modIntel.py
modIntel.py

        Update the modIntel.conf file to point to your Bro and OSSEC intel files.

        The modIntel.conf file must reside in the same directory or modify this script with the location you placed it in.

        Header of the intel file must be:
        #fields\tindicator\tindicator_type\tmeta.source\tmeta.desc\tmeta.url\tmeta.do_notice\tmeta.if_in
        Remember Bro intel files MUST be tab delimited!!!

        Any Bro intel file must be loaded into Bro to be used.
        Example, add below to /opt/bro/share/bro/site/local.bro in order to load the your intel1.txt custom file:
                redef Intel::read_files += {
                        "/opt/bro/share/bro/policy/intel1.txt",
                };

        Bro adds new intel but does not remove without a restart:
                sudo broctl install
                sudo broctl restart
                or sudo nsme_sensor_ps-restart --only-bro

        The script will also run the ossec-makelists command to compile any updated CDB files.

        The script, before performing any other action on intel files, will backup all intel files to the specified location in modIntel.conf.
        The script will also parse all intel files for duplicates upon startup.
        The script does its best to honor OSSEC's ability to specify IPs at the octet boundaries but only for /24s.  Logic is not included for /8s or /16s.
theflakes/security-onion-intel-scripts