search

mlsecproject / combine

Tool to gather Threat Intelligence indicators from publicly available sources
https://www.mlsecproject.org/
GNU General Public License v3.0
652 stars 179 forks source link

new idea for data transfer / feed metadata #110

Closed paulpc closed 9 years ago

paulpc commented 9 years ago

This should work partially with the feeds I have in there. There is still quite a bit of messy code, so, obviously it's not ready for the prime time yet, but it's the accumulation of a few ideas discussed on the slack.com site.

I'll try to comment the code some more when I get some time in the next week or so

krmaxwell commented 9 years ago

I pulled this into the paulpc-data branch and fixed some merge conflicts, but please rebase when you get a chance.

Also: is there any way we can avoid the from parsers import *? I realize you specified __all__ in __init__.py but I feel like we should avoid that for the purposes of readability and maintainability.

paulpc commented 9 years ago

But that will take away from the cool factor and simplicity of adding parsers. Currently all it takes is a the python file and an entry in the config file - no additional code changes in the main files. I'll figure something out. On Jan 8, 2015 5:56 PM, "Kyle Maxwell" notifications@github.com wrote:

I pulled this into the paulpc-data branch and fixed some merge conflicts, but please rebase when you get a chance.

Also: is there any way we can avoid the from parsers import *? I realize you specified all in init.py but I feel like we should avoid that for the purposes of readability and maintainability.

— Reply to this email directly or view it on GitHub https://github.com/mlsecproject/combine/pull/110#issuecomment-69272311.

krmaxwell commented 9 years ago

I get what you're saying and that's attractive. But it feels very un-Pythonic to me. Curious what others think, of course. :)

paulpc commented 9 years ago

I need to go see how mgoffin did it in CRITs - i thought that was pretty elegant

alexcpsec commented 9 years ago

This is deprecated by #121. Thanks a lot for giving it a go @paulpc, and we really welcome your suggestions for what else we need there to get it good for v0.2.0