Spamhouse often sends data like:
['111.111.111.183', 'AS11178', 'LV', '1471111139', 'iotmirai', '-', '?', '?', '?', '?']
['111.111.111.230', 'AS11178', 'LV', '1471111134', 'gootkit', '', '111.111.111.166', '1696', 'xxxxxxxxxxx.com', 'tcp']
..these are columns from [0] to [9]. Current parser fails because:
- '?' is not a valid value;
- field [8] is not a valid local_port (sometimes we see a domain);
Could you add the IP checking function inside class SpamhausCERTParserBot(Bot):
def is_valid_ip(self, ip):
m = re.match(r"^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$", ip)
return bool(m) and all(map(lambda n: 0 <= int(n) <= 255, m.groups()))and check if fields 6..9 are valid:
if self.is_valid_ip(row_splitted[6]):
event.add('destination.ip', row_splitted[6])
if row_splitted[7].isdigit():
event.add('destination.port', row_splitted[7])
if row_splitted[8].isdigit():
event.add('extra', {'destination.local_port':
int(row_splitted[8])})
if row_splitted[9] != "?":
event.add('protocol.transport', row_splitted[9])
Spamhouse often sends data like:
..these are columns from [0] to [9]. Current parser fails because:
Could you add the IP checking function inside
class SpamhausCERTParserBot(Bot):and check if fields 6..9 are valid: