Hi, I am trying to use Bro’s intel framework and can’t seem to get it to generate anything in the intel or notice logs. I’m on version 2.5.5 in cluster mode. Everything else seems to work fine. I see all the logs, and notices are working for other event types. I have checked to make sure the dat fi…

The most important thing is the format of that ".dat" file. If you do not have tabs entered correctly, the files may not be loaded. Check your "reporter.log" to see if there are any errors with the input of your intel file. Example error: 0.000000 Reporter::WARNING /nsm/intel/custom.int…

And I misread you already did check reporter. Sorry for the noise. I would get a pcap and test this offline with the intel framework to make sure everything is working as it should.

Thanks for the reply. I am not seeing any errors show up in the reporter.log or the stderr.log. I verified the tabs are there. I was wondering if I could get it to generate an error, so I intentionally misspelled the name of the dat file in the script, but it did not generate an error. Now I wonder…

I took a pcap file and ran it standalone against the file. This time it complained that the requested field meta.source was missing. I don’t know why that was not showing up in the reporter or stderr logs. I added the field, and now there are no errors, but still no intel.log.

I have tried several things in offline mode. I am searching for “Firefox” in “Intel::IN_ANYWHERE”, and still no intel hits, even though “firefox” clealry shows up in the http.log in the user agent field.

The HTTP::IN_USER_AGENT_HEADER needs to be an exact match, so unless you used a user agent of just “Mozilla” you would never get a hit.

Update: I copied the script and dat file to another box and they seem to work fine.02 I’m not sure why it is not working on the first box.02 It is not logging any errors, and other things seem to work.02 I will try recompiling and reinstalling. The other problem is that I was not aware that …

Help with intel framework

Zeek

Topic		Replies	Views
Intel Framework Usage Zeek	2	100	May 6, 2022
Issues with intel framework Zeek	6	202	May 6, 2022
Help with intel framework Zeek	3	129	May 6, 2022
two issues with the intel framework Zeek	6	181	May 6, 2022
Intel framework troubleshooting on Bro 2.5 Zeek	6	114	May 6, 2022

Help with intel framework

Related topics