metron-streaming/Metron-Common/src/test/resources/config/sensors/bro.json

{
  "index": "bro",
  "batchSize": 5,
  "enrichmentFieldMap":
  {
    "geo": ["ip_dst_addr", "ip_src_addr"],
    "host": ["host"]
  },
  "threatIntelFieldMap":
  {
    "hbaseThreatIntel": ["ip_dst_addr", "ip_src_addr"]
  },
  "fieldToThreatIntelTypeMap":
  {
    "ip_dst_addr" : [ "malicious_ip" ]
    ,"ip_src_addr" : [ "malicious_ip" ]
  }
}