[Bro] Intel framework not working as expected
jlay at slave-tothe-box.net
Wed Jan 17 12:31:29 PST 2018
Thanks Fatema...that was it..had to do the install as well :)
On 2018-01-17 13:17, fatema bannatwala wrote:
> Not sure if the new changes are loaded when doing broctl stop and start, might want to try broctl install as well before doing broctl start?
> On Wed, Jan 17, 2018 at 3:12 PM, James Lay <jlay at slave-tothe-box.net> wrote:
> I did do a broctl stop and start thank you...and I was thinking an entry should show up in intel, but it does not.
> On 2018-01-17 13:10, fatema bannatwala wrote:
> Just a trivial question:
> Did you restart Bro after adding your new intel file entry in local.bro?
> If a DNS record is getting logged for the domain in your intel file, then I would think an entry should be created in intel.log.
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Bro