Removing intel while Bro is running

Zeek
1

It seems that while it’s possible to add to the intel list in memory while Bro is running, it’s not possible to remove.

That is, if I remove something from the intel file because it’s generating too many false positives, I have to restart Bro in order for it to take effect.

Is there anything I can do to fix this? I’d rather not restart Bro and lose connection states.

2

There will be code going into Bro before too long, but for now you can run what I wrote as an extension...

https://github.com/sethhall/intel-ext

You can see how to work with it in the testing/ directory. Look into how the whitelisting happens. It gives you the ability to stop monitoring for intel items by actually adding new “whitelisted” intel items.

  .Seth