AbuseHelper 5.7.0

Fixes

• Fix bug in handling idna encoded domain names. Roomgraph with rules like "domain name" in *.example.com crashed if event had idna encoded domain name that didn't cleanly convert to unicode.

AbuseHelper 5.6.0

Features

• Improved the harmonization document:
  • better readability
  • added a new functional type, compromised account
  • added a new threat type, policy violation

Fixes

• Fix IMAPBot to work correcty when UIDs change between sessions.

AbuseHelper 5.5.3

Fixes

• Raise ValueError if RegExp pattern is invalid.

AbuseHelper 5.5.2

Fixes

• Fix CSVReader to work also using Python 2.6.

AbuseHelper 5.5.1

Fixes

• Include status in abuse.ch's Feodo C&C feed.
• GeoIP augmentation: Add coordinates even if one of them is zero.
• Handle malformed input data using replacemode in CSVReader.

AbuseHelper 5.5.0

5.5.0 (2017-08-14)

Features

• Add support for DataPlane's DNS feeds.
• Improve fetch_url():
  • Use ssl.create_defaut_context() when available (Python 2.7.9 or newer). This
    enables SNI support and tries to choose reasonably secure protocol and cipher
    settings.
  • Use Python's builtin functionality for finding and loading system's CA bundle
    when running on modern Python (2.7.9+).
• Improve the description of host-based artifacts in Data Harmonization Ontology.

Fixes

• Fix comparison of Session() objects.
• Fix crash in mailer if connection is lost when sending mail.

Removed

• Remove support for OpenBL feed.

AbuseHelper 5.4.0

Features

• Add support for DataPlane's VNC RFB feed

Fixes

• Use "malware family" when creating description in abuse.ch's feeds

Removed

• Remove support for abuse.ch's Palevo Tracker

AbuseHelper 5.3.1

Fixes

• Update the VXVault feed URL

AbuseHelper 5.3.0

Features

• Add support for DataPlane feeds
• Improve usability by creating required directories automatically (#85)
• Improve robustness and add more human readable error messages (#86)
• Improve the DHO with the "vulnerability" key to help in correlating the vulnerable service reports and "source" to help in better describe aggregated indicators collated by a feeder.

Removed

• Remove support for Dragon Research Group's feeds
• Remove support for AutoShun feed

AbuseHelper 5.2.0

Features

• Add drop_older_than parameter for bots, which can be used to ignore too old events (debd818)