intelmq
intelmq copied to clipboard
Aggregating Output Formatter bot
For some use cases a "grouping" feature is needed, but the output is (or can be) specific to an output format. For example, a CSV formatting bot. It could collect (up to) N events and format them as CSV as configured, written to the already existing "output" field. This allows sending data in bulk.
A simple selection criterion could be size (maximum number of events or maximum size in bytes) or time ((at least) every x minutes), but also data-based. However, I would exclude the latter for a first version.