[Intelmq-users] ShadowServer Parser bot feedname

Peter Chan pchanwork at gmail.com
Tue Jun 5 11:11:02 CEST 2018


Good day,

I wanted to set up a test in intelmq, with the following pipe:
Fetch Mail Attachement -> Parse Shadow Server csv -> output to file.

The mail and file output bots are running fine, however I am getting the
following error with the shadowserver parser bot:
2018-06-05 10:54:51,880 - ShadowServer-Parser - INFO -
ShadowserverParserBot initialized with id ShadowServer-Parser and intelmq
1.0.3 and python 3.5.2 (default, Nov 23 2017, 16:37:01) as process 7223.
2018-06-05 10:54:51,881 - ShadowServer-Parser - INFO - Bot is starting.
2018-06-05 10:54:51,888 - ShadowServer-Parser - ERROR - No feedname
provided or feedname not in conf.
2018-06-05 10:54:51,889 - ShadowServer-Parser - INFO - Bot stopped.

The feedname parameter in my runtime.conf is definitely populated.
I have tried defining different feed names, based on the report name from
the shadowserver website, but still getting the same error.
Any idea what I am missing?

I've attached my runtime.conf and pipeline.conf for reference.
Unfortunately I cannot share the shadowserver email as it contains device
scans in my ASN.

Regards,
Peter
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cert.at/pipermail/intelmq-users/attachments/20180605/074f8492/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: pipeline.conf
Type: application/octet-stream
Size: 377 bytes
Desc: not available
URL: <http://lists.cert.at/pipermail/intelmq-users/attachments/20180605/074f8492/attachment.obj>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: runtime.conf
Type: application/octet-stream
Size: 1717 bytes
Desc: not available
URL: <http://lists.cert.at/pipermail/intelmq-users/attachments/20180605/074f8492/attachment-0001.obj>


More information about the Intelmq-users mailing list