ENH: Improved Abuse.ch Feodo Tracker parser bot and documentation #2268
Conversation
gethvi
force-pushed
the
feodo-parser
branch
5 times, most recently
from
687d1da
to
8e1e9f3
Compare
gethvi
force-pushed
the
feodo-parser
branch
4 times, most recently
from
6bdbc6d
to
375474e
Compare
gethvi
force-pushed
the
feodo-parser
branch
4 times, most recently
from
5e55172
to
f31684e
Compare
|
This also fixes #1499. |
| messages.append('A discontinued feed "Abuse.ch Feodo Tracker IPs" has been found' | ||
| 'as bot %s.\nPlease manually replace with the feed' | ||
| '"Abuse.ch Feodo Tracker".' % ', '.join(sorted(found_abusech_feodotracker_csv))) | ||
|
|
||
| if found_abusech_feodotracker_browse: | ||
| messages.append('A discontinued feed "Abuse.ch Feodo Tracker Browse" has been found' | ||
| 'as bot %s.\nPlease manually replace with the feed' | ||
| '"Abuse.ch Feodo Tracker".' % ', '.join(sorted(found_abusech_feodotracker_browse))) | ||
|
|
||
| if found_abusech_removed_parsers: | ||
| messages.append('A discontinued bot module has been found' | ||
| 'as bot %s.' % ', '.join(sorted(found_abusech_removed_parsers))) | ||
|
|
There was a problem hiding this comment.
Why not changing the config directly? Replacing the module and adapting the http_url can be fully automated.
There was a problem hiding this comment.
I made the explanation into an issue #2297.
There was a problem hiding this comment.
If you insist on changing the config directly I will do it. Just let me know.
However as a user I prefer only being notified that I need to change to the config. I like to understand the necessary changes even if it requires more (manual) effort. That's why I implemented the upgrades this way.
There was a problem hiding this comment.
I'd believe that the change shouldn't be done automatically - but it could be suggested. Either as "run command xyz to automatically update documentation" or "please change following things ... ".
There was a problem hiding this comment.
Either as "run command xyz to automatically update documentation"
Originally that was the purpose of the intelmqctl upgrade-config command.
… feeds and parsers. Updates documentation.
This PR replaces two duplicate feeds with an unified and improved one with greatly simplified code. The JSON source from feodotracker.abuse.ch has the most complete data (compared to CSV and Browse HTML table).