/3 "2015-04-29T05:43:02Z")
Thanks for reply, Could you please elaborate more on that point:" Also, the internal intelligence representation is accumulative. If you remove something from that file, Bro is still watching for it." So, for example if I will overwrite the whole intel file with the new one, what happened to the records from the old file ? Bro still watching for them ? ---
**Author:** ![Nick\_Pratley](https://avatars.discourse-cdn.com/v4/letter/n/b77776/32.png) [@Nick\_Pratley](https://community.zeek.org/u/Nick_Pratley)\ **Post date:** [April 29, 2015, 5:59am UTC](https://community.zeek.org/t/bro-intel-framework/3574/4 "2015-04-29T05:59:27Z")
Yes, Bro would still be watching for them, at least if [http://blog.bro.org/2014/01/intelligence-data-and-bro\_4980.html](http://blog.bro.org/2014/01/intelligence-data-and-bro_4980.html) is still accurate: " A restart is required if you want to purge entries that have been removed from the feeds, but not if you only want the new entries because Bro keeps the file open and will pick up any new additions. " ---
**Author:** ![Giedrius\_Ramas](https://avatars.discourse-cdn.com/v4/letter/g/59ef9b/32.png) [@Giedrius\_Ramas](https://community.zeek.org/u/Giedrius_Ramas)\ **Post date:** [April 29, 2015, 11:42am UTC](https://community.zeek.org/t/bro-intel-framework/3574/5 "2015-04-29T11:42:03Z")
One more thing I need to clarify. I see in bro intel data file (generated by CIF) Intel::URL url’s have a prefix http:// . However when I visit these URLs BRO Intel do not trigger. I tried to remove prefix http:// from url’s in BRO intel file and BRO Intel works well then. So is there anything wrong with CIF generated BRO intel file or elsewhere ? ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [April 29, 2015, 1:03pm UTC](https://community.zeek.org/t/bro-intel-framework/3574/6 "2015-04-29T13:03:24Z")
Yes, it was designed that way originally so we that could do some optimizations in the future. I’m starting to see some more work that needs to be done on the Intelligence framework though so I’m sure that over the next release or two there will be improvements coming in this area and others.   .Seth ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [April 29, 2015, 1:32pm UTC](https://community.zeek.org/t/bro-intel-framework/3574/7 "2015-04-29T13:32:48Z")
Oh, that’s not good. I actually thought at some point that I started stripping prefixes off of urls as they came in, but I may not have gotten that out anywhere.   .Seth ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:42pm UTC](https://community.zeek.org/t/bro-intel-framework/3574/8 "2022-05-06T15:42:37Z")