# intel.log extra log

**URL:** <https://community.zeek.org/t/intel-log-extra-log/4775>\
**Category:** Zeek\
**Created:** [April 13, 2017, 5:49am UTC](https://community.zeek.org/t/intel-log-extra-log/4775 "2017-04-13T05:49:52Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ps\_sunu](https://avatars.discourse-cdn.com/v4/letter/p/9d8465/32.png) [@ps\_sunu](https://community.zeek.org/u/ps_sunu)\
**Post date:** [April 13, 2017, 5:49am UTC](https://community.zeek.org/t/intel-log-extra-log/4775/1 "2017-04-13T05:49:52Z")

</div>

Hi,

i need to generate intel log content into separate logs , i generated except one field  
i am not able to get “source” field into separate log, any idea tp do this

my main file

@load frameworks/intel/seen

redef Intel::read\_files += {  
fmt(“%s/intel-1.dat”, @DIR)  
};

@load ./field.bro  
#redef LogAscii::use\_json=T;

event Intel::log\_intel (rec: Intel::Info)

{

# Log::create\_stream(Factor::LOG, [$columns=Factor::Info, $path=“intel\_trigger”]);

if ( rec$seen$where == HTTP::IN\_HOST\_HEADER )  
{

# print “ssss”,rec$seen;

Log::write(Match::LOG,[$ts=network\_time(),$uid=rec$seen$uid,$id=rec$seen$conn$id,$seen\_indicator=rec$seen$indicator,$seen\_indicator\_type=rec$seen$indicator\_type,$seen\_where=rec$seen$where,$seen\_node=rec$seen$node,$matched=rec$seen$indicator\_type]);  
print “ssssssss”,rec$seen;

}  
}  
event bro\_init ()

{  
Log::create\_stream(Match::LOG, [$columns=Match::Info, $path=“intel\_tech”]);

}

field.bro

module Match;

export {

# Append the value LOG to the Log::ID enumerable.

redef enum Log::ID += { LOG };

type Type: enum {

## An IP address.

ADDR,

## A complete URL without the prefix `"http://"`.

URL,

## Software name.

SOFTWARE,

## Email address.

EMAIL,

## DNS domain name.

DOMAIN,

## A user name.

USER\_NAME,

## File hash which is non-hash type specific. It’s up to the

## user to query for any relevant hash types.

FILE\_HASH,

## File name. Typically with protocols with definite

## indications of a file name.

FILE\_NAME,

## Certificate SHA-1 hash.

CERT\_HASH,

## Public key MD5 hash. (SSH server host keys are a good example.)

PUBKEY\_HASH,  
};

type Where: enum {

## A catchall value to represent data of unknown provenance.

IN\_ANYWHERE,  
};

# Define a new type called Factor::Info.

type Info: record {  
ts: time &log;  
uid : string &log;  
id: conn\_id &log;  
seen\_indicator: string &log;  
seen\_indicator\_type: Type &log &optional;  
seen\_where : Where &log;  
seen\_node : string &log;  
matched:Type &log &optional;

};  
}

i need intel-1.dat file

[www.reddit.com](http://www.reddit.com) Intel::DOMAIN **my\_special\_source --\>\> into source field**

**[http://try.bro.org/#/trybro/saved/138000](http://try.bro.org/#/trybro/saved/138000)**

---

<div class="post-metadata">

**Author:** ![ps\_sunu](https://avatars.discourse-cdn.com/v4/letter/p/9d8465/32.png) [@ps\_sunu](https://community.zeek.org/u/ps_sunu)\
**Post date:** [April 13, 2017, 6:55am UTC](https://community.zeek.org/t/intel-log-extra-log/4775/2 "2017-04-13T06:55:11Z")

</div>

i solved the problem

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:44pm UTC](https://community.zeek.org/t/intel-log-extra-log/4775/3 "2022-05-06T15:44:49Z")

</div>