Skip to content

Commit

Permalink
Merge pull request #2460 from certtools/2455-shadowserver-parser-docs…
Browse files Browse the repository at this point in the history
…-missing-part-on-feedname

Documentation update for #2455
  • Loading branch information
sebix committed Feb 6, 2024
2 parents 7085de1 + d8dee57 commit 1b04f3d
Showing 1 changed file with 5 additions and 4 deletions.
9 changes: 5 additions & 4 deletions docs/user/bots.md
Original file line number Diff line number Diff line change
Expand Up @@ -930,8 +930,7 @@ oldest files available!).

The resulting reports contain the following special field:

- `extra.file_name`: The name of the downloaded file, with fixed filename extension. The API returns file names with the
extension `.csv`, although the files are JSON, not CSV. Therefore, for clarity and better error detection in the parser, the file name in `extra.file_name` uses `.json` as extension.
- `extra.file_name`: The name of the downloaded file, with fixed filename extension.

**Module:** `intelmq.bots.collectors.shadowserver.collector_reports_api`

Expand All @@ -951,7 +950,7 @@ The resulting reports contain the following special field:

**`types`**

(optional, string/array of strings) An array of strings (or a list of comma-separated values) with the names of report types you want to process. If you leave this empty, all the available reports will be downloaded and processed (i.e. 'scan', 'drones', 'intel', 'sandbox_connection', 'sinkhole_combined'). The possible report types are equivalent to the file names given in the section Supported Reports of the [Shadowserver parser](#intelmq.bots.parsers.shadowserver.parser).
(optional, string/array of strings) An array of strings (or a list of comma-separated values) with the names of report types you want to process. If you leave this empty, all the available reports will be downloaded and processed (i.e. 'scan', 'drones', 'intel', 'sandbox_connection', 'sinkhole_combined'). The possible report types are equivalent to the file names defined the the schema. Please see the Supported Reports of the [Shadowserver parser](#intelmq.bots.parsers.shadowserver.parser) for details.

**Sample configuration**

Expand Down Expand Up @@ -2154,7 +2153,9 @@ correct mapping of the columns:

**`feedname`**

(optional, string) Name of the Shadowserver report, see list below for possible values.
(optional, string) Name of the Shadowserver report. The value for each report type can be found in the schema `feed_name` field.

For example using `curl -s https://interchange.shadowserver.org/intelmq/v1/schema | jq .[].feed_name`.

**`overwrite`**

Expand Down

0 comments on commit 1b04f3d

Please sign in to comment.