def provider_contact_directive(notification_format="avalanche",
data_format="avalanche_csv_inline", interval=0):
# Some maybe reasonable defaults
# Interval: for testing 0 = immediately is a good choice.
# In production, daily = 86400 will be better.
return Directive(template_name="avalanche_provider.txt",
notification_format=notification_format,
event_data_format=data_format,
notification_interval=interval)
def create_directive(notification_format, target_group, interval, data_format):
"""
This method is NOT designed, to be compatible with the existing configuration
of mailgen. You MUST can adapt Mailgen-config in order to be capable
of processing this directive.
it creates Directives looking like:
template_name: malware-infection_provider
notification_format: malware-infection
notification_interval: 86400
data_format: malware_csv_inline
"""
return Directive(template_name=notification_format + "_" + target_group,
notification_format=notification_format,
event_data_format=data_format,
notification_interval=interval)
def shadowserver_csv_entry(basename):
return Directive(template_name="shadowserver_csv_" + basename,
notification_format="shadowserver",
event_data_format="csv_" + basename,
notification_interval=86400)
"""Sample notification rules for Organisation Annotations.
If an Organisation carries the tag "xarf" all a
directive is created for all contacts associated to this organisation
which states the explicit wish to notify the contact in x-arf format.
"""
from intelmq_certbund_contact.rulesupport import Directive
# default X-ARF settings
xarf_settings = Directive(template_name="generic-xarf-description.txt",
notification_format="xarf",
event_data_format="bot-infection_0.2.0_unstable",
notification_interval=0)
def determine_directives(context):
if context.section == "destination":
return
directive_set = False
for org in context.organisations:
if any(annotation.tag == "xarf" for annotation in org.annotations):
context.logger.debug("Create X-ARF Directive")
context.logger.debug(org.contacts)
for contact in org.contacts:
directive = Directive.from_contact(contact)
directive.update(xarf_settings)
context.add_directive(directive)
directive_set = True