SpamScope v1.5.0

Highlights

• Added new network bolt: now it's possible to analyze the sender ip address.
• Updated Apache Storm version (1.1.0).
• Mark mail as phishing only if there are urls.
• Fixed Thug analysis for files in archive.
• Fixed attachments filter function.

⚠️ Breaking Changes ⚠️

• New flag for attachments: with_raw_attachments. If true mail has attachments.
  If with_attachments is true the mail has attachments that are not filtered.

⚠️ New configuration sections ⚠️

• Added two new fields to tokenizer bolt, to filter analysis of sender ip address:

+    # If True the same ip address is filtered and not analyzed.
 +    filter_network: True
 +
 +    # Max number of hashes saved for filter function
 +    maxlen_network: 1000000

• New section for network bolt:

+# Network bolt configuration
 +network:
 +    shodan:
 +        enabled: False
 +        api_key: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
 +
 +    virustotal:
 +        enabled: False
 +        api_key: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx