intelmq

intelmq copied to clipboard

Shadowserver Sandbox API Expert

1

For the Sanbox-URL feed you can get more data for the event by querying their API: https://www.shadowserver.org/wiki/pmwiki.php/Services/Sandbox-URL

ghost

currently the generic db lookup can only check for equality (`=`), but e.g. postgres supports other comparators too, e.g. the contains or equals operator `

ghost

Mail collectors do not have much logging output

2

In DEBUG they do not log very much what they are doing (connecting, searching, iterating etc).

ghost

The maxmind geoip download script should verify if the downloaded file is valid. See https://lists.cert.at/pipermail/intelmq-dev/2017-July/000215.html and previous ```python python3 -c "import maxminddb; maxminddb.open_database('GeoLite2-City.mmdb')" ```

ghost

Taxonomy bot: Handling wrong type/taxonomy

2

Current situation: If one or two of `classification.type` and `classification.taxonomy` are missing, it adds the other or both. If both exist, the bot does nothing. But there are for sure...

ghost

modify: check for non-existence with regex

1

Currently it is not possible to check both for non-existence and a value with just one rule, e.g.: ```json "if": { "classification.identifier": "^(|botnet)$" } ``` Events with a non-existent `classification.identifier`...

ghost

Instead of printing 'is_valid returned False.' if the validation failed, we could print an error message produced by the harmonization class itself. This would be much more helpful.

ghost

See the thread _Destination host in malware feeds_ on intelmq-dev: https://lists.cert.at/pipermail/intelmq-dev/2017-April/000182.html https://lists.cert.at/pipermail/intelmq-dev/2017-June/000203.html

ghost

IP Addresses 0.0.0.0/8

2

0.0.0.0 itself is a non-routable metaddress ([Wikipedia](https://en.wikipedia.org/wiki/0.0.0.0)), so it shouldn't be valid. For the other addresses it's more complicated, [RFC 5735](https://tools.ietf.org/html/rfc5735): > 0.0.0.0/8 - Addresses in this block refer to...

ghost

Modify bot: support multiple config files

2

We currently have two config files which do overlap each other. In the future * the number of rules will increase (e.g. with a more complete malware name-family mapping) and...

ghost