Intel Framework Question

I’ve just started playing with the intel framework and have a question for everyone. How are people automating the conversion of their intel data (threat feeds, etc.) into the format the BRO intel files require.

Are their any solutions out there to automate this?


Python is nice. I think Jon Schipp has a script or two that assists in converting indicators too.


$ wget

Also, CIF has an Bro output plugin. The following article on the Bro
Blog covers using both of the aforementioned tools