Skip to content
Draft
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -77,6 +77,7 @@ Please refer to the [NEWS](NEWS.md) for a list of changes which have an affect o
### Documentation
- Fix and refresh links to mailing lists (PR#2609 by Kamil Mańkowski)
- `Aggregate Bot`: Add illustration graphics (PR#2612 by Sebastian Wagner).
- `scripts/generate-feeds-docs.py`: Remove necessity to specify placeholders for feed name and provider, generate feed code automatically (PR#2653 by Sebastian Wagner).

### Packaging
- Replace `/opt/intelmq` example paths in bots with variable `VAR_STATE_PATH` for correct paths in LSB-path setups like with packages (PR#2587 by Sebastian Wagner).
Expand Down
6 changes: 0 additions & 6 deletions docs/admin/beta-features.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,6 @@
SPDX-License-Identifier: AGPL-3.0-or-later
-->


# Beta Features

## Using Supervisor as a Process Manager
Expand Down Expand Up @@ -45,7 +44,6 @@ process_manager: supervisor
After this it is possible to manage bots like before with `intelmqctl`
command.


## Using AMQP Message Broker

Starting with IntelMQ 1.2 the AMQP protocol is supported as message queue. To use it, install a broker, for example
Expand Down Expand Up @@ -183,7 +181,3 @@ However, there are currently a few cavecats:
queue
- In the logs, you can see the main thread initializing first, then all of the threads which log with the
name `[bot-id].[thread-id]`.




6 changes: 1 addition & 5 deletions docs/admin/common-problems.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,6 @@
SPDX-License-Identifier: AGPL-3.0-or-later
-->


# Common Problems

## IntelMQ
Expand Down Expand Up @@ -42,7 +41,6 @@ errors.

This section has been moved to the [Management Guide](management/intelmq.md#orphaned-queues).


### Multithreading is not available for this bot

Multithreading is not available for some bots and AMQP broker is
Expand All @@ -60,10 +58,8 @@ support Multithreading include:

If you think this mapping is wrong, please report a bug.


## IntelMQ API


### IntelMQCtlError

If the command is not configured correctly, you will see exceptions on
Expand Down Expand Up @@ -118,4 +114,4 @@ other tweaks.
SQLite does not only need write access to the database itself, but also
the folder the database file is located in. Please check that the
webserver has write permissions to the folder the session file is
located in.
located in.
3 changes: 1 addition & 2 deletions docs/admin/configuration/intelmq-api.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,6 @@
SPDX-License-Identifier: AGPL-3.0-or-later
-->


