Dear Sebastian,
Is the IP part of the message or is it a mapping needed?
test-file-collector (192.0.2.0-192.0.2.255) ----------> test-message-expert (192.0.2.10) ---> test-tcp-output No, the idea is that the expert bot makes ip range correlation with interface (REST GET) from extern server. example 192.0.2.10 = Get_IP4RANGE_FROM_SEVER ("192.0.2.0-192.0.2.255") I would like to set the IP runtime parameter (192.0.2.10) of the TCP-output bot "test-tcp-output". I honestly did not understand how to implement this with filters.
Regards Majid
From: Sebastian Wagner [mailto:wagner@cert.at] Sent: Donnerstag, 5. Juli 2018 16:10 To: Salehi Ghamsari, Majid majid.salehi.ghamsari@fokus.fraunhofer.de; intelmq-dev@lists.cert.at Subject: Re: [Intelmq-dev] changing bot runtime parameter
Hi, On 2018-07-05 14:56, Salehi Ghamsari, Majid wrote:
I would like to put or change the IP runtime parameter of the TCP output bot "test-tcp-output" depends on Message that I get from file-collector in the runtime. What is the best method to do this in intelmq?
Is the IP part of the message or is a mapping needed?
Are the IPs fixed and is the number of them small? Then you can use filters and different output bots, the explicit way.
Sebastian
--
// Sebastian Wagner wagner@cert.atmailto:wagner@cert.at - T: +43 1 5056416 7201
// CERT Austria - https://www.cert.at/
// Eine Initiative der nic.at GmbH - https://www.nic.at/
// Firmenbuchnummer 172568b, LG Salzburg