intelmq icon indicating copy to clipboard operation
intelmq copied to clipboard

Field Reducer: Support to remove sub-fields in extra

Open sebix opened this issue 11 months ago • 0 comments

(non-urgent) feature idea by an IntelMQ user:

If the event contains, for example

{
"extra.source.naics: 1,
"extra.source.sic: 2
}

setting

type: blacklist
keys: extra.source

does not delete the two fields.

sebix avatar Jan 27 '25 16:01 sebix