# Help with intel framework **URL:** \ **Category:** Zeek\ **Created:** [November 16, 2018, 5:23pm UTC](https://community.zeek.org/t/help-with-intel-framework/5531 "2018-11-16T17:23:05Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![lshiry](https://avatars.discourse-cdn.com/v4/letter/l/d26b3c/32.png) [@lshiry](https://community.zeek.org/u/lshiry)\ **Post date:** [November 16, 2018, 5:23pm UTC](https://community.zeek.org/t/help-with-intel-framework/5531/1 "2018-11-16T17:23:05Z")
Hi, I am trying to use Bro’s intel framework and can’t seem to get it to generate anything in the intel or notice logs. I’m on version 2.5.5 in cluster mode. Everything else seems to work fine. I see all the logs, and notices are working for other event types. I have checked to make sure the dat file has only tabs in it to separate fields. I don’t see anything coming up in the stderr or reporter log files. I must be missing something. Any help is appreciated. Here is what I have added to local.bro: ---
**Author:** ![Michael\_Shirk](https://avatars.discourse-cdn.com/v4/letter/m/aeb1de/32.png) [@Michael\_Shirk](https://community.zeek.org/u/Michael_Shirk)\ **Post date:** [November 16, 2018, 5:44pm UTC](https://community.zeek.org/t/help-with-intel-framework/5531/2 "2018-11-16T17:44:55Z")
The most important thing is the format of that ".dat" file. If you do not have tabs entered correctly, the files may not be loaded. Check your "reporter.log" to see if there are any errors with the input of your intel file. Example error: 0.000000 Reporter::WARNING /nsm/intel/custom.intel/Input::READER\_ASCII: Field: meta.do\_notice Invalid value for boolean: meta.do\_notice (empty) ---
**Author:** ![Michael\_Shirk](https://avatars.discourse-cdn.com/v4/letter/m/aeb1de/32.png) [@Michael\_Shirk](https://community.zeek.org/u/Michael_Shirk)\ **Post date:** [November 16, 2018, 5:47pm UTC](https://community.zeek.org/t/help-with-intel-framework/5531/3 "2018-11-16T17:47:32Z")
And I misread you already did check reporter. Sorry for the noise. I would get a pcap and test this offline with the intel framework to make sure everything is working as it should. ---
**Author:** ![lshiry](https://avatars.discourse-cdn.com/v4/letter/l/d26b3c/32.png) [@lshiry](https://community.zeek.org/u/lshiry)\ **Post date:** [November 16, 2018, 5:51pm UTC](https://community.zeek.org/t/help-with-intel-framework/5531/4 "2018-11-16T17:51:10Z")
Thanks for the reply. I am not seeing any errors show up in the reporter.log or the stderr.log. I verified the tabs are there. I was wondering if I could get it to generate an error, so I intentionally misspelled the name of the dat file in the script, but it did not generate an error. Now I wonder if something else is preventing it from getting that far. ---
**Author:** ![lshiry](https://avatars.discourse-cdn.com/v4/letter/l/d26b3c/32.png) [@lshiry](https://community.zeek.org/u/lshiry)\ **Post date:** [November 16, 2018, 6:28pm UTC](https://community.zeek.org/t/help-with-intel-framework/5531/5 "2018-11-16T18:28:31Z")
I took a pcap file and ran it standalone against the file. This time it complained that the requested field meta.source was missing. I don’t know why that was not showing up in the reporter or stderr logs. I added the field, and now there are no errors, but still no intel.log. ---
**Author:** ![lshiry](https://avatars.discourse-cdn.com/v4/letter/l/d26b3c/32.png) [@lshiry](https://community.zeek.org/u/lshiry)\ **Post date:** [November 16, 2018, 7:44pm UTC](https://community.zeek.org/t/help-with-intel-framework/5531/6 "2018-11-16T19:44:33Z")
I have tried several things in offline mode. I am searching for “Firefox” in “Intel::IN\_ANYWHERE”, and still no intel hits, even though “firefox” clealry shows up in the http.log in the user agent field. ---
**Author:** ![Azoff\_Justin\_S](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@Azoff\_Justin\_S](https://community.zeek.org/u/Azoff_Justin_S)\ **Post date:** [November 16, 2018, 9:43pm UTC](https://community.zeek.org/t/help-with-intel-framework/5531/7 "2018-11-16T21:43:57Z")
The HTTP::IN\_USER\_AGENT\_HEADER needs to be an exact match, so unless you used a user agent of just “Mozilla” you would never get a hit. ---
**Author:** ![lshiry](https://avatars.discourse-cdn.com/v4/letter/l/d26b3c/32.png) [@lshiry](https://community.zeek.org/u/lshiry)\ **Post date:** [November 19, 2018, 6:18pm UTC](https://community.zeek.org/t/help-with-intel-framework/5531/8 "2018-11-19T18:18:56Z")
Update: I copied the script and dat file to another box and they seem to work fine.0„2 I’m not sure why it is not working on the first box.0„2 It is not logging any errors, and other things seem to work.0„2 I will try recompiling and reinstalling. The other problem is that I was not aware that the intel match had to be an exact match.0„2 Does anyone know if it is possible to use a wildcard or do a substring search with the intel match?0„2 I tried “\*” as a wildcard, that does not work. Thanks for all the help! ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:46pm UTC](https://community.zeek.org/t/help-with-intel-framework/5531/9 "2022-05-06T15:46:12Z")