[Bro] bro exchange 2013 intel exercises

scott mcallester scott at 0x4c.com
Mon May 19 16:49:35 PDT 2014


Yep that was it, narrowed it down to an Emacs issue, If i hit the tab
key once there, it would add 2 tabs, not sure why though yet.

Thanks
Scott

On 20/05/14 00:41, Siwek, Jonathan Luke wrote:
> On May 19, 2014, at 12:39 AM, scott mcallester <scott at 0x4c.com> wrote:
>
>> My intel.dat:
>> #fields    indicator    indicator_type    meta.source
>> fetchback.com        Intel::DOMAIN    my_special_source
>>
>> I've double checked the tab spacing it all looks fine, but every time I run this I receive this error:
>> bro -C -r exercise-traffic.pcap intel.bro 
>> internal error: Value not found in enum mappimg. Module: GLOBAL, var: , var size: 0
>> Aborted (core dumped)
> Can you check that there’s only a single tab character between values?  In particular, if there is more than one tab between “fetchback.com” and “Intel::DOMAIN” I reproduce that error.
>
> - Jon




More information about the Bro mailing list