Hello,
I would like to propose a change to the mapping of the 'source' field in the blocklist report which is currently mapped to 'extra.source' in IntelMQ to 'extra.source_name'.
This change is necessary to avoid conflicts with the elasticsearch mapping of the 'extra.source' field where it is commonly an object instead of a string.
Reports details can be found here:
https://www.shadowserver.org/what-we-do/network-reporting/blocklist-report/
Regards,
Jason