[Bro] Intel framework troubleshooting on Bro 2.5

Jan Grashöfer jan.grashoefer at gmail.com
Fri Oct 7 14:51:14 PDT 2016


> If the linter is working as expected then it appears the problem is with a
> few URIs from PhishTank with odd URL encoding, maybe they are mistakenly
> being interpreted as tabs during parsing or corrupting some internal state
> within Bro.

Theoretically malformed items should not affect previously loaded intel
files. If you can reproduce this issue and provide something like a
minimal example it would be good to open a ticket.

Jan


More information about the Bro mailing list