Highlights
- Added new **network** bolt: now it's possible to analyze the sender ip address.
- Updated Apache Storm version (1.1.0).
- Mark mail as phishing only if there are urls.
- Fixed Thug analysis for files in archive.
- Fixed attachments filter function.
:warning: Breaking Changes :warning:
- New flag for attachments: **with_raw_attachments**. If `true` mail has attachments.
If **with_attachments** is `true` the mail has attachments that are not filtered.
:warning: New configuration sections :warning:
- Added two new fields to **tokenizer** bolt, to filter analysis of sender ip address:
+ If True the same ip address is filtered and not analyzed.
+ filter_network: True
+
+ Max number of hashes saved for filter function
+ maxlen_network: 1000000
- New section for **network** bolt:
+ Network bolt configuration
+network:
+ shodan:
+ enabled: False
+ api_key: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+
+ virustotal:
+ enabled: False
+ api_key: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx