Pull JSON data from elasticinsight to update Bro intel indicators file. Uses "jq" from http://stedolan.github.io/jq

update_bro_intel.sh

#!/bin/bash

INTELFILE=$1
DOC=$(curl -# http://elasticinsight-test/ElasticAPI/BroIntelFrameworkIndicatorList 2> /dev/null)
RECS=$(echo $DOC | jq '. | length')
j=0

HEADER=$(grep -E "^#" $INTELFILE)

echo "$HEADER" > $INTELFILE

#fields  indicator 	indicator_type 	meta.source 	meta.desc 	meta.url 	meta.do_notice 	meta.if_in

while [ $j -lt $RECS ]; do
   indicator=$(echo $DOC | jq ".[$j] | .Indicator" | sed 's/\"//g')
   indicator_type=$(echo $DOC | jq ".[$j] | .IndicatorType" | sed 's/\"//g')
   meta_source=$(echo $DOC | jq ".[$j] | .MetaData_Source" | sed 's/\"//g')
   meta_desc=$(echo $DOC | jq ".[$j] | .MetaData_Description" | sed 's/\"//g')
   meta_url=$(echo $DOC | jq ".[$j] | .MetaData_URL" | sed 's/\"//g')
   meta_do_notice=$(echo $DOC | jq ".[$j] | .MetaData_DoNotice" | sed 's/\"//g')
   meta_if_in=$(echo $DOC | jq ".[$j] | .MetaData_IfIn" | sed 's/\"//g')

   echo "$indicator"$'\t'"$indicator_type"$'\t'"$meta_source"$'\t'"$meta_desc"$'\t'"$meta_url"$'\t'"$meta_do_notice"$'\t'"$meta_if_in" >> $INTELFILE
   j=$(( j + 1 ))
done

exit