feeds/cruzit-ip_reputation.feed
provider "cruzit"
name "ip_reputation"
fetch_http('http://www.cruzit.com/xwbl2txt.php')
event_types [:scanning]
feed_re = /^(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})/
filter_whitespace
filter_comments
# Filter out IPv6 addresses
filter do |record|
(record.data =~ /\:/)
end
# Filter out first line
filter do |record|
(record.data =~ /^ipaddress$/)
end
parse_eachline(:separator => "\n") do |event_generator, record|
m = feed_re.match(record.data)
next if m.nil?
event_generator.call() do |event|
event.type = :scanning
event.add_ipv4(m[:ip]) do |ipv4_event|
end
end
end