Hello,
I would like to propose a change to the mapping of the 'source' field in
the blocklist report which is currently mapped to 'extra.source' in
IntelMQ to 'extra.source_name'.
This change is necessary to avoid conflicts with the elasticsearch
mapping of the 'extra.source' field where it is commonly an object
instead of a string.
Reports details can be found here:
https://www.shadowserver.org/what-we-do/network-reporting/blocklist-report/
Regards,
Jason