EventDB — intelmq 3.0.0.alpha.1 documentation

# EventDB

The EventDB is not a software itself.

The EventDB is a database (usually PostgreSQL) that gets filled with with data from intelmq using the SQL Output bot.

## EventDB Utilities

Some scripts related to the eventdb are located in the contrib/eventdb folder in the IntelMQ git repository.

### Apply Malware Name Mapping

The apply_mapping_eventdb.py script applies the malware name mapping to the eventdb. Source and destination columns can be given, also a local file. If no local file is present, the mapping can be downloaded on demand. It queries the database for all distinct malware names with the taxonomy “malicious-code” and sets another column to the malware family name.

### Apply Domain Suffix

The apply_domain_suffix.py script writes the public domain suffix to the source.domain_suffix / destination.domain_suffix columns, extracted from source.fqdn / destination.fqdn.

#### Usage

The Python scripts can connect to a PostgreSQL server with an eventdb database and an events table. The command line arguments interface for both scripts are the same. See –help for more information:

    apply_mapping_eventdb.py -h
    apply_domain_suffix.py -h

### PostgreSQL trigger

PostgreSQL trigger is a trigger keeping track of the oldest inserted/updated “time.source” data. This can be useful to (re-)generate statistics or aggregation data.

The SQL script can be executed in the database directly.

## EventDB Statistics

The EventDB provides a great base for statistical analysis of the data.

The eventdb-stats repository contains a Python script that generates an HTML file and includes the Plotly JavaScript Open Source Graphing Library. By modifying the configuration file it is possible to configure various queries that are then displayed using graphs:

## Using EventDB with Timescale DB

TBD