IntelMQ-users March 2020

intelmq-users@lists.cert.at

5 participants
3 discussions

Reverse DNS Expert - unusual behavior
by Tomislav Protega 31 Mar '20

31 Mar '20

Hi, recently I noticed that reverse DNS expert bot doesn't correctly apply the reverse lookup results for IP. Meaning, the right value (result) is not applied for the right JSON event. It's like it's skipping it and then applies it to other event. There are no errors in log file for the bot. For the illustration: Let say that hostname for IP 1.1.1.1 is "xx.yyy.zz", but instead the mentioned hostname becomes applied under wrong JSON event for the IP which in real has no PTR record in DNS. Of course, there are events which have applied right PTR record for the IP, but in rare situations. This case is not the issue with raw events which already contain hostname in origin feed. Anyone notice such behavor, or could take a look at already processed data and see if the "source.reverse_dns" has right value applied against IP? Regards, -- Tomislav

2 5

MAIL ATTACHMENT FETCHER FAILS TO READ/PARSE CSV FILE.
by patric sungura 19 Mar '20

19 Mar '20

Dear Team,Please assist me on mail attachment fetcher.Intelmq fails to read/parse csv file as per below erros from log and dump. ShadowServer-Parser-2.log 2020-03-17 16:10:42,064 - ShadowServer-Parser-2 - ERROR - Bot has found a problem.Traceback (most recent call last): File "/usr/local/lib/python3.5/dist-packages/intelmq/lib/bot.py", line 267, in start self.process() File "/usr/local/lib/python3.5/dist-packages/intelmq/lib/bot.py", line 941, in process for line in self.parse(report): File "/usr/local/lib/python3.5/dist-packages/intelmq/lib/bot.py", line 884, in parse_csv_dict self.csv_fieldnames = csv_reader.fieldnames File "/usr/lib/python3.5/csv.py", line 96, in fieldnames self._fieldnames = next(self.reader, dialect=csv.excel_tab)NameError: name 'csv' is not defined2020-03-17 16:10:42,065 - ShadowServer-Parser-2 - INFO - Dumping message to dump file. ShadowServer-Parser-2.dump "source_queue": "ShadowServer-Parser-2-queue", "traceback": [ "Traceback (most recent call last):\n", " File \"/usr/local/lib/python3.5/dist-packages/intelmq/lib/bot.py\", line 267, in start\n self.process()\n", " File \"/usr/local/lib/python3.5/dist-packages/intelmq/lib/bot.py\", line 941, in process\n for line in self.parse(report):\n", " File \"/usr/local/lib/python3.5/dist-packages/intelmq/lib/bot.py\", line 884, in parse_csv_dict\n self.csv_fieldnames = csv_reader.fieldnames\n", " File \"/usr/lib/python3.5/csv.py\", line 96, in fieldnames\n self._fieldnames = next(self.reader, dialect=csv.excel_tab)\n", "NameError: name 'csv' is not defined\n" ] }

3 16

RIPE Expert Geolocation data (currently) not available anymore
by Sebastian Wagner 18 Mar '20

18 Mar '20

Hi, I just noticed, that RIPE currently does not provide geolocation information anymore as a result of the MaxMind data license change. That data can/could be queried with the IntelMQ RIPE expert. In case you are still relying on this information, please use another source for geolocation data, like the maxmind geolocation expert and local data. Unfortunately, the returned status code of the API call is 200 and the error is only detectable by another field. I am working on changes in the RPIE expert to detect this and raise a warning for it. best regards, Sebastian For example https://stat.ripe.net/data/maxmind-geo-lite/data.json?resource=131.130.254.… says: messages 0 0 "info" 1 "This data is currently unavailable due to maintenance. Please check official announcements for when it will be available again! https://stat.ripe.net/feedback" data_call_status "maintenance - this data call is in maintenance mode" -- // Sebastian Wagner <wagner(a)cert.at> - T: +43 1 5056416 7201 // CERT Austria - https://www.cert.at/ // Eine Initiative der nic.at GmbH - https://www.nic.at/ // Firmenbuchnummer 172568b, LG Salzburg

2 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

IntelMQ-users March 2020