[Bro] A little more confusion with Intel

[Jan Grashöfer]

On 18/01/18 19:15, James Lay wrote:
> Ah....Ok thanks again Justin.  Seth should I put in a feature request
> for both TLD and UDP for the Intel framework?  Thanks.

That's probably something that can be addressed with a package. In 
general you can have a look at 
https://github.com/bro/bro/tree/master/scripts/policy/frameworks/intel/seen 
to get an idea of how the intel framework gathers its information.

Jan