# Configuring IntelMQ API

Depending on your setup you might have to install `sudo` to make it
Expand Down Expand Up @@ -98,4 +97,4 @@ Therefore, SELinux needs to be disabled:
setenforce 0
```

We welcome contributions to provide SELinux policies.
We welcome contributions to provide SELinux policies.
1 change: 0 additions & 1 deletion docs/admin/configuration/intelmq-manager.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,6 @@
SPDX-License-Identifier: AGPL-3.0-or-later
-->


# Configuring IntelMQ Manager

In the file `/usr/share/intelmq-manager/html/js/vars.js` set `ROOT` to the URL of your `intelmq-api` installation - by
Expand Down
3 changes: 2 additions & 1 deletion docs/admin/configuration/intelmq.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,6 @@
SPDX-License-Identifier: AGPL-3.0-or-later
-->


# Configuring IntelMQ

## Directories
Expand Down Expand Up @@ -156,6 +155,7 @@ Some information can as well be found in Python's documentation on the used

If the path `_on_error` exists for a bot, the message is also sent to this queue, instead of (only) dumping the file if
configured to do so.

##### Pipeline

**`source_pipeline_broker`**
Expand Down Expand Up @@ -204,6 +204,7 @@ configured to do so.

(required, integer) broker database that the bot will use to connect and send messages (requirement from
redis broker).

##### Miscellaneous

**`load_balance`**
Expand Down
1 change: 1 addition & 0 deletions docs/admin/configuration/redis.md
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
# Redis Pipeline (Message broker)

<!-- comment
SPDX-FileCopyrightText: 2025 Sebastian Wagner, Intevation GmbH <[email protected]>
SPDX-License-Identifier: AGPL-3.0-or-later
Expand Down
1 change: 0 additions & 1 deletion docs/admin/database/elasticsearch.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,6 @@
SPDX-License-Identifier: AGPL-3.0-or-later
-->


# Using Elasticsearch as a database for IntelMQ

If you wish to run IntelMQ with Elasticsearch or full ELK stack (Elasticsearch, Logstash, Kibana) it is entirely
Expand Down
2 changes: 1 addition & 1 deletion docs/admin/database/mssql.md
Original file line number Diff line number Diff line change
Expand Up @@ -9,4 +9,4 @@ For MSSQL support, the library `pymssql>=2.2` is required.

To output data to MSSQL use SQL Output Bot with parameter `engine` set to `mssql`.

For more information see SQL Output Bot documentation page.
For more information see SQL Output Bot documentation page.
4 changes: 3 additions & 1 deletion docs/admin/database/postgresql.md
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@ You have two basic choices to run PostgreSQL:
### PostgreSQL Server Version

Any supported version of PostgreSQL should work (v>=13 as of January 2025) [[1]](https://www.postgresql.org/support/versioning/).

### events table definition (`intelmq_psql_initdb`)

IntelMQ comes with the `intelmq_psql_initdb` command line tool designed to help with creating the
Expand Down Expand Up @@ -71,6 +72,7 @@ get to test if the user `intelmq` can authenticate):
```bash
psql -h localhost intelmq-events intelmq < /tmp/initdb.sql
```

## EventDB Utilities

Some scripts related to the EventDB are located in the
Expand Down Expand Up @@ -225,4 +227,4 @@ data loss - you need to do this step manually.

While null characters (`0`, not SQL "NULL") in TEXT and JSON/JSONB fields are valid, data containing null characters can
cause troubles in some combinations of clients, servers and each settings. To prevent unhandled errors and data which
can't be inserted into the database, all null characters are escaped (`u0000`) before insertion.
can't be inserted into the database, all null characters are escaped (`u0000`) before insertion.
1 change: 0 additions & 1 deletion docs/admin/database/splunk.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,6 @@
SPDX-License-Identifier: AGPL-3.0-or-later
-->


# Sending IntelMQ events to Splunk

1. Go to Splunk and configure in order to be able to receive
Expand Down
2 changes: 1 addition & 1 deletion docs/admin/database/sqlite.md
Original file line number Diff line number Diff line change
Expand Up @@ -17,4 +17,4 @@ sqlite> .read /tmp/initdb.sql

Then, set the `database` parameter to the `your-db.db` file path.

To output data to SQLite use SQL Output Bot with parameter `engine` set to `sqlite`. For more information see SQL Output Bot documentation page.
To output data to SQLite use SQL Output Bot with parameter `engine` set to `sqlite`. For more information see SQL Output Bot documentation page.
2 changes: 0 additions & 2 deletions docs/admin/faq.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,6 @@
SPDX-License-Identifier: AGPL-3.0-or-later
-->


# Frequently asked questions

## How can I improve the speed?
Expand Down Expand Up @@ -100,4 +99,3 @@ If you installed manually via pip (note that this also deletes all configuration
pip3 uninstall intelmq
rm -r /opt/intelmq
```

2 changes: 0 additions & 2 deletions docs/admin/hardware-requirements.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,15 +3,13 @@
SPDX-License-Identifier: AGPL-3.0-or-later
-->


# Hardware Requirements

Do you ask yourself how much RAM do you need to give your new IntelMQ
virtual machine?

