Intel Framework Question

Zeek
1

I’ve just started playing with the intel framework and have a question for everyone. How are people automating the conversion of their intel data (threat feeds, etc.) into the format the BRO intel files require.

Are their any solutions out there to automate this?

Thanks
Damon

2

Python is nice. I think Jon Schipp has a script or two that assists in converting indicators too.

-AK

3

$ wget https://raw.githubusercontent.com/jonschipp/mal-dnssearch/master/tools/mal-dns2bro.sh
:slight_smile:

4

Also, CIF has an Bro output plugin. The following article on the Bro
Blog covers using both of the aforementioned tools
http://blog.bro.org/2014/01/intelligence-data-and-bro_4980.html