Skip to content

Commit

Permalink
DOC: changelog entry and bot doc enh for PR#1967
Browse files Browse the repository at this point in the history
  • Loading branch information
Sebastian Wagner committed Aug 6, 2021
1 parent 9f7ceea commit fc3abe4
Show file tree
Hide file tree
Showing 2 changed files with 16 additions and 12 deletions.
1 change: 1 addition & 0 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,7 @@ CHANGELOG
#### Parsers

#### Experts
- `intelmq.bots.experts.truncate_by_delimiter.expert`: Cut string if its length is higher than a maximum length (PR#1967 by Marius Karotkis).

#### Outputs
- `intelmq.bots.outputs.mcafee.output_esm_ip`: Fix access to parameters, the bot wrongly used `self.parameters` (by Sebastian Wagner).
Expand Down
27 changes: 15 additions & 12 deletions docs/user/bots.rst
Original file line number Diff line number Diff line change
Expand Up @@ -3266,33 +3266,36 @@ For both fields *ip* and *domain*, the *destinations* objects are iterated and i
The IntelMQ fields used by this bot may change in the next IntelMQ release, as soon as better suited fields are available.
.. _intelmq.bots.experts.url2fqdn.expert:
.. _intelmq.bots.experts.truncate_by_delimiter.expert:
Truncate By Delimiter
^^^^^^^^^
^^^^^^^^^^^^^^^^^^^^^
**Information**
* `name:` `intelmq.bots.experts.truncate_by_delimiter.expert`
* `lookup:` no
* `public:` yes
* `cache (redis db):` none
* `description:` Cut string if length is bigger than max
* `description:` Cut string if length is bigger than maximum length
**Configuration Parameters**
* `delimiter`: example . or ;
* `max_length`: max string length
* `field`: string field
* `delimiter`: The delimiter to be used for truncating, for example ``.`` or ``;``
* `max_length`: The maximum string length.
* `field`: The field to be truncated, e.g. ``source.fqdn``
Example: Cut through a long domain with a dot. Truncated until the domain not exceeds the maximum length.
The given field is truncated step-by-step using the delimiter from the beginning, until the field is shorter than `max_length`.
input domain = www.subdomain.web.secondsubomain.test.domain.com
delimiter = '.'
max_length = 20
results = test.domain.com
Example: Cut through a long domain with a dot. The string is truncated until the domain does not exceed the configured maximum length.
.. _intelmq.bots.experts.truncate_by_delimiter.expert:
- input domain (e.g. ``source.fqdn``): ``www.subdomain.web.secondsubomain.test.domain.com``
- delimiter: ``.``
- ``max_length``: 20
- Resulting value ``test.domain.com`` (length: 15 characters)
.. _intelmq.bots.experts.url2fqdn.expert:
Url2FQDN
^^^^^^^^
Expand Down

0 comments on commit fc3abe4

Please sign in to comment.