From 209024c68c6861815dffd6d6f9fbb89bc77e0df4 Mon Sep 17 00:00:00 2001 From: Tim de Boer Date: Wed, 11 Dec 2024 14:48:54 +0100 Subject: [PATCH] Added support for JSON containing multuple events --- intelmq/bots/parsers/json/parser.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/intelmq/bots/parsers/json/parser.py b/intelmq/bots/parsers/json/parser.py index f66a5a741..d430ec904 100644 --- a/intelmq/bots/parsers/json/parser.py +++ b/intelmq/bots/parsers/json/parser.py @@ -12,15 +12,19 @@ from intelmq.lib.bot import ParserBot from intelmq.lib.message import MessageFactory from intelmq.lib.utils import base64_decode +import json class JSONParserBot(ParserBot): """Parse IntelMQ-JSON data""" splitlines = False + multiple_events = False def process(self): report = self.receive_message() - if self.splitlines: + if self.multiple_events: + lines = [json.dumps(event) for event in json.loads(base64_decode(report['raw']))] + elif self.splitlines: lines = base64_decode(report['raw']).splitlines() else: lines = [base64_decode(report['raw'])]