intelmq.bots.parsers.abusech package — intelmq 3.1.0.alpha1 documentation

# intelmq.bots.parsers.abusech package

## Submodules

## intelmq.bots.parsers.abusech.parser_domain module

Parses simple newline separated list of domains.

Docs:

  - https://feodotracker.abuse.ch/blocklist/

  - https://palevotracker.abuse.ch/blocklists.php

  - https://zeustracker.abuse.ch/blocklist.php

class intelmq.bots.parsers.abusech.parser_domain.AbusechDomainParserBot(bot_id: str, start: bool = False, sighup_event=None, disable_multithreading: Optional[bool] = None)

  Bases: `intelmq.lib.bot.ParserBot`

  Parse Abuse.ch domain feeds

  parse_line(line, report)

    A generator which can yield one or more messages contained in line.

    Report has the full message, thus you can access some metadata. Override for your use.

  recover_line(line)

    Reverse of “parse” for single lines.

    Recovers a fully functional report with only the problematic line by concatenating all strings in “self.tempdata” with “line” with LF newlines. Works fine for most text files.

    lineOptional[str], optional

      The currently process line which should be transferred into it’s original appearance. As fallback, “self._current_line” is used if available (depending on self.parse). The default is None.

    ValueError

      If neither the parameter “line” nor the member “self._current_line” is available.

    str

      The reconstructed raw data.

intelmq.bots.parsers.abusech.parser_domain.BOT

  alias of `intelmq.bots.parsers.abusech.parser_domain.AbusechDomainParserBot`

## intelmq.bots.parsers.abusech.parser_ip module

Parses simple newline separated list of IPs.

Docs:

  - https://feodotracker.abuse.ch/blocklist/

class intelmq.bots.parsers.abusech.parser_ip.AbusechIPParserBot(bot_id: str, start: bool = False, sighup_event=None, disable_multithreading: Optional[bool] = None)

  Bases: `intelmq.lib.bot.ParserBot`

  Parse Abuse.ch IP address feeds

  parse(report: dict)

    A generator yielding the single elements of the data.

    Comments, headers etc. can be processed here. Data needed by self.parse_line can be saved in self.tempdata (list).

    Default parser yields stripped lines. Override for your use or use an existing parser, e.g.:

        parse = ParserBot.parse_csv

    You should do that for recovering lines too.

      recover_line = ParserBot.recover_line_csv

  parse_line(line, report)

    A generator which can yield one or more messages contained in line.

    Report has the full message, thus you can access some metadata. Override for your use.

  recover_line(line)

    Reverse of “parse” for single lines.

    Recovers a fully functional report with only the problematic line by concatenating all strings in “self.tempdata” with “line” with LF newlines. Works fine for most text files.

    lineOptional[str], optional

      The currently process line which should be transferred into it’s original appearance. As fallback, “self._current_line” is used if available (depending on self.parse). The default is None.

    ValueError

      If neither the parameter “line” nor the member “self._current_line” is available.

    str

      The reconstructed raw data.

intelmq.bots.parsers.abusech.parser_ip.BOT

  alias of `intelmq.bots.parsers.abusech.parser_ip.AbusechIPParserBot`

## Module contents