JSON structure of events: malware.hash

[cert-lv]

In the IntelMQ the event object (etc/harmonization.conf) mostly looks like a JSON object. For example classification.identifier, classification.taxonomy, destination.abuse_contact, destination.geolocation.cc etc., can be represented as:

event
    |
    +- classification
    |   |
    |   +- identifier
    |   +- taxonomy
    |
    +- destination
        |
        +- abuse_contact
        +- geolocation
            |
            +- cc

.. and so on.

But there is one field, called malware.hash, which is a string technically and an object logically at the same time:

malware.hash      - string (should be an object only)
malware.hash.md5  - string
malware.hash.sha1 - string

If someone will want to convert the whole event to the multilevel JSON object - he will fail because of this one field.

Could you replace malware.hash with malware.hash.other (if hash type is unknown) for example? Other name is acceptable.

On the one hand probably many Parsers will have to be updated, but on the other hand you will get a beautiful and correct JSON object.

[dmth]

Thanks for reporting this. I think you are correct.

When this issue is fixed, migrations of the eventDB might become necessary.

[SYNchroACK]

@dmth is it ok for you guys if we fix this in the next days or is there any current compatibility issue?

[aaronkaplan]

--- Mobile

On 29 Dec 2016, at 10:20, SyNchroAcK ***@***.***> wrote: @dmth is it ok for you guys if we fix this in the next days or is there any current compatibility issue?

Well we do have some deployments out there and they will all need to migrate the eventDB database structure. So yes , IMHO it would be fair to first announce this in the users mailinglist.

…

— You are receiving this because you were assigned. Reply to this email directly, view it on GitHub, or mute the thread.

[SYNchroACK]

Email sent.
Subject: "IntelMQ Data Harmonization (DHO) - malware.hash key (issue 732)".

Will wait for feedback and then we will proceed with the fix.

[SYNchroACK]

related to #394