mlsecproject/combine — pull request #86 by gbrindisi (2014-10-19 10:39:35+00:00)
Title: Labeled feeds

Hi!
I've managed to tidy up the code a bit.

I'm aware that the dot-based nomenclature I've chosen is not so pretty but I still find useful the overall functionality. Anyhow check it out and let me know if you would like something different.

The config I've used is the following:
```
[feeds.outbound]
#malwaregroup = http://www.malwaregroup.com/ipaddresses
#malc0de = http://malc0de.com/bl/IP_Blacklist.txt
#zeustracker = https://zeustracker.abuse.ch/blocklist.php?download=ipblocklist
#spyeyetracker = https://spyeyetracker.abuse.ch/blocklist.php?download=ipblocklist
#palevotracker = https://palevotracker.abuse.ch/blocklists.#php?download=ipblocklist
alienvault = http://reputation.alienvault.com/reputation.data
#nothink-malware-dns = http://www.nothink.org/blacklist/blacklist_malware_dns.txt
#nothink-malware-http = http://www.nothink.org/blacklist/blacklist_malware_http.txt
#nothink-malware-irc = http://www.nothink.org/blacklist/blacklist_malware_irc.txt

[feeds.inbound]
#projecthoneypot = http://www.projecthoneypot.org/list_of_ips.php?rss=1
#openbl = http://www.openbl.org/lists/base_30days.txt
#blocklist-ssh = http://www.blocklist.de/lists/ssh.txt
#blocklist-apache = http://www.blocklist.de/lists/apache.txt
#blocklist-asterisk = http://www.blocklist.de/lists/asterisk.txt
#blocklist-bots = http://www.blocklist.de/lists/bots.txt
#blocklist-courierimap = http://www.blocklist.de/lists/courierimap.txt
#blocklist-courierpop3 = http://www.blocklist.de/lists/courierpop3.txt
#blocklist-email = http://www.blocklist.de/lists/email.txt
#blocklist-ftp = http://www.blocklist.de/lists/ftp.txt
#blocklist-imap = http://www.blocklist.de/lists/imap.txt
#blocklist-ircbot = http://www.blocklist.de/lists/ircbot.txt
#blocklist-pop3 = http://www.blocklist.de/lists/pop3.txt
#blocklist-postfix = http://www.blocklist.de/lists/postfix.txt
#blocklist-proftpd = http://www.blocklist.de/lists/proftpd.txt
#blocklist-sip = http://www.blocklist.de/lists/sip.txt
#ciarmy = http://www.ciarmy.com/list/ci-badguys.txt
alienvault-inbound = http://reputation.alienvault.com/reputation.data
#drg-ssh = http://dragonresearchgroup.org/insight/sshpwauth.txt
#drg-vnc = http://dragonresearchgroup.org/insight/vncprobe.txt
#rulez = http://danger.rulez.sk/projects/bruteforceblocker/blist.php
#sans = https://isc.sans.edu/ipsascii.html
#nothink-ssh = http://www.nothink.org/blacklist/blacklist_ssh_day.txt
#packetmail = https://www.packetmail.net/iprep.txt
#autoshun = http://www.autoshun.org/files/shunlist.csv
#haleys = http://charles.the-haleys.org/ssh_dico_attack_hdeny_format.#php/hostsdeny#.txt
#virbl = http://virbl.org/download/virbl.dnsbl.bit.nl.txt
#botscout = http://botscout.com/last_caught_cache.htm

[feeds.parsers]
alienvault = process_alienvault
alienvault-inbound = process_alienvault
projecthoneypot = process_project_honeypot
rulez = process_rulez
sans = process_sans
packetmail = process_packetmail
autoshun = process_autoshun
haleys = process_haleys
drg-ssh = process_drg
drg-vnc = process_drg
malwaregroup = process_malwaregroup
```