Hi IntelMQ-Devs,
wondering what an OutputBot should do, if it cannot put an event to the output, because of the event itself.
Should it do something like self.logger.warning("event does not meet criteria for output") self._dump_message() # to place the event in a dump file for later inspection
self.acknowledge_message() ?
Background: the https://github.com/certtools/intelmq/blob/develop/intelmq/bots/outputs/misp/... seems to get events that it cannot insert into MISP, because some fields necessary in the intelmq event are not filled with values.
If the bot detects this, it can skip the event, but it seems a good idea to preserve enough info how the empty values came to be.
The alternatives to dumping would be a) write out the event in the log using self.logger b) just ignore the event
Thanks, Bernhard