Skip to content

Commit acf17e3

Browse files
authored
Merge branch 'develop' into fix_missing_kommas
2 parents 2047508 + 9750181 commit acf17e3

File tree

22 files changed

+815
-115
lines changed

22 files changed

+815
-115
lines changed

.github/workflows/unittests.yml

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,6 @@
66
name: "Unit tests"
77
on:
88
push:
9-
branches: [develop, maintenance, master]
109
pull_request:
1110
branches: [develop, maintenance]
1211
paths-ignore:

CHANGELOG.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ CHANGELOG
2020
- `intelmq.lib.harmonization`:
2121
- Changes signature and names of `DateTime` conversion functions for consistency, backwards compatible (PR#2329 by Filip Pokorný).
2222
- Ensure rejecting URLs with leading whitespaces after changes in CPython (fixes [#2377](https://github.com/certtools/intelmq/issues/2377))
23+
- `intelmq.lib.bot.Bot`: Allow setting the parameters via parameter on bot initialization.
2324

2425
### Development
2526
- CI: pin the Codespell version to omit troubles caused by its new releases (PR #2379).
@@ -52,13 +53,16 @@ CHANGELOG
5253
- `intelmq.bots.experts.cymru_whois`:
5354
- Ignore AS names with unexpected unicode characters (PR#2352, fixes #2132)
5455
- Avoid extraneous search domain-based queries on NXDOMAIN result (PR#2352)
56+
- `intelmq.bots.experts.sieve`:
57+
- Added :before and :after keywords (PR#2374)
5558

5659
#### Outputs
5760
- `intelmq.bots.outputs.cif3.output`: Added (PR#2244 by Michael Davis).
5861
- `intelmq.bots.outputs.sql.output`: New parameter `fail_on_errors` (PR#2362 by Sebastian Wagner).
5962
- `intelmq.bots.outputs.smtp_batch.output`: Added a bot to gathering the events and sending them by e-mails at a stroke as CSV files (PR#2253 by Edvard Rejthar)
6063

6164
### Documentation
65+
- API: update API installation to be aligned with the rewritten API, and clarify some missing steps.
6266

6367
### Tests
6468
- New decorator `skip_installation` and environment variable `INTELMQ_TEST_INSTALLATION` to skip tests requiring an IntelMQ installation on the test host by default (PR#2370 by Sebastian Wagner, fixes #2369)
@@ -69,6 +73,8 @@ CHANGELOG
6973
- `intelmqsetup`:
7074
- SECURITY: fixed a low-risk bug causing the tool to change owner of `/` if run with the `INTELMQ_PATHS_NO_OPT` environment variable set. This affects only the PIP package as the DEB/RPM packages don't contain this tool. (PR#2355 by Kamil Mańkowski, fixes #2354)
7175
- `contrib.eventdb.separate-raws-table.sql`: Added the missing commas to complete the sql syntax. (PR#2386, fixes #2125 by Sebastian Kufner)
76+
- `intelmq_psql_initdb`:
77+
- Added parameter `-o` to set the output file destination. (by Sebastian Kufner)
7278

7379
### Known Errors
7480
- `intelmq.parsers.html_table` may not process invalid URLs in patched Python version due to changes in `urllib`. See #2382

debian/control

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,8 @@ Build-Depends: debhelper (>= 4.1.16),
2222
python3-tz,
2323
quilt,
2424
rsync,
25-
safe-rm
25+
safe-rm,
26+
python3-pytest-cov
2627
X-Python3-Version: >= 3.7
2728
Standards-Version: 3.9.6
2829
Homepage: https://github.com/certtools/intelmq/

