Hallo there,
I'm new to IntelMQ. But nevertheless I'm wondering how you are getting IntelMQ to use files uploaded in a directory. My only knowledge of IntelMQ Is using the GUI I'm not a scripting guy at all.
Could someone in this community please help with setting the right parameters for the "file-collector2 bot in the GUI of IntelMQ?
In advance many thanks.
Bedste hilsner/regards
Henrik Jensen
TeleDCIS
Tlf: +45 35 88 82 84
Mobil: +45 93 51 00 03
Mail: hj@teledcis.dkmailto:hj@teledcis.dk
www.teledcis.dk
Hi Henrik,
On 1/25/21 2:43 PM, Henrik Jensen - TeleDCIS wrote:
I’m new to IntelMQ. But nevertheless I’m wondering how you are getting IntelMQ to use files uploaded in a directory. My only knowledge of IntelMQ Is using the GUI I’m not a scripting guy at all.
Could someone in this community please help with setting the right parameters for the “file-collector2 bot in the GUI of IntelMQ?
To add a bot to the configuration, either drag it from the list of available bots on the left to the desired place into the graph, or - alternatively - click "Add Bot", select a destination position in the graph and then on the left the bot you want to add.
In any way, you'll get an interface to configure the parameters. You get the same interface when you edit an existing bot (select the bot and click "Edit Bot", or double-click the bot).
Look at the section "runtime". As "path" enter the directory where the bot should expect the files. "postfix" is the file ending (could also be an empty string/null). That's the bare minimum. "rate_limit" is the time in seconds, the bot is sleeping between the runs, adjust it to your needs. "delete_file" determines if the file should be deleted after it has been picked by.
The documentation on this bot can be found here: https://intelmq.readthedocs.io/en/latest/user/bots.html#fileinput
best regards Sebastian
Hi Sebastian,
Thanks for your quick answer.
I do as you described, when I then run the CLI command "intelmqctl check", the system tells me the following: "Bot 'File-Collector' has no 'name'.", what does that mean then?
Bedste hilsner/regards
Henrik Jensen
TeleDCIS
Tlf: +45 35 88 82 84
Mobil: +45 93 51 00 03
Mail: hj@teledcis.dkmailto:hj@teledcis.dk
www.teledcis.dk
From: Sebastian Wagner wagner@cert.at Sent: 25. januar 2021 17:09 To: Henrik Jensen - TeleDCIS hj@teledcis.dk Cc: intelmq-users@lists.cert.at Subject: Re: [IntelMQ-users] Parameters for file-collectors
Hi Henrik,
On 1/25/21 2:43 PM, Henrik Jensen - TeleDCIS wrote:
I'm new to IntelMQ. But nevertheless I'm wondering how you are getting IntelMQ to use files uploaded in a directory. My only knowledge of IntelMQ Is using the GUI I'm not a scripting guy at all.
Could someone in this community please help with setting the right parameters for the "file-collector2 bot in the GUI of IntelMQ?
To add a bot to the configuration, either drag it from the list of available bots on the left to the desired place into the graph, or - alternatively - click "Add Bot", select a destination position in the graph and then on the left the bot you want to add.
In any way, you'll get an interface to configure the parameters. You get the same interface when you edit an existing bot (select the bot and click "Edit Bot", or double-click the bot).
Look at the section "runtime". As "path" enter the directory where the bot should expect the files. "postfix" is the file ending (could also be an empty string/null). That's the bare minimum. "rate_limit" is the time in seconds, the bot is sleeping between the runs, adjust it to your needs. "delete_file" determines if the file should be deleted after it has been picked by.
The documentation on this bot can be found here: https://intelmq.readthedocs.io/en/latest/user/bots.html#fileinput
best regards Sebastian
-- // Sebastian Wagner wagner@cert.atmailto:wagner@cert.at - T: +43 1 5056416 7201 // CERT Austria - https://www.cert.at/ // Eine Initiative der nic.at GmbH - https://www.nic.at/ // Firmenbuchnummer 172568b, LG Salzburg
Hi,
On 1/26/21 8:11 AM, Henrik Jensen - TeleDCIS wrote:
I do as you described, when I then run the CLI command “intelmqctl check”, the system tells me the following: “Bot 'File-Collector' has no 'name'.”, what does that mean then?
I think we can remove this check, as the name field is not required, it was just there for historical reasons.
So you can ignore this warning. Although I don't know how that field did vanish from your configuration...
best regards Sebastian
Bedste hilsner/regards
Henrik Jensen
TeleDCIS
Tlf: +45 35 88 82 84
Mobil: +45 93 51 00 03
Mail: hj@teledcis.dk mailto:hj@teledcis.dk
www.teledcis.dk
TELEDCIS Logo FINAL RGB 200 pixel 72 dpi
*From:*Sebastian Wagner wagner@cert.at *Sent:* 25. januar 2021 17:09 *To:* Henrik Jensen - TeleDCIS hj@teledcis.dk *Cc:* intelmq-users@lists.cert.at *Subject:* Re: [IntelMQ-users] Parameters for file-collectors
Hi Henrik,
On 1/25/21 2:43 PM, Henrik Jensen - TeleDCIS wrote:
I’m new to IntelMQ. But nevertheless I’m wondering how you are getting IntelMQ to use files uploaded in a directory. My only knowledge of IntelMQ Is using the GUI I’m not a scripting guy at all. Could someone in this community please help with setting the right parameters for the “file-collector2 bot in the GUI of IntelMQ?To add a bot to the configuration, either drag it from the list of available bots on the left to the desired place into the graph, or - alternatively - click "Add Bot", select a destination position in the graph and then on the left the bot you want to add.
In any way, you'll get an interface to configure the parameters. You get the same interface when you edit an existing bot (select the bot and click "Edit Bot", or double-click the bot).
Look at the section "runtime". As "path" enter the directory where the bot should expect the files. "postfix" is the file ending (could also be an empty string/null). That's the bare minimum. "rate_limit" is the time in seconds, the bot is sleeping between the runs, adjust it to your needs. "delete_file" determines if the file should be deleted after it has been picked by.
The documentation on this bot can be found here: https://intelmq.readthedocs.io/en/latest/user/bots.html#fileinput
best regards Sebastian
-- // Sebastian Wagner wagner@cert.at mailto:wagner@cert.at - T: +43 1 5056416 7201 // CERT Austria - https://www.cert.at/ // Eine Initiative der nic.at GmbH - https://www.nic.at/ // Firmenbuchnummer 172568b, LG Salzburg
