shadowbq/threatinator

provider "bambenek"
name "c2_masterlist_ip"
fetch_http('http://osint.bambenekconsulting.com/feeds/c2-ipmasterlist.txt')
event_types [:c2]

filter do |record|
  record.data[:ip].start_with?("#")
end

parse_csv(:headers => [:ip, :description, :date, :moreinfo]) do |event_generator, record|
  event_generator.call do |event|
    event.type = :c2
    event.add_ipv4(record.data[:ip]) do |ipv4_event|
    end
  end
end