docs/dev/library.rst

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
..
2+
SPDX-FileCopyrightText: 2023 Bundesamt für Sicherheit in der Informationstechnik (BSI)
3+
SPDX-License-Identifier: AGPL-3.0-or-later
4+
5+
##########################
6+
Running IntelMQ as Library
7+
##########################
8+
9+
.. contents::
10+
11+
************
12+
Introduction
13+
************
14+
15+
The feature is specified in `IEP007 <https://github.com/certtools/ieps/tree/iep-007/007/>`_.
16+
17+
**********
18+
Quickstart
19+
**********
20+
21+
First, import the Python module and a helper. More about the ``BotLibSettings`` later.
22+
23+
.. code-block:: python
24+
25+
from intelmq.lib.bot import BotLibSettings
26+
from intelmq.bots.experts.domain_suffix.expert import DomainSuffixExpertBot
27+
28+
Then we need to initialize the bot's instance.
29+
We pass two parameters:
30+
* ``bot_id``: The id of the bot
31+
* ``settings``: A Python dictionary of runtime configuration parameters, see :ref:`runtime-configuration`.
32+
The bot first loads the runtime configuration file if it exists.
33+
Then we update them with the ``BotLibSettings`` which are some accumulated settings disabling the logging to files and configure the pipeline so that we can send and receive messages directly to/from the bot.
34+
Last by not least, the actual bot parameters, taking the highest priority.
35+
36+
.. code-block:: python
37+
38+
domain_suffix = DomainSuffixExpertBot('domain-suffix', # bot id
39+
settings=BotLibSettings | {
40+
'field': 'fqdn',
41+
'suffix_file': '/usr/share/publicsuffix/public_suffix_list.dat'}
42+
43+
As the bot is not fully initialized, we can process messages now.
44+
Inserting a message as dictionary:
45+
46+
.. code-block:: python
47+
48+
queues = domain_suffix.process_message({'source.fqdn': 'www.example.com'})
49+
50+
The return value is a dictionary of queues, e.g. the output queue and the error queue.
51+
More details below.
52+
53+
The methods accepts multiple messages as positional argument:
54+
55+
.. code-block:: python
56+
57+
domain_suffix.process_message({'source.fqdn': 'www.example.com'}, {'source.fqdn': 'www.example.net'})
58+
domain_suffix.process_message(*[{'source.fqdn': 'www.example.com'}, {'source.fqdn': 'www.example.net'}])
59+
60+
61+
Select the output queue (as defined in `destination_queues`), first message, access the field 'source.domain_suffix':
62+
63+
.. code-block:: python
64+
65+
>>> output['output'][0]['source.domain_suffix']
66+
'com'
67+
68+
*************
69+
Configuration
70+
*************
71+
72+
Configuration files are not required to run IntelMQ as library.
73+
Contrary to IntelMQ normal behavior, if the files ``runtime.yaml`` and ``harmonization.conf`` do not exist, IntelMQ won't raise any errors.
74+
For the harmonization configuration, internal defaults are loaded.

docs/index.rst

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,7 @@ Getting involved
7474
:maxdepth: 1
7575

7676
dev/guide
77+
dev/library
7778
dev/data-format
7879
dev/harmonization-fields
7980
dev/release-procedure

docs/user/bots.rst

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2194,7 +2194,7 @@ Both parameters accept string values describing absolute or relative time:
21942194

21952195
* absolute
21962196

2197-
* basically anything parseable by datetime parser, eg. "2015-09-012T06:22:11+00:00"
2197+
* basically anything parseable by datetime parser, eg. "2015-09-12T06:22:11+00:00"
21982198
* `time.source` taken from the event will be compared to this value to decide the filter behavior
21992199

22002200
* relative
@@ -2204,7 +2204,7 @@ Both parameters accept string values describing absolute or relative time:
22042204

22052205
*Examples of time filter definition*
22062206

2207-
* ```"not_before" : "2015-09-012T06:22:11+00:00"``` events older than the specified time will be dropped
2207+
* ```"not_before" : "2015-09-12T06:22:11+00:00"``` events older than the specified time will be dropped
22082208
* ```"not_after" : "6 months"``` just events older than 6 months will be passed through the pipeline
22092209

22102210
**Possible paths**
@@ -3003,6 +3003,12 @@ The following operators may be used to match events:
30033003
* `:supersetof` tests if the list of values from the given key is a superset of the values specified as the argument. Example for matching hosts with at least the IoT and vulnerable tags:
30043004
``if extra.tags :supersetof ['iot', 'vulnerable'] { ... }``
30053005
3006+
* `:before` tests if the date value occurred before given time ago. The time might be absolute (basically anything parseable by pendulum parser, eg. “2015-09-12T06:22:11+00:00”) or relative (accepted string formatted like this “<integer> <epoch>”, where epoch could be any of following strings (could optionally end with trailing ‘s’): hour, day, week, month, year)
3007+
``if time.observation :before '1 week' { ... }``
3008+
3009+
* `:after` tests if the date value occurred after given time ago; see `:before`
3010+
``if time.observation :after '2015-09-12' { ... } # happened after midnight the 12th Sep``
3011+
30063012
* Boolean values can be matched with `==` or `!=` followed by `true` or `false`. Example:
30073013
``if extra.has_known_vulns == true { ... }``
30083014

0 commit comments

Comments
 (0)