<html>
<head>
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>Any comments on this proposal?<br>
</p>
<br>
<div class="moz-cite-prefix">On 04/12/2017 12:54 PM, Sebastian
Wagner wrote:<br>
</div>
<blockquote type="cite"
cite="mid:4a718255-7d9d-4318-7829-e7df05d90e04@cert.at">
<pre wrap="">Hi,
we have this IP vs FQDN problem in some parsers, not only the
shadowserver. Stripping the port there can be simply achieved by use a
conversion function. But the main problem is IP/FQDN.
Instead of implementing the logic in many parsers we could add this
"intelligence" in the libs.
One possibility: If the parser tries to add an FQDN as IP, save the IP.
But I don't like this simple approach as this implicitness raises other
problems.
Other possibility: Use a new "logic" (actually non-existing) field, e.g.
`destination.host-info`, same applies to source. If some data is added
to this field, the data will be parsed and added to ip, fqdn, port
(,network?)
Example 1:
event['destination.host-info'] = 'example.com:8080'
results in:
{'destination.fqdn': 'example.com', 'destination.port': 8080}
Example2:
event['destination.host-info'] = '10.0.0.1'
results in:
{'source.ip': '10.0.0.1'}
Sebastian
</pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Intelmq-dev mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Intelmq-dev@lists.cert.at">Intelmq-dev@lists.cert.at</a>
<a class="moz-txt-link-freetext" href="http://lists.cert.at/cgi-bin/mailman/listinfo/intelmq-dev">http://lists.cert.at/cgi-bin/mailman/listinfo/intelmq-dev</a>
</pre>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
// Sebastian Wagner <a class="moz-txt-link-rfc2396E" href="mailto:wagner@cert.at"><wagner@cert.at></a> - T: +43 1 5056416 7201
// CERT Austria - <a class="moz-txt-link-freetext" href="https://www.cert.at/">https://www.cert.at/</a>
// Eine Initiative der nic.at GmbH - <a class="moz-txt-link-freetext" href="https://www.nic.at/">https://www.nic.at/</a>
// Firmenbuchnummer 172568b, LG Salzburg</pre>
</body>
</html>