[Bro] Intel framework troubleshooting on Bro 2.5

Jan Grashöfer jan.grashoefer at gmail.com
Fri Oct 7 11:04:33 PDT 2016

> Nothing stands out.  Looking at base/frameworks/intel/input.bro is there a
> way to hook Input::add_event and have those events written to a log file ?

You could use the Intel::read_entry event. For validation of the files
have a look at https://github.com/packetsled/bro_intel_linter.

Can you reproduce the issue running a standalone deployment or against a
pcap and is that issue new in Bro 2.5?


More information about the Bro mailing list