Add new bot: bro output file

[mariuskarotkis]

Add new bot: bro output file

[ghost]

What is bro? Are the fields fixed in bro, or is this user-/implementation-specific?

[mariuskarotkis]

What is bro? Are the fields fixed in bro, or is this user-/implementation-specific?

Bro intel (zeek) for IDS.

[ghost]

https://zeek.org/2019/09/23/zeek-3-0-0/ indicates that bro has been renamed to zeek. is this output bot only compatible to bro or to zeek as well? Is there any format specification available? Are the fields fixed in bro, or is this user-/implementation-specific?

[mariuskarotkis]

https://zeek.org/2019/09/23/zeek-3-0-0/ indicates that bro has been renamed to zeek. is this output bot only compatible to bro or to zeek as well? Is there any format specification available? Are the fields fixed in bro, or is this user-/implementation-specific?

This was made bro intel, but the format I think should fit and zeek (needs testing).

[codecov-commenter]

Codecov Report

Merging #1963 (a86ca53) into develop (0750a3d) will increase coverage by 0.16%.
The diff coverage is 66.66%.

@@             Coverage Diff             @@
##           develop    #1963      +/-   ##
===========================================
+ Coverage    75.74%   75.91%   +0.16%     
===========================================
  Files          414      438      +24     
  Lines        22169    23505    +1336     
  Branches      2944     3143     +199     
===========================================
+ Hits         16793    17843    +1050     
- Misses        4697     4932     +235     
- Partials       679      730      +51     

Impacted Files	Coverage Δ
intelmq/bots/outputs/bro_file/output.py	56.60% <56.60%> (ø)
intelmq/tests/bots/outputs/bro_file/test_output.py	100.00% <100.00%> (ø)
intelmq/tests/bots/experts/wait/test_expert.py	50.00% <0.00%> (-50.00%)	⬇️
intelmq/bots/experts/wait/expert.py	48.57% <0.00%> (-31.43%)	⬇️
intelmq/bin/intelmqctl.py	9.32% <0.00%> (-3.56%)	⬇️
intelmq/bots/parsers/cert_eu/parser_csv.py	78.84% <0.00%> (-2.79%)	⬇️
intelmq/bots/parsers/misp/parser.py	85.45% <0.00%> (-2.79%)	⬇️
intelmq/lib/cache.py	42.42% <0.00%> (-2.74%)	⬇️
intelmq/bots/experts/tor_nodes/expert.py	46.42% <0.00%> (-2.33%)	⬇️
intelmq/bots/experts/domain_suffix/expert.py	42.69% <0.00%> (-2.01%)	⬇️
... and 429 more

[ghost]

Just a minor comment on how default values are set, otherwise ready for merge!

[ghost]

Thank you also for this nice addition! Apologies for the delays again - we very much value your contributions and your commitment!