[Bro] Intel framework troubleshooting on Bro 2.5

[Jan Grashöfer]

> Nothing stands out.  Looking at base/frameworks/intel/input.bro is there a
> way to hook Input::add_event and have those events written to a log file ?

You could use the Intel::read_entry event. For validation of the files
have a look at https://github.com/packetsled/bro_intel_linter.

Can you reproduce the issue running a standalone deployment or against a
pcap and is that issue new in Bro 2.5?

Jan