Dear Community Please I need help to configure the SMTP bots of Intelmq to send CSV file as describe in the description. I check the MIME and I is not the blocking point. The Information needed to be sent in CSV is either in the ATT00001 file and contrary to all the Intelmq mail I do receive mine is not .txt. Can someone please help me to solve this issue? This is an example of the file sent after the configuration: [cid:image001.png@01D77335.33F95C40]
Cordialement / Best Regards, Kossi DOH Analyste Cyber Securite CYBER DEFENSE AFRICA S.A.S. Mobile: +228 70 54 93 26 https://cert.tg This information is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Unauthorised use of this information by a person or entity other than the intended recipient is prohibited by law. If you received this by mistake, please immediately contact the sender by email or phone and delete this information from any computer. Thank you.
Dear Kossi DOH,
thanks for your interest in IntelMQ and for asking a question! (It helps us all to understand where possible improvement have to be.)
Am Mittwoch 07 Juli 2021 15:37:42 schrieb Kossi DOH via IntelMQ-users:
Please I need help to configure the SMTP bots of Intelmq to send CSV file as describe in the description.
Ss there are several useful ways to send email with IntelMQ, please tell us more about the bots your are using, their configuration and the version of intelmq.
I check the MIME and I is not the blocking point. The Information needed to be sent in CSV is either in the ATT00001 file and contrary to all the Intelmq mail I do receive mine is not .txt.
Can you take a look at the raw email that IntelMQ has send out (by a bot) and tell us the structure? To do this, one way maybe to use an IMAP email client being different than Outlook. E.g. claws-mail.org You could replace or remove the sensitive parts of the raw email and attach it here.
(To get this analysed one of the developers has to be put into the position to understand or recreate what is happening, the raw email is the output of the bots.)
This is an example of the file sent after the configuration: [cid:image001.png@01D77335.33F95C40]
The image probably shows the interpretation of your email client.
Best Regards, Bernhard
Hello dear Bernhard Thanks for your reply and sorry for my late response. I was on shift base. The version of IntelMQ I am using is the 2.3.3 The bots I am using is the SMTP output bot. I will like to add more description to the configuration I have onsite. How the flow is set. ShadowServer reports API--> ShadowServer JSON parser-->Deduplicator_Expert-->Taxonomy-Expert-->Filter-Expert-->CVS-Converter-->SMTPOutput
May be the flow is not correct. And someone can help with.
-----Original Message----- From: Bernhard Reiter bernhard@intevation.de Sent: Friday, July 9, 2021 6:26 AM To: intelmq-users@lists.cert.at; Kossi DOH kdoh@cert.tg Subject: Re: [IntelMQ-users] Unable to send CSV file using Intelmq
Dear Kossi DOH,
thanks for your interest in IntelMQ and for asking a question! (It helps us all to understand where possible improvement have to be.)
Am Mittwoch 07 Juli 2021 15:37:42 schrieb Kossi DOH via IntelMQ-users:
Please I need help to configure the SMTP bots of Intelmq to send CSV file as describe in the description.
Ss there are several useful ways to send email with IntelMQ, please tell us more about the bots your are using, their configuration and the version of intelmq.
I check the MIME and I is not the blocking point. The Information needed to be sent in CSV is either in the ATT00001 file and contrary to all the Intelmq mail I do receive mine is not .txt.
Can you take a look at the raw email that IntelMQ has send out (by a bot) and tell us the structure? To do this, one way maybe to use an IMAP email client being different than Outlook. E.g. claws-mail.org You could replace or remove the sensitive parts of the raw email and attach it here.
(To get this analysed one of the developers has to be put into the position to understand or recreate what is happening, the raw email is the output of the bots.)
This is an example of the file sent after the configuration: [cid:image001.png@01D77335.33F95C40]
The image probably shows the interpretation of your email client.
Best Regards, Bernhard
-- www.intevation.de/~bernhard +49 541 33 508 3-3 Intevation GmbH, Osnabrück, DE; Amtsgericht Osnabrück, HRB 18998 Geschäftsführer Frank Koormann, Bernhard Reiter, Dr. Jan-Oliver Wagner
Hello Kossi,
Am Samstag, 10. Juli 2021, 15:56:11 CEST schrieb Kossi DOH via IntelMQ-users:
-->CVS-Converter-->SMTPOutput
my guess is that "CVS-Converter" is unecessary as the SMTP Output bot does the conversion to CSV itself. (Please read the documentation on both bots and their parameters in detail.)
Best Regards, Bernhard
Hi dear Samstag I tried that solution too and same results. I will go through the documentation again as you suggested. But I think if you have any help on how to set things up it will be welcome.
