Manager memory requirements for the intel framework

Zeek
1

Thanks, Drew,

Agreed that it would be best to upgrade, and we moved on to Bro 2.5.3 a couple releases ago. No, misc/scan is not loaded. Unfortunately, I don’t have the production intel input file. I’m told it’s about 100K indicators of about 50% domain, 25% addr, and 25% hash, plus a few email and url indicators less than 1%. We started testing with a file of 18K domain indicators, but will be expanding to a more realistic profile next. Maybe I started this thread a little early, without the representative input file, but I wanted to query the community for any ideas or suggestions about our initial results. Thank you for your ideas!

Brian

2

Thanks, Drew,

Agreed that it would be best to upgrade, and we moved on to Bro 2.5.3 a couple releases ago. No, misc/scan is not loaded. Unfortunately, I don’t have the production intel input file. I’m told it’s about 100K indicators of about 50% domain, 25% addr, and 25% hash, plus a few email and url indicators less than 1%. We started testing with a file of 18K domain indicators, but will be expanding to a more realistic profile next. Maybe I started this thread a little early, without the representative input file, but I wanted to query the community for any ideas or suggestions about our initial results. Thank you for your ideas!

Brian