IntelMQ-dev May 2019

intelmq-dev@lists.cert.at

1 participants
1 discussions

IntelMQ & Manager 2.0.0 Release
by Sebastian Wagner 28 May '19

28 May '19

Dear community, I am pleased to announce the second major versions of IntelMQ and IntelMQ Manager. *A big thanks goes to all the contributors engaging and contributing to this project!* Before migrating, have a look at the NEWS file: https://github.com/certtools/intelmq/blob/maintenance/NEWS.md Installation instructions: https://github.com/certtools/intelmq/blob/2.0.0/docs/INSTALL.md Upgrade instructions: https://github.com/certtools/intelmq/blob/2.0.0/docs/UPGRADING.md The release is available also in the unstable deb/rpm repositories: https://software.opensuse.org/download.html?project=home:sebix:intelmq:unst… It is *not* yet available in the stable repositories, I will do that in the next weeks or with the next bugfix release, depending on whether there are some issues popping up. Some numbers on the bots compared to the first major release: 8 new collectors since 1.0, now 21 in total 16 new parsers since 1.0, now 59 in total 37 new documented feeds since 1.0, now 138 in total 2 new experts since 1.0, now 24 in total 2 new outputs since 1.0, now 15 in total On 4th April I wrote a summary about new features to the developer's list: https://lists.cert.at/pipermail/intelmq-dev/2019-April/000293.html Here is a short summary for the core's most important new features including the links to documentation: * AMQP is available as alternative broker additionally to redis. I do *not* recommend yet to migrate if you are not familiar with RabbitMQ (an AQMP implementation). I'd still like to get more feedback on this feature. https://github.com/certtools/intelmq/blob/|maintenance|/docs/User-Guide.md#… * Supervisor can be used as replacement for intelmqctl's own pid-based process management https://github.com/certtools/intelmq/blob/|maintenance|/docs/User-Guide.md#… Note that there is also a script to generate systemd service files for intelmq bots: https://github.com/certtools/intelmq/tree/maintenance/contrib/systemd * Multithreading: By proving the parameter |instances_threads you can set the number of threads for a bot, works for most bots. https://github.com/certtools/intelmq/blob/maintenance/docs/User-Guide.md#mu… * Statistics: Mostly relevant for power users and developers, the bots save load statistics, not stable yet. Discussion is here: https://github.com/certtools/intelmq/issues/1274 * You can switch between /opt and LSB-paths with an environment variable: https://github.com/certtools/intelmq/blob/maintenance/docs/User-Guide.md#op… * "Named queue" or "paths" have already been introduced in 1.1, allowing multiple *different* destination pipelines. The filter expert supports named queues, potentially reducing the number of needed filter bots: https://github.com/certtools/intelmq/blob/maintenance/docs/Bots.md#possible… Using the sieve expert, you can set the paths for the messages too. * The separated malware name mapping since 1.1: https://github.com/certtools/intelmq/tree/maintenance/contrib/malware_name_… * The transparent usage of `extra.*` fields since 1.1. * And *a lot* of changes in the bots, it is impossible to list them here For the IntelMQ Manager: * The configuration tab shows the number of queued messages live, name of queues ("paths"), management and monitoring features. Physics can be permanently turned off (the state is saved). With the new shortcuts, you can do some actions with keyboard only. * List and array parameters are shown correctly as JSON/JS. * The management allows to manage bot groups (intelmqctl's --group feature). * The monitor page has an advanced inspection tool and further allows management of the bot. * Error handling and communication to the user: Instead of alerts a message box shows a summary and counter of errors messages. * Many more and lots of improvements under the hood I am sure that I forgot something here ;) so for the full changelogs please refer to the repository: https://github.com/certtools/intelmq/blob/develop/CHANGELOG.md https://github.com/certtools/intelmq-manager/blob/develop/CHANGELOG.md Co-financed by the Connecting Europe Facility of the European Union -- // Sebastian Wagner <wagner(a)cert.at> - T: +43 1 5056416 7201 // CERT Austria - https://www.cert.at/ // Eine Initiative der nic.at GmbH - https://www.nic.at/ // Firmenbuchnummer 172568b, LG Salzburg

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

IntelMQ-dev May 2019