[Intelmq-dev] changing bot runtime parameter

[Salehi Ghamsari, Majid]

Dear Sebastian,
> Is the IP part of the message or is it a mapping needed?
test-file-collector (192.0.2.0-192.0.2.255) ----------> test-message-expert (192.0.2.10) ---> test-tcp-output
No, the idea is that the expert bot makes ip range correlation with interface (REST GET) from extern server.
example
192.0.2.10 = Get_IP4RANGE_FROM_SEVER ("192.0.2.0-192.0.2.255")
I would like to set the IP runtime parameter (192.0.2.10) of the TCP-output bot "test-tcp-output".
I honestly did not understand how to implement this with filters.

Regards Majid

From: Sebastian Wagner [mailto:wagner at cert.at]
Sent: Donnerstag, 5. Juli 2018 16:10
To: Salehi Ghamsari, Majid <majid.salehi.ghamsari at fokus.fraunhofer.de>; intelmq-dev at lists.cert.at
Subject: Re: [Intelmq-dev] changing bot runtime parameter


Hi,
On 2018-07-05 14:56, Salehi Ghamsari, Majid wrote:

I would like to put or change the IP runtime parameter of the TCP output bot "test-tcp-output" depends on Message that I get from file-collector in the runtime.
What is the best method to do this in intelmq?

Is the IP part of the message or is a mapping needed?

Are the IPs fixed and is the number of them small? Then you can use filters and different output bots, the explicit way.

Sebastian



--

// Sebastian Wagner <wagner at cert.at><mailto:wagner at cert.at> - T: +43 1 5056416 7201

// CERT Austria - https://www.cert.at/

// Eine Initiative der nic.at GmbH - https://www.nic.at/

// Firmenbuchnummer 172568b, LG Salzburg
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cert.at/pipermail/intelmq-dev/attachments/20180710/847bf065/attachment.html>