I am running Bro 2.2 on Security Onion
Hi Jamie,
Take a look at loaded_scripts.log and verify that the intel framework
and your intel feed show up there.
The Bro intel scripts show up in the log, but am I supposed to be seeing my test.txt feed?
No, it's not supposed to show test.txt in loaded_scripts.log.
I duplicated your scenario and everything worked properly for me.
Is it possible you have a local.bro in your current directory (~/tmp)
that is overriding /opt/bro/share/bro/site/local.bro?
Have you tried something like this?
bro -r test.pcap /opt/bro/share/bro/site/local.bro