feeds/arbor_fastflux-domain_reputation.feed
provider "arbor"
name "fastflux_domain_reputation"
fetch_http('http://atlas.arbor.net/summary/domainlist')
event_types [:c2]
feed_re = /^(?<domain>.*)/
filter_whitespace
filter_comments
parse_eachline(:separator => "\n") do |event_generator, record|
m = feed_re.match(record.data)
next if m.nil?
event_generator.call() do |event|
event.type = :c2
event.add_fqdn(m[:domain])
end
end