The honest answer is simple and pointless: It depends ;)


## IntelMQ and the messaging queue (broker)

IntelMQ uses a messaging queue to move the messages between the bots.
Expand Down
3 changes: 0 additions & 3 deletions docs/admin/installation/dockerhub.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,6 @@
SPDX-License-Identifier: AGPL-3.0-or-later
-->


# Installation from DockerHub

This guide provides instruction on how to install IntelMQ and it's components using Docker.
Expand Down Expand Up @@ -53,8 +52,6 @@ environment variables `INTELMQ_API_USER` for the username and
!!! note
If you get an **Permission denied** error, you should run `chown -R $USER:$USER example_config`



## Docker without docker-compose

If not already installed, please install
Expand Down
1 change: 0 additions & 1 deletion docs/admin/installation/linux-packages.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,6 @@
SPDX-License-Identifier: AGPL-3.0-or-later
-->


# Installation as Linux package

This guide provides instructions on how to install IntelMQ and it's components from Linux distribution's package repository.
Expand Down
4 changes: 1 addition & 3 deletions docs/admin/installation/pypi.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,6 @@
SPDX-License-Identifier: AGPL-3.0-or-later
-->


# Installation from PyPI

This guide provides instruction on how to install IntelMQ and it's components using the Python Package Index (PyPI)
Expand Down Expand Up @@ -92,7 +91,6 @@ sudo -u intelmq /opt/intelmq/venv/bin/pip install intelmq intelmq-api intelmq-ma
sudo /opt/intelmq/venv/bin/intelmqsetup
```


## Installing IntelMQ API (optional)

The `intelmq-api` packages ships:
Expand Down Expand Up @@ -165,4 +163,4 @@ This file needs to be placed in the correct place for your Apache 2 installation
- On Debian and Ubuntu, the file needs to be placed at `/etc/apache2/conf-available.d/manager-apache.conf` and then execute
`a2enconf manager-apache`.
- On CentOS, RHEL and Fedora, the file needs to be placed at `/etc/httpd/conf.d/` and reload the webserver.
- On openSUSE, the file needs to be placed at `/etc/apache2/conf.d/` and reload the webserver.
- On openSUSE, the file needs to be placed at `/etc/apache2/conf.d/` and reload the webserver.
2 changes: 1 addition & 1 deletion docs/admin/integrations/cifv3.md
Original file line number Diff line number Diff line change
Expand Up @@ -13,4 +13,4 @@ indicators. CIFv3 can correlate indicators via the UUID attribute.
Can be used to submit indicators to a CIFv3 instance by using
the [CIFv3 API](https://github.com/csirtgadgets/bearded-avenger-deploymentkit/wiki/REST-API).

Look at the CIFv3 API Output Bot for more information.
Look at the CIFv3 API Output Bot for more information.
1 change: 0 additions & 1 deletion docs/admin/integrations/misp.md
Original file line number Diff line number Diff line change
Expand Up @@ -48,4 +48,3 @@ Can be used to directly create MISP events in a MISP instance by using
the [MISP API](https://misp.gitbooks.io/misp-book/content/automation/).

Look at the Bots documentation page for more information.

1 change: 0 additions & 1 deletion docs/admin/intro.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,6 @@
SPDX-License-Identifier: AGPL-3.0-or-later
-->


# Intro

This guide provides instructions on how to install, configure and manage IntelMQ and it's components.
Expand Down
5 changes: 1 addition & 4 deletions docs/admin/management/intelmq-api.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,15 +3,12 @@
SPDX-License-Identifier: AGPL-3.0-or-later
-->


# Managing IntelMQ API


## Running


For development purposes and testing you can run directly using `hug`:

```bash
hug -m intelmq_api.serve
```
```
1 change: 0 additions & 1 deletion docs/admin/upgrade.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,6 @@
SPDX-License-Identifier: AGPL-3.0-or-later
-->


# Upgrade instructions

In order to upgrade your IntelMQ installation it is recommended to follow these five steps:
Expand Down
Loading
Loading