certtools / ieps Goto Github PK
View Code? Open in Web Editor NEWIntelMQ Enhancement Proposals
IntelMQ Enhancement Proposals
As a follow-up to the discussion in the hackathon, we need to define the format of the "format" field.
We have several related fields:
One suggestion in the hackathon was that the type should be a child of the format field. So I start the discussion with two proposals:
A:
{
"format": "intelmq",
"version": 1,
"type": "event",
...
}
B:
{
"format": {
"name": "intelmq"
"version": 1,
"type": "event"
},
...
}
Valid values for the type
field are event
and report
. Also replaces the __type
field which we currently have in the payload.
https://github.com/certtools/intelmq/tree/schacht/http-mixin does not work anymore
Not sure I fully understand the document and proposed format.
The UUID mentioned is the UUID of the IntelMQ instance or a unique UUID per message?
I would recommend to have a unique UUID per IntelMQ instance.
@aaronkaplan please write a new IEP on the protocol extension mechanism.
I think the IEP03 is very well written, thank you a lot for this! Thinking this through was important and I think Sebastian Waldbauer did a great job.
Reading it, I realised that my initial proposal of having multiple values is really breaking the KISS principle of IntelMQ in a bad way. Worse than I had thought. So, I am thinking of retracting the proposal.
However, .... https://github.com/certtools/ieps/tree/main/003#alternatives has a good core in it.
If we have multiple values, instead of doing the n x m complexity explosion, we link different events (JSON rows) together via UUIDs this gives us what we need:
I would like to add one little but important thing for the UUID linking idea: add a "link-type".
Examples for link-types:
With this triplet information , we are close to RDF (left-side, type, right-side) and thus we can (future-proof) represent any type of relation.
A list of valid types needs to be documented in the IDF format page of course.
So, I think with that, we can go ahead.
Thanks,
a.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.