using intel framework for scripts

Zeek
1

How does one leverage this framework to write scripts?

2

Hey John,

Start with the video:
Video

Then review these exercises:
http://bro.org/bro-exchange-2013/exercises/intel.html

These are both from the Bro Exchange 2013.

Thanks,

Liam Randall

3

It depends on what you want to do. The docs we have for it show you how to use it (to get an intel.log file). Is that all you're interested in? Loading data and finding things that hit?

http://www.bro.org/sphinx/frameworks/intel.html

  .Seth

4

Thank you!

5

Does the framework take care of updating the system on the fly if the input files change, or is a restart needed?

-matt

6

It updates on the fly. If you are running a cluster you only need to update the data on the manager too. It will auto distribute.

  .Seth