Cordialement / Best Regards, Kossi DOH Analyste Cyber Securite CYBER DEFENSE AFRICA S.A.S. Mobile: +228 70 54 93 26 www.cda.tg This information is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Unauthorised use of this information by a person or entity other than the intended recipient is prohibited by law. If you received this by mistake, please immediately contact the sender by email or phone and delete this information from any computer. Thank you.
-----Original Message----- From: IntelMQ-users intelmq-users-bounces@lists.cert.at On Behalf Of Bernhard Reiter Sent: Monday, July 12, 2021 12:26 PM To: intelmq-users@lists.cert.at Subject: Re: [IntelMQ-users] Unable to send CSV file using Intelmq
Hello Kossi,
Am Samstag, 10. Juli 2021, 15:56:11 CEST schrieb Kossi DOH via IntelMQ-users:
-->CVS-Converter-->SMTPOutput
my guess is that "CVS-Converter" is unecessary as the SMTP Output bot does the conversion to CSV itself. (Please read the documentation on both bots and their parameters in detail.)
Best Regards, Bernhard
Dear Kossi,
Am Montag, 12. Juli 2021, 14:42:40 CEST schrieb Kossi DOH via IntelMQ-users:
But I think if you have any help on how to set things up it will be welcome.
check the logs, they may contain hints. Maybe see if the documentation you are reading matches the version of the bot.
Personally I haven't used the SMTP Output Bot yet, so I have no example configuration. And me being a developer, when in doubt I just read the code and add print/log lines, until I understand what is going on. (I realize this is not an option for everybody. ;))
Best Regards, Bernhard
Dear Kossi,
You answered the same question about one month ago on a different mailing list and the responses you received still apply.
We suspected that the SMTP output needs to add an additional MIME header to the attachment in the mail, so that Microsoft Outlook interprets the attachment as CSV-file.
So this: Content-Disposition: attachment; filename="somefeed.csv" needs to be added using https://docs.python.org/3/library/email.compat32-message.html#email.message.... at about this place in the IntelMQ code: https://github.com/certtools/intelmq/blob/a51276054a7c5f0744ccb90cda54a03eee...
Unless someone does this work (+ testing), the behavior will likely not change. I /may/ find the time for it this week if nothing else prevents me to do so.
Sebastian
On 7/7/21 3:37 PM, Kossi DOH via IntelMQ-users wrote:
Dear Community
Please I need help to configure the SMTP bots of Intelmq to send CSV file as describe in the description. I check the MIME and I is not the blocking point. The Information needed to be sent in CSV is either in the ATT00001 file and contrary to all the Intelmq mail I do receive mine is not .txt.
Can someone please help me to solve this issue?
This is an example of the file sent after the configuration:
Cordialement / Best Regards,
*Kossi DOH *Analyste Cyber Securite
*CYBER DEFENSE AFRICA S.A.S.*
Mobile: +228 70 54 93 26
This information is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Unauthorised use of this information by a person or entity other than the intended recipient is prohibited by law. If you received this by mistake, please immediately contact the sender by email or phone and delete this information from any computer. Thank you.
Hi Sebastian
Thank for your reply. I will work on it with and see what it gives. If I understand well this issue is related to Microsoft Outlook.
From: Sebastian Wagner wagner@cert.at Sent: Monday, July 12, 2021 12:56 PM To: Kossi DOH kdoh@cert.tg; intelmq-users intelmq-users@lists.cert.at Subject: Re: [IntelMQ-users] Unable to send CSV file using Intelmq
OpenPGP message
Please wait while the message is being verified...
Dear Kossi,
You answered the same question about one month ago on a different mailing list and the responses you received still apply.
We suspected that the SMTP output needs to add an additional MIME header to the attachment in the mail, so that Microsoft Outlook interprets the attachment as CSV-file.
So this: Content-Disposition: attachment; filename="somefeed.csv" needs to be added using https://docs.python.org/3/library/email.compat32-message.html#email.message.... at about this place in the IntelMQ code: https://github.com/certtools/intelmq/blob/a51276054a7c5f0744ccb90cda54a03eee...
Unless someone does this work (+ testing), the behavior will likely not change. I may find the time for it this week if nothing else prevents me to do so.
Sebastian
On 7/7/21 3:37 PM, Kossi DOH via IntelMQ-users wrote:
Dear Community
Please I need help to configure the SMTP bots of Intelmq to send CSV file as describe in the description. I check the MIME and I is not the blocking point. The Information needed to be sent in CSV is either in the ATT00001 file and contrary to all the Intelmq mail I do receive mine is not .txt.
Can someone please help me to solve this issue?
This is an example of the file sent after the configuration:
Cordialement / Best Regards,
Kossi DOH Analyste Cyber Securite
CYBER DEFENSE AFRICA S.A.S.
