Procmail config:
Standard email list extraction:
:0cr
- ^To.somelist@somewhere.com. | /usr/local/bin/python /home/pierre/es_email_intel/mail_parser2json.py
Shoot a mail back to the originator with the extracted IOCs:
:0cr
- ^To.extract@userid.org. | /usr/local/bin/python /home/pierre/es_email_intel/mail_parser2json.py 1
Crontab entries:
00 04 * * * /bin/sh /home/pierre/es_email_intel/es_feeder.sh 30 06 * * * /usr/local/bin/python /home/pierre/es_email_intel/es_query_ipv4_outhtml_outmail.py 35 06 * * * /usr/local/bin/python /home/pierre/es_email_intel/es_query_domain_outhtml_outmail.py 40 06 * * * /usr/local/bin/python /home/pierre/es_email_intel/es_query_md5_outhtml_outmail.py
Not included, the feeder script, but it's invoked like this:
/usr/local/bin/python /home/pierre/es_email_intel/es_query_ipv4_feed.py > /tmp/es_ipv4feed.txt
==
You'll obviously need to setup your own ElasticSearch box. I also backend to some external boxes for things, you'll need to fix or replace those entries.