# using intel framework for scripts **URL:** https://community.zeek.org/t/using-intel-framework-for-scripts/2908 **Category:** Zeek **Created:** [November 21, 2013, 2:22pm UTC](https://community.zeek.org/t/using-intel-framework-for-scripts/2908 "2013-11-21T14:22:15Z") **Posts on this page:** 7 **Page:** 1
### Author: ![John\_Babio1](https://avatars.discourse-cdn.com/v4/letter/j/da6949/32.png) [@John\_Babio1](https://community.zeek.org/u/John_Babio1) #### Post date: [November 21, 2013, 2:22pm UTC](https://community.zeek.org/t/using-intel-framework-for-scripts/2908/1 "2013-11-21T14:22:15Z")
How does one leverage this framework to write scripts? ---
### Author: ![Liam\_Randall2](https://avatars.discourse-cdn.com/v4/letter/l/a87d85/32.png) [@Liam\_Randall2](https://community.zeek.org/u/Liam_Randall2) #### Post date: [November 21, 2013, 2:29pm UTC](https://community.zeek.org/t/using-intel-framework-for-scripts/2908/2 "2013-11-21T14:29:05Z")
Hey John, Start with the video: [Video](http://youtu.be/E7SwURCdi8g) Then review these exercises: [http://bro.org/bro-exchange-2013/exercises/intel.html](http://bro.org/bro-exchange-2013/exercises/intel.html) These are both from the Bro Exchange 2013. Thanks, Liam Randall ---
### Author: ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3) #### Post date: [November 21, 2013, 2:30pm UTC](https://community.zeek.org/t/using-intel-framework-for-scripts/2908/3 "2013-11-21T14:30:46Z")
It depends on what you want to do. The docs we have for it show you how to use it (to get an intel.log file). Is that all you're interested in? Loading data and finding things that hit? [http://www.bro.org/sphinx/frameworks/intel.html](http://www.bro.org/sphinx/frameworks/intel.html)   .Seth ---
### Author: ![John\_Babio1](https://avatars.discourse-cdn.com/v4/letter/j/da6949/32.png) [@John\_Babio1](https://community.zeek.org/u/John_Babio1) #### Post date: [November 21, 2013, 2:48pm UTC](https://community.zeek.org/t/using-intel-framework-for-scripts/2908/4 "2013-11-21T14:48:10Z")
Thank you! ---
### Author: ![Matt\_Stucky](https://avatars.discourse-cdn.com/v4/letter/m/ee7513/32.png) [@Matt\_Stucky](https://community.zeek.org/u/Matt_Stucky) #### Post date: [November 21, 2013, 4:17pm UTC](https://community.zeek.org/t/using-intel-framework-for-scripts/2908/5 "2013-11-21T16:17:06Z")
Does the framework take care of updating the system on the fly if the input files change, or is a restart needed? -matt ---
### Author: ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3) #### Post date: [November 21, 2013, 5:02pm UTC](https://community.zeek.org/t/using-intel-framework-for-scripts/2908/6 "2013-11-21T17:02:41Z")
It updates on the fly. If you are running a cluster you only need to update the data on the manager too. It will auto distribute.   .Seth ---
### Author: ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system) #### Post date: [May 6, 2022, 3:41pm UTC](https://community.zeek.org/t/using-intel-framework-for-scripts/2908/7 "2022-05-06T15:41:24Z")