[Bro] Intel framework not working as expected

James Lay jlay at slave-tothe-box.net
Wed Jan 17 12:31:29 PST 2018


Thanks Fatema...that was it..had to do the install as well :) 

James 

On 2018-01-17 13:17, fatema bannatwala wrote:

> Not sure if the new changes are loaded when doing broctl stop and start, might want to try broctl install as well before doing broctl start? 
> 
> On Wed, Jan 17, 2018 at 3:12 PM, James Lay <jlay at slave-tothe-box.net> wrote:
> 
> I did do a broctl stop and start thank you...and I was thinking an entry should show up in intel, but it does not. 
> 
> James
> 
> On 2018-01-17 13:10, fatema bannatwala wrote: 
> Just a trivial question: 
> Did you restart Bro after adding your new intel file entry in local.bro? 
> If a DNS record is getting logged for the domain in your intel file, then I would think an entry should be created in intel.log. 
> 
> Fatema.

  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20180117/cc8919b9/attachment.html 


More information about the Bro mailing list