intelmq.bots.parsers.cznic package¶

Submodules¶

intelmq.bots.parsers.cznic.parser_haas module¶

intelmq.bots.parsers.cznic.parser_haas.BOT¶: alias of CZNICHaasParserBot

class intelmq.bots.parsers.cznic.parser_haas.CZNICHaasParserBot(*args, **kwargs)¶

Bases: ParserBot

CZ.NIC HaaS Parser is the bot responsible to parse the report and sanitize the information

parse(report: Report)¶: A basic JSON parser. Assumes a list of objects as input to be yield.

parse_line(line, report)¶

A generator which can yield one or more messages contained in line.

Report has the full message, thus you can access some metadata. Override for your use.

recover_line(line: dict) → str¶

Reverse of parse for JSON pulses.

Recovers a fully functional report with only the problematic pulse. Using a string as input here is not possible, as the input may span over multiple lines. Output is not identical to the input, but has the same content.

Parameters:: dict. (The line as) –
Returns:: The JSON-encoded line as string.
Return type:: str

intelmq.bots.parsers.cznic.parser_proki module¶

intelmq.bots.parsers.cznic.parser_proki.BOT¶: alias of CZNICProkiParserBot

class intelmq.bots.parsers.cznic.parser_proki.CZNICProkiParserBot(*args, **kwargs)¶

Bases: ParserBot

Parse the feed from malicious IP addresses on Czech networks

parse(report)¶

A generator yielding the single elements of the data.

Comments, headers etc. can be processed here. Data needed by self.parse_line can be saved in self.tempdata (list).

Default parser yields stripped lines. Override for your use or use an existing parser, e.g.:

parse = ParserBot.parse_csv

You should do that for recovering lines too.: recover_line = ParserBot.recover_line_csv