# bro intel {INTEL::URL} date file format check

**URL:** <https://community.zeek.org/t/bro-intel-intel-url-date-file-format-check/5355>\
**Category:** Zeek\
**Created:** [June 15, 2018, 4:32pm UTC](https://community.zeek.org/t/bro-intel-intel-url-date-file-format-check/5355 "2018-06-15T16:32:38Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![ps\_sunu](https://avatars.discourse-cdn.com/v4/letter/p/9d8465/32.png) [@ps\_sunu](https://community.zeek.org/u/ps_sunu)\
**Post date:** [June 15, 2018, 4:32pm UTC](https://community.zeek.org/t/bro-intel-intel-url-date-file-format-check/5355/1 "2018-06-15T16:32:38Z")

</div>

Hi,  
I am using bro intel , INTEL::URL as below format

#fields indicator indicator\_type meta.source meta.url meta.do\_notice meta.if\_in meta.whitelist  
[hardcomng.com/doc/Main/](http://hardcomng.com/doc/Main/) Intel::URL cybercrime-url - T - -  
[hardcomng.com/diamond/](http://hardcomng.com/diamond/) Intel::URL cybercrime-url - T - -  
[hardcomng.com/doc/Formgrab/](http://hardcomng.com/doc/Formgrab/) Intel::URL cybercrime-url - T - -  
[hardcomng.com/panel/login/](http://hardcomng.com/panel/login/) Intel::URL cybercrime-url - T - -  
[name.xcution.pw/](http://name.xcution.pw/) Intel::URL cybercrime-url - T - -  
[melatidanes.com/m3l4t1DANES/asset/js/connect/login.php](http://melatidanes.com/m3l4t1DANES/asset/js/connect/login.php) Intel::URL cybercrime-url - T - -  
[forwarderindia.cf/dollarspanel/login.php](http://forwarderindia.cf/dollarspanel/login.php) Intel::URL cybercrime-url - T - -  
[nobles-iq.com/WebPanel/login.php](http://nobles-iq.com/WebPanel/login.php) Intel::URL cybercrime-url - T - -

but i am facing one problem in intel log seen.indicator is showing blank

“seen.indicator”:"" this place url need to came

is my format is wrong ? i am using mal-dns2bro.sh script for formatting

Regards,  
Sunu

---

<div class="post-metadata">

**Author:** ![Azoff\_Justin\_S](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@Azoff\_Justin\_S](https://community.zeek.org/u/Azoff_Justin_S)\
**Post date:** [June 15, 2018, 4:39pm UTC](https://community.zeek.org/t/bro-intel-intel-url-date-file-format-check/5355/2 "2018-06-15T16:39:11Z")

</div>

What does your full intel.log line look like? I'm not sure how indicator could be blank, as that's what triggers the log event in the first place.

---

<div class="post-metadata">

**Author:** ![ps\_sunu](https://avatars.discourse-cdn.com/v4/letter/p/9d8465/32.png) [@ps\_sunu](https://community.zeek.org/u/ps_sunu)\
**Post date:** [June 15, 2018, 4:51pm UTC](https://community.zeek.org/t/bro-intel-intel-url-date-file-format-check/5355/3 "2018-06-15T16:51:47Z")

</div>

{“ts”:1529049750.133943,“uid”:“CHZHCR1m2zAzOqJer7”,“id.orig\_h”:“10.10.49.11”,“id.orig\_p”:5345,“id.resp\_h”:“149.96.16.51”,“id.resp\_p”:25,“seen.indicator”:"",“seen.indicator\_type”:“Intel::URL”,“seen.where”:“SMTP::IN\_MESSAGE”,“seen.node”:“worker-1-4”,“matched”:[“Intel::URL”],“sources”:[“cybercrime-url”]}

---

<div class="post-metadata">

**Author:** ![ps\_sunu](https://avatars.discourse-cdn.com/v4/letter/p/9d8465/32.png) [@ps\_sunu](https://community.zeek.org/u/ps_sunu)\
**Post date:** [June 15, 2018, 4:59pm UTC](https://community.zeek.org/t/bro-intel-intel-url-date-file-format-check/5355/4 "2018-06-15T16:59:35Z")

</div>

we are creating from

wget -N [http://cybercrime-tracker.net/all.php](http://cybercrime-tracker.net/all.php)

./mal-dns2bro.sh -T url -f all.php -s cybercrime-url -n true \> cybercrime\_url.intel

---

<div class="post-metadata">

**Author:** ![Azoff\_Justin\_S](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@Azoff\_Justin\_S](https://community.zeek.org/u/Azoff_Justin_S)\
**Post date:** [June 15, 2018, 5:42pm UTC](https://community.zeek.org/t/bro-intel-intel-url-date-file-format-check/5355/5 "2018-06-15T17:42:35Z")

</div>

I think I figured out what is happening here. Are any of the indicators in your .intel file blank?

find\_urls and find\_all\_urls\_without\_scheme consider http:// or even xxx:// a link, and find\_all\_urls\_without\_scheme turns that into just "":

event bro\_init()  
{  
&nbsp;&nbsp;&nbsp;&nbsp;local s = "hello xxx://";  
&nbsp;&nbsp;&nbsp;&nbsp;local urls = find\_all\_urls\_without\_scheme(s);  
&nbsp;&nbsp;&nbsp;&nbsp;for ( url in urls ) {  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;print fmt("Got [%s]", url);  
&nbsp;&nbsp;&nbsp;&nbsp;}  
}

outputs:

Got []

so if your .intel file has any empty urls and bro sees a link like http://, i'll do what you are seeing.

---

<div class="post-metadata">

**Author:** ![ps\_sunu](https://avatars.discourse-cdn.com/v4/letter/p/9d8465/32.png) [@ps\_sunu](https://community.zeek.org/u/ps_sunu)\
**Post date:** [June 18, 2018, 7:28am UTC](https://community.zeek.org/t/bro-intel-intel-url-date-file-format-check/5355/6 "2018-06-18T07:28:35Z")

</div>

thanks justin , for helping , the intel file have one blank space intel

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:45pm UTC](https://community.zeek.org/t/bro-intel-intel-url-date-file-format-check/5355/7 "2022-05-06T15:45:52Z")

</div>