bro/bro — pull request #6 by jshlbrd (2014-04-15 13:18:38+00:00)
Title: Intel::ADDR indicators in http host field

After reviewing the http logs for our Bro deployment, I noticed many instances where the host field contains an IP address. We track a lot of IP addresses as intel indicators and have seen them appear as domains in past incidents... this change does an IP check on the host field value and, if it passes, looks for the value in Intel::ADDR.