<!DOCTYPE html>
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Dear IntelMQ community, users, developers, and Incident Response
teams!</p>
We are excited to announce the release of IntelMQ version 3.3.1,
which includes important bug fixes.<br>
The updated version is available on PyPI, in the git repository, and
the deb/rpm repositories.<br>
<p>Please see the list of all changes below.</p>
<p>Documentation: <a class="moz-txt-link-freetext" href="https://doc.intelmq.org/">https://doc.intelmq.org/</a><br>
Source code: <a class="moz-txt-link-freetext" href="https://github.com/certtools/intelmq">https://github.com/certtools/intelmq</a><br>
</p>
<p>Thanks to all contributors to this release, in alphabetical
order:</p>
<ul>
<li>DigitalTrustCenter</li>
<li>Edvard Rejthar (CSIRT.CZ)</li>
<li>elsif2 (Shadowserver Foundation)</li>
<li>Kamil Mankowski (CERT.at)</li>
<li>Mikk Margus Möll (CERT.ee)</li>
<li>Sebastian Wagner (Institute for Common Good Technology,
Intevation & BSI)</li>
</ul>
<p>The full list of changes:</p>
<p>Core<br>
====<br>
- `intelmq.lib.utils.drop_privileges`: When IntelMQ is called as
`root` and dropping the privileges to user `intelmq`, also set the
non-primary groups associated with the `intelmq` user. Makes the
behaviour of running intelmqctl as `root` closer to the behaviour
of `sudo -u intelmq ...` (PR#2507 by Mikk Margus Möll).<br>
- `intelmq.lib.utils.unzip`: Ignore directories themselves when
extracting data to prevent the extraction of empty data for a
directory entries (PR#2512 by Kamil Mankowski).<br>
<br>
Bots<br>
====<br>
<br>
Collectors<br>
----------<br>
<br>
- `intelmq.bots.collectors.shadowserver.collector_reports_api.py`:<br>
- Added support for the types parameter to be either a string or
a list (PR#2495 by elsif2).<br>
- Refactored to utilize the type field returned by the API to
match the requested types instead of a sub-string match on the
filename.<br>
- Fixed timezone issue for collecting reports (PR#2506 by
elsif2).<br>
- Fixed behaviour if parameter `reports` value is empty string,
behave the same way as not set, not like no report (PR#2523 by
Sebastian Wagner).<br>
- `intelmq.bots.collectors.shodan.collector_stream` (PR#2492 by
Mikk Margus Möll):<br>
- Add `alert` parameter to Shodan stream collector to allow
fetching streams by configured alert ID<br>
- `intelmq.bots.collectors.mail._lib`: Remove deprecated parameter
`attach_unzip` from default parameters (PR#2511 by Sebastian
Wagner).<br>
<br>
Parsers<br>
-------<br>
<br>
- `intelmq.bots.parsers.shadowserver._config`:<br>
- Fetch schema before first run (PR#2482 by elsif2, fixes
#2480).<br>
- `intelmq.bots.parsers.dataplane.parser`: Use ` | ` as field
delimiter, fix parsing of AS names including `|` (PR#2488 by
DigitalTrustCenter).<br>
- all parsers: add `copy_collector_provided_fields` parameter
allowing copying additional fields from the report, e.g.
`extra.file_name`. (PR#2513 by Kamil Mankowski).<br>
<br>
Experts<br>
-------<br>
<br>
- `intelmq.bots.experts.sieve.expert`:<br>
- For `:contains`, `=~` and `!~`, convert the value to string
before matching avoiding an exception. If the value is a dict,
convert the value to JSON (PR#2500 by Sebastian Wagner).<br>
- Add support for variables in Sieve scripts (PR#2514 by Mikk
Margus Möll, fixes #2486).<br>
- `intelmq.bots.experts.filter.expert`:<br>
- Treat value `false` for parameter `filter_regex` as false
(PR#2499 by Sebastian Wagner).<br>
<br>
Outputs<br>
-------<br>
<br>
- `intelmq.bots.outputs.misp.output_feed`: Handle failures if
saved current event wasn't saved or is incorrect (PR by Kamil
Mankowski).<br>
- `intelmq.bots.outputs.smtp_batch.output`: Documentation on
multiple recipients added (PR#2501 by Edvard Rejthar).<br>
<br>
Documentation<br>
=============<br>
<br>
- Bots: Clarify some section of Mail collectors and the Generic
CSV Parser (PR#2510 by Sebastian Wagner).<br>
</p>
<pre class="moz-signature" cols="72">--
Institute for Common Good Technology
gemeinnütziger Kulturverein - nonprofit cultural society
<a class="moz-txt-link-freetext" href="https://commongoodtechnology.org/">https://commongoodtechnology.org/</a>
ZVR 1510673578</pre>
<p></p>
</body>
</html>