Unable to generate intel.log

Zeek
2

Hi,

there are a couple of possible cases for this to happen. The first one is that, when processing pcaps, there always is a bit of a race condition between the input framework and the pcap processing. Both happen simultaneously - and pcap processing (for small pcaps) often is faster.

You can load a short script that suspends processing till after the intelligence file is loaded, e.g. like this:

event zeek_init()
        {
        suspend_processing();
        }

event Input::end_of_data(name: string, source: string)
        {
        if ( /^intel-/ in name )
                continue_processing();
        }

The second possibility is that only a quic connection is established (via udp). UDP connections don’t automatically trigger the intelligence framework.