Kyle Maxwell

We may have lost some of the DNS enrichment logic with the move to the new plugin architecture. This should be investigated and fixed.

The current code in `dev` uses a custom queueing solution built directly on the low-level APIs in Python. We should use some existing module (such as requests-futures?), otherwise we'll have...

Catch HTTP errors

1

Currently HTTP errors (e.g. 404 when attempting a DNSDB lookup on an address not in the DB) fill up the console. We should either mute these or else provide better...

e.g. ``` 2015-01-07 14:51:24,849 - combine.winnower - ERROR - Could not determine address type for 68.24.212.66.in-addr.arpa. listed as FQDN ```

Handle FQDNs with port numbers specified

1

This is really a URL but isn't specified as such. ``` 2015-01-23 15:18:07,977 - combine.winnower - ERROR - Could not determine address type for vendor.almsyar.com:8080 listed as FQDN ```

Group enrichments

4

From @alexcpsec in #21: > I would separate the enrichments by "groups" (for the lack of a better name) in a config file. And the groups would have a list...

We should think about alternative strategies for enrichment (e.g. not just maxhits).

[From @womba164](https://twitter.com/wompa164/status/496816573558956033): > Can I suggest using {}-style string formatting for Python3 forward compat?

JSON improvements

1

Our JSON sucks right now. Effectively, each indicator is treated as a list. Turning it into a key-value array (dict in Python terms) would make it much more readable and...

Additional option from CSV