intelmq
intelmq copied to clipboard
Modify bot: support multiple config files
We currently have two config files which do overlap each other. In the future
- the number of rules will increase (e.g. with a more complete malware name-family mapping) and consequently
- not all rules are useful for all users.
So I think we need to split these configuration parts into more files.
My idea is that the bot itself could resolve globs in the filename (e.g. /var/lib/intelmq/bots/modify/*.conf) and read them all.
I noticed this just after logging it, but #1026 is another proposal addressing the same issue.
current example is smaller now because of the malware name mapping