<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Dear community,</p>
<p>It's again long overdue for a new release and here it is finally.
Since August we collected quite a few bugfixes - Thanks to all
contributors!</p>
<p>IntelMQ Installation documentation:<br>
<a class="moz-txt-link-freetext" href="https://github.com/certtools/intelmq/blob/2.2.2/docs/INSTALL.md">https://github.com/certtools/intelmq/blob/2.2.2/docs/INSTALL.md</a><br>
IntelMQ Upgrade documentation:<br>
<a class="moz-txt-link-freetext" href="https://github.com/certtools/intelmq/blob/2.2.2/docs/UPGRADING.md">https://github.com/certtools/intelmq/blob/2.2.2/docs/UPGRADING.md</a><br>
</p>
<p><b>News for IntelMQ 2.2.2</b></p>
<p>### Bots<br>
#### Cymru Whois Lookup<br>
The cache key calculation has been fixed. It previously led to
duplicate keys for different IP addresses and therefore wrong
results in rare cases. The cache key calculation is intentionally
not backwards-compatible. Therefore, this bot may take longer
processing events than usual after applying this update.<br>
More details can be found in [issue
#1592](<a class="moz-txt-link-freetext" href="https://github.com/certtools/intelmq/issues/1592">https://github.com/certtools/intelmq/issues/1592</a>).<br>
<br>
### Harmonization<br>
#### Shadowserver Feed/Parser<br>
The feed "Blacklisted-IP" has been renamed by ShadowServer to
"Blocklist". In IntelMQ, the old name can still be used in IntelMQ
until version 3.0.</p>
<p><b>Changes for IntelMQ 2.2.2</b><br>
</p>
<p>### Core<br>
- `intelmq.lib.upgrades`:<br>
- Add upgrade function for renamed Shadowserver feed name
"Blacklisted-IP"/"Blocklist".<br>
<br>
### Bots<br>
#### Parsers<br>
- `intelmq.bots.parsers.shadowserver`:<br>
- Rename "Blacklisted-IP" feed to "Blocklist", old name is still
valid until IntelMQ version 3.0 (PR#1588 by Thomas Hungenberg).<br>
- Added support for the feeds `Accessible Radmin` and `CAIDA IP
Spoofer` (PR#1600 by sinus-x).<br>
- `intelmq.bots.parsers.anubisnetworks.parser`: Fix parsing error
where `dst.ip` was not equal to `comm.http.host`.<br>
- `intelmq/bots/parsers/danger_rulez/parser`: correctly skip
malformed rows by defining variables before referencing (PR#1601
by Tomas Bellus).<br>
- `intelmq.bots.parsers.misp.parser: Fix MISP Event URL (#1619,
PR#1618 by Nedfire23).<br>
- `intelmq.bots.parsers.microsoft.parser_ctip`:<br>
- Add support for `DestinationIpInfo.*` and `Signatures.Sha256`
fields, used by the `ctip-c2` feed (PR#1623 by Mikk Margus Möll).<br>
- Use `extra.payload.text` for the feed's field `Payload` if the
content cannot be decoded (PR#1610 by Giedrius Ramas).<br>
<br>
#### Experts<br>
- `intelmq.bots.experts.cymru_whois`:<br>
- Fix cache key calculation which previously led to duplicate
keys and therefore wrong results in rare cases. The cache key
calculation is intentionally not backwards-compatible (#1592,
PR#1606).<br>
- The bot now caches and logs (as level INFO) empty responses
from Cymru (PR#1606).<br>
<br>
### Documentation<br>
- README:<br>
- Add Core Infrastructure Initiative Best Practices Badge.<br>
- Bots:<br>
- Generic CSV Parser: Add note on escaping backslashes (#1579).<br>
- Remove section of non-existing "Copy Extra" Bot.<br>
- Explain taxonomy expert.<br>
- Add documentation on n6 parser.<br>
- Gethostbyname expert: Add documentation how errors are
treated.<br>
- Feeds:<br>
- Fixed bot modules of Calidog CertStream feed.<br>
- Add information on Microsoft CTIP C2 feed.<br>
<br>
### Packaging<br>
- In Debian packages, `intelmqctl check` and `intelmqctl
upgrade-config` are executed in the postinst step (#1551, PR#1624
by Birger Schacht).<br>
<br>
### Tests<br>
- `intelmq.tests.lib.test_pipeline`: Skip
`TestAmqp.test_acknowledge` on Travis with Python 3.8.<br>
- `intelmq.tests.bots.outputs.elasticsearch.test_output`: Refresh
index `intelmq` manually to fix random test failures (#1593,
PR#1595 by Zach Stone).<br>
<br>
### Tools<br>
- `intelmqctl check`:<br>
- For disabled bots which do not have any pipeline connections,
do not raise an error, but only warning.<br>
- Fix check on source/destination queues for bots as well the
orphaned queues.<br>
<br>
### Contrib<br>
- Bash completion scripts: Check both `/opt/intelmq/` as well as
LSB-paths (`/etc/intelmq/` and `/var/log/intelmq/`) for loading
bot information (#1561, PR#1628 by Birger Schacht).<br>
<br>
### Known issues<br>
- Bots started with IntelMQ-Manager stop when the webserver is
restarted. (#952).<br>
- Corrupt dump files when interrupted during writing (#870).<br>
</p>
<pre class="moz-signature" cols="72">--
// Sebastian Wagner <a class="moz-txt-link-rfc2396E" href="mailto:wagner@cert.at"><wagner@cert.at></a> - T: +43 1 5056416 7201
// CERT Austria - <a class="moz-txt-link-freetext" href="https://www.cert.at/">https://www.cert.at/</a>
// Eine Initiative der nic.at GmbH - <a class="moz-txt-link-freetext" href="https://www.nic.at/">https://www.nic.at/</a>
// Firmenbuchnummer 172568b, LG Salzburg</pre>
</body>
</html>