Removing intel while Bro is running

It seems that while it’s possible to add to the intel list in memory while Bro is running, it’s not possible to remove.

That is, if I remove something from the intel file because it’s generating too many false positives, I have to restart Bro in order for it to take effect.

Is there anything I can do to fix this? I’d rather not restart Bro and lose connection states.

There will be code going into Bro before too long, but for now you can run what I wrote as an extension...

You can see how to work with it in the testing/ directory. Look into how the whitelisting happens. It gives you the ability to stop monitoring for intel items by actually adding new “whitelisted” intel items.