intelmq.bots.experts.rfc1918 package — intelmq 3.0.0.alpha.1 documentation

# intelmq.bots.experts.rfc1918 package

## Submodules

## intelmq.bots.experts.rfc1918.expert module

RFC 1918 Will Drop Local IP from a given record and a bit more.

  It checks for RFC1918 IPv4 Hosts It checks for localhost, multicast and test LANs It checks for Link Local and Documentation LAN in IPv6 It checks for RFC538 ASNs

Need only to feed the parameter “fields” to set the name of the field parameter designed to be filtered out. Several parameters could be used, separated by “,” It could sanitize the whole records with the “drop” parameter set to “yes”

Sources: https://tools.ietf.org/html/rfc1918 https://tools.ietf.org/html/rfc2606 https://tools.ietf.org/html/rfc3849 https://tools.ietf.org/html/rfc4291 https://tools.ietf.org/html/rfc5737 https://en.wikipedia.org/wiki/IPv4 https://en.wikipedia.org/wiki/Autonomous_system_(Internet)

`intelmq.bots.experts.rfc1918.expert.` `BOT`

  alias of `intelmq.bots.experts.rfc1918.expert.RFC1918ExpertBot`

class `intelmq.bots.experts.rfc1918.expert.` `RFC1918ExpertBot`(bot_id: str, start: bool = False, sighup_event=None, disable_multithreading: Optional[bool] = None)

  Bases: `intelmq.lib.bot.Bot`

  Removes fields or discard events if an IP address or domain is invalid as defined in standards like RFC 1918 (invalid, local, reserved, documentation). IP address, FQDN and URL fields are supported

  static `check`(parameters)

    The bot’s own check function can perform individual checks on it’s parameters. init() is not called before, this is a staticmethod which does not require class initialization.

    Parameters

      parameters – Bot’s parameters, defaults and runtime merged together

    Returns

      None or a list of [log_level, log_message] pairs, both

        strings. log_level must be a valid log level.

    Return type

      output

  `fields`: str = 'destination.ip,source.ip,source.url'
  `init`()
  `is_in_domains`(value)
  `is_in_net`(ip)
  `is_subdomain`(value)
  `policy`: str = 'del,drop,drop'
  `process`()

## Module contents