# Removing IP from Intel Framework? **URL:** \ **Category:** Zeek\ **Created:** [September 15, 2014, 1:22pm UTC](https://community.zeek.org/t/removing-ip-from-intel-framework/3269 "2014-09-15T13:22:13Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Aaron\_Gee-Clough](https://avatars.discourse-cdn.com/v4/letter/a/a3d4f5/32.png) [@Aaron\_Gee-Clough](https://community.zeek.org/u/Aaron_Gee-Clough)\ **Post date:** [September 15, 2014, 1:22pm UTC](https://community.zeek.org/t/removing-ip-from-intel-framework/3269/1 "2014-09-15T13:22:13Z")
All, I'm working with the intel framework and enjoying it, but have hit a bit of a problem: I can successfully add new IPs to watchlists in the framework, but I can't remove them without restarting bro. I'd like to be able to do this to handle false-positives, for example. The fact that new watchlist entries are flagged says to me that I'm doing the "create the file then move it into place" bit properly...I don't know what's up with removing entries, though. I'm running bro 2.3 (the 06/16/14 release), and am invoking the intel framework like this: @load frameworks/intel/seen @load frameworks/intel/do\_notice redef Intel::read\_files += {   "/opt/bro/etc/internalList.dat", }; internalList.dat looks like: #fields indicator indicator\_type meta.source meta.url meta.do\_notice meta.if\_in targetDomain.blah Intel::DOMAIN internal\_monitoring [https://internalsite/campaign?arg1=text&arg2=some%20more%20text](https://internalsite/campaign?arg1=text&arg2=some%20more%20text) T - Any ideas? Thanks. Aaron ---
**Author:** ![Mike\_Reeves](https://avatars.discourse-cdn.com/v4/letter/m/22d042/32.png) [@Mike\_Reeves](https://community.zeek.org/u/Mike_Reeves)\ **Post date:** [September 15, 2014, 2:00pm UTC](https://community.zeek.org/t/removing-ip-from-intel-framework/3269/2 "2014-09-15T14:00:29Z")
Unfortunately there is no way to remove them without restarting. ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [September 15, 2014, 5:13pm UTC](https://community.zeek.org/t/removing-ip-from-intel-framework/3269/3 "2014-09-15T17:13:12Z")
I'm hoping that I can get a repository up on github today/tonight that makes your statement incorrect. 🙂   .Seth ---
**Author:** ![Tom\_OBrion](https://avatars.discourse-cdn.com/v4/letter/t/d07c76/32.png) [@Tom\_OBrion](https://community.zeek.org/u/Tom_OBrion)\ **Post date:** [September 15, 2014, 5:55pm UTC](https://community.zeek.org/t/removing-ip-from-intel-framework/3269/4 "2014-09-15T17:55:27Z")
Thats awesome Seth! Thanks Tom "Life is too short to spend time with people who suck the happy out of you." ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [September 15, 2014, 8:53pm UTC](https://community.zeek.org/t/removing-ip-from-intel-framework/3269/5 "2014-09-15T20:53:31Z")
[https://github.com/sethhall/intel-ext](https://github.com/sethhall/intel-ext) This repository adds two features.   - You can extend your intel log (now named intel\_ext.log).   - You can whitelist items. These features will likely be integrated into Bro at a future date. I'm trying to use this ext repository as a way to vet features for the intel framework before integrating them right into the main distribution. If you want to start whitelisting intel items at runtime, you should create a new intel file with an extra "meta.whitelist" field and set the field value to "T" (there is a test that shows this). As you add elements to this intel file, those items won't show up in your intel\_ext.log. The intel file will look something like this... #fields indicator indicator\_type meta.source meta.whitelist [bro.org](http://bro.org) Intel::DOMAIN my\_whitelist T You should probably maintain this as a separate file and make sure that you are giving the source as something distinct from where the data comes from originally (it's "my\_whitelist" in my example). Have fun! 🙂   .Seth ---
**Author:** ![Michal\_Purzynski1](https://avatars.discourse-cdn.com/v4/letter/m/a88e57/32.png) [@Michal\_Purzynski1](https://community.zeek.org/u/Michal_Purzynski1)\ **Post date:** [September 15, 2014, 9:05pm UTC](https://community.zeek.org/t/removing-ip-from-intel-framework/3269/6 "2014-09-15T21:05:53Z")
W00t, thanks a lot, testing ASAP. ---
**Author:** ![Josh\_Liburdi](https://avatars.discourse-cdn.com/v4/letter/j/df705f/32.png) [@Josh\_Liburdi](https://community.zeek.org/u/Josh_Liburdi)\ **Post date:** [September 15, 2014, 10:24pm UTC](https://community.zeek.org/t/removing-ip-from-intel-framework/3269/7 "2014-09-15T22:24:04Z")
Just to clarify a couple things ... Do in-line indicator changes require a restart? That is, if my intel file is deployed with indicator [blah.org](http://blah.org) and a whitelist value of F, then later I update that value to T, do I need to restart for that change to be picked up? IIRC you still would need to restart for the value change to be read. The whitelisting also wouldn't decrease any processing requirements of the Intel framework since the initial indicator match is still occurring, right? Josh ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [September 16, 2014, 2:13am UTC](https://community.zeek.org/t/removing-ip-from-intel-framework/3269/8 "2014-09-16T02:13:23Z")
> Do in-line indicator changes require a restart? That is, if my intel > file is deployed with indicator blah.org and a whitelist value of F, > then later I update that value to T, do I need to restart for that > change to be picked up? IIRC you still would need to restart for the > value change to be read. I wouldn't recommend setting a whitelist value in your normal intel datasets. I would maintain it as a separate file as I recommended in my previous email. > The whitelisting also wouldn't decrease any processing requirements of > the Intel framework since the initial indicator match is still > occurring, right? Having fewer items being matched really doesn't change your processing time overhead so there isn't really an optimization to be made there. It primarily just uses less memory at runtime but you wouldn't notice that either unless you have some sort of monstrous whitelist file. The only case where I could see it really helping would be if you are having a really huge number of hits, but I still suspect most people wouldn't notice.   .Seth ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:42pm UTC](https://community.zeek.org/t/removing-ip-from-intel-framework/3269/9 "2022-05-06T15:42:04Z")