[Bro] Intelligence framework and bro logs

Jan Grashöfer jan.grashoefer at gmail.com
Thu Dec 1 02:24:01 PST 2016

Hi N,

> -I am updating the IOCs regularly and the only way I found to reload IOCs
> in bro is to restart the service with broctl, is there any better way?
> (like just reloading the configuration and not restarting everything)

using Bro 2.5 you can use the new expiration feature of the intel
framework. There might be a blog post explaining the details. I will
check that.

Best regards

More information about the Bro mailing list