Mobile: +228 70 54 93 26
https://cert.tg https://cert.tg
This information is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Unauthorised use of this information by a person or entity other than the intended recipient is prohibited by law. If you received this by mistake, please immediately contact the sender by email or phone and delete this information from any computer. Thank you.
Dear Kossi,
I took the time to work on this issue and we merged the fix for it today (https://github.com/certtools/intelmq/pull/2052). The fix will be part of the upcoming IntelMQ release 3.0.1.
best regards Sebastian
On 7/12/21 2:56 PM, Sebastian Wagner wrote:
Dear Kossi,
You answered the same question about one month ago on a different mailing list and the responses you received still apply.
We suspected that the SMTP output needs to add an additional MIME header to the attachment in the mail, so that Microsoft Outlook interprets the attachment as CSV-file.
So this: Content-Disposition: attachment; filename="somefeed.csv" needs to be added using https://docs.python.org/3/library/email.compat32-message.html#email.message.... at about this place in the IntelMQ code: https://github.com/certtools/intelmq/blob/a51276054a7c5f0744ccb90cda54a03eee...
Unless someone does this work (+ testing), the behavior will likely not change. I /may/ find the time for it this week if nothing else prevents me to do so.
Sebastian
On 7/7/21 3:37 PM, Kossi DOH via IntelMQ-users wrote:
Dear Community
Please I need help to configure the SMTP bots of Intelmq to send CSV file as describe in the description. I check the MIME and I is not the blocking point. The Information needed to be sent in CSV is either in the ATT00001 file and contrary to all the Intelmq mail I do receive mine is not .txt.
Can someone please help me to solve this issue?
This is an example of the file sent after the configuration:
Cordialement / Best Regards,
*Kossi DOH *Analyste Cyber Securite
*CYBER DEFENSE AFRICA S.A.S.*
Mobile: +228 70 54 93 26
This information is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Unauthorised use of this information by a person or entity other than the intended recipient is prohibited by law. If you received this by mistake, please immediately contact the sender by email or phone and delete this information from any computer. Thank you.
-- // Sebastian Wagner wagner@cert.at - T: +43 676 898 298 7201 // CERT Austria - https://www.cert.at/ // Eine Initiative der nic.at GmbH - https://www.nic.at/ // Firmenbuchnummer 172568b, LG Salzburg
Hello dear Sebastian
Happy to hear that.
I will be waiting for the update then.
From: Sebastian Wagner wagner@cert.at Sent: Thursday, August 19, 2021 6:22 PM To: Kossi DOH kdoh@cert.tg; intelmq-users intelmq-users@lists.cert.at Subject: Re: [IntelMQ-users] Unable to send CSV file using Intelmq
Dear Kossi,
I took the time to work on this issue and we merged the fix for it today (https://github.com/certtools/intelmq/pull/2052). The fix will be part of the upcoming IntelMQ release 3.0.1.
best regards Sebastian
On 7/12/21 2:56 PM, Sebastian Wagner wrote:
Dear Kossi,
You answered the same question about one month ago on a different mailing list and the responses you received still apply.
We suspected that the SMTP output needs to add an additional MIME header to the attachment in the mail, so that Microsoft Outlook interprets the attachment as CSV-file.
So this: Content-Disposition: attachment; filename="somefeed.csv" needs to be added using https://docs.python.org/3/library/email.compat32-message.html#email.message.... at about this place in the IntelMQ code: https://github.com/certtools/intelmq/blob/a51276054a7c5f0744ccb90cda54a03eee...
Unless someone does this work (+ testing), the behavior will likely not change. I may find the time for it this week if nothing else prevents me to do so.
Sebastian
On 7/7/21 3:37 PM, Kossi DOH via IntelMQ-users wrote:
Dear Community
Please I need help to configure the SMTP bots of Intelmq to send CSV file as describe in the description. I check the MIME and I is not the blocking point. The Information needed to be sent in CSV is either in the ATT00001 file and contrary to all the Intelmq mail I do receive mine is not .txt.
Can someone please help me to solve this issue?
This is an example of the file sent after the configuration:
Cordialement / Best Regards,
Kossi DOH Analyste Cyber Securite
CYBER DEFENSE AFRICA S.A.S.
Mobile: +228 70 54 93 26
https://cert.tg https://cert.tg
This information is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Unauthorised use of this information by a person or entity other than the intended recipient is prohibited by law. If you received this by mistake, please immediately contact the sender by email or phone and delete this information from any computer. Thank you.
-- // Sebastian Wagner wagner@cert.at mailto:wagner@cert.at - T: +43 676 898 298 7201 // CERT Austria - https://www.cert.at/ // Eine Initiative der nic.at GmbH - https://www.nic.at/ // Firmenbuchnummer 172568b, LG Salzburg
