from intelmq.lib.bot import Bot, sys
from intelmq.lib.utils import decode
from intelmq.lib.event import Event

class DansParserBot(Bot):

    def process(self):
        report = self.receive_message()

        if report:
            for row in report.split('\n'):
                row = row.strip()

                if len(row) == 0 or row.startswith('#'):
                    continue

                row = row.split()
                event = Event()

                columns = ["url"]
                for key, value in zip(columns, row):
                    event.add(key, value)
                    
                event.add('feed', 'DansGuardian')
                event.add('feed_url', "https://lists.malwarepatrol.net/cgi/getfile?product=8&list=dansguardian")
                event.add('type', 'malware')

                self.send_message(event)

        self.acknowledge_message()


if __name__ == "__main__":
    bot = DansParserBot(sys.argv[1])
    bot.start()
from intelmq.lib.bot import Bot, sys
from intelmq.lib.event import Event
from intelmq.bots import utils

class DansParserBot(Bot):

    def process(self):
        report = self.receive_message()

        if report:
            for row in report.split('\n'):
                row = row.strip()

                if len(row) == 0 or row.startswith('#'):
                    continue

                row = row.split()
                event = Event()

                columns = ["source_url"]
                for key, value in zip(columns, row):
                    event.add(key, value)
                    
                event.add('feed', 'malwarepatrol-dansguardian')
                event.add('type', 'malware')
                event = utils.parse_source_time(event, "source_time")
                event = utils.generate_observation_time(event, "observation_time")
                event = utils.generate_reported_fields(event)

                self.send_message(event)
        self.acknowledge_message()


if __name__ == "__main__":
    bot = DansParserBot(sys.argv[1])
    bot.start()

improve malwarepatrol - dansguardian