Intel alerts not showing up in the notice log

Zeek
1

Good afternoon,

Was there a resolution to this thread? I’m having the same issue on a default build and I’m not sure where to start.

http://mailman.icsi.berkeley.edu/pipermail/bro/2014-May/006940.html

Thanks,

2

I haven’t read the whole thread, but you may need:

@load policy/frameworks/intel/do_notice

As well as have “meta.do_notice” set to T in your .dat files.

-Dop