https://cybertoolchain.io/tools/intelmq New releases and features in IntelMQ, tracked by The Cyber Toolchain. en Sat, 01 Nov 2025 08:11:09 GMT https://github.com/certtools/intelmq/releases/tag/3.5.0 https://github.com/certtools/intelmq/releases/tag/3.5.0 Sat, 01 Nov 2025 08:11:09 GMT IntelMQ 3.5.0 adds product/vulnerability fields, Shodan Alert collector, MySQL output, GPG decryption and new bot params • Adds `intelmq.bots.outputs.sql.output` support for MySQL databases in addition to PostgreSQL. • Introduces `intelmq.bots.collectors.shodan.collector_alert` to query the Shodan Alert API directly. • Extends `intelmq.bots.collectors.mail.collector_mail_attach` with GPG attachment decryption capability. • Adds new message fields `product.full_name`, `product.name`, `product.vendor`, `product.version`, and `product.vulnerabilities` to identify products and vulnerabilities in data events. • Introduces the `constituency` field in the IntelMQ Data Format for easier identification in multi-constituency setups. • Adds `severity` field to help with triaging received events, supporting enum values: critical, high, medium, low, info, undefined. • New parameter `stop_retry_limit` added to gracefully handle stopping bots which take longer to shutdown. • Adds `additional_grouping_keys`, `templating`, `allowed_fieldnames`, and `fieldnames_translation` parameters to `intelmq.bots.outputs.smtp_batch.output` for enhanced email batching. • `intelmq.lib.mixins.cache.CacheMixin` extended to support temporary storing messages in a cache queue. • Introduces new mode `random_single_value` to `intelmq.bots.experts.fake.expert`. Breaking changes: • Drops support for Python 3.8; Python >=3.9 is now required. • Removes `intelmq.bots.collectors.blueliv` collector as it uses an unmaintained library. • Removes `intelmq.bots.parsers.blueliv` parser as it is obsolete with the removed collector. • The `intelmq.bin.rewrite_config_files` tool has been removed; obsolete JSON configuration file rewriting is no longer supported. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/intelmq https://github.com/certtools/intelmq/releases/tag/3.4.0 https://github.com/certtools/intelmq/releases/tag/3.4.0 Fri, 14 Mar 2025 16:44:45 GMT IntelMQ 3.4.0 adds securitytxt and fake experts, renames Twitter parser, supports Ubuntu 24.04 • Adds `intelmq.bots.experts.securitytxt` expert bot for processing security.txt files • Adds `intelmq.bots.experts.fake.expert` bot to generate fake data for testing • Renamed Twitter parser to IoC Extractor Parser (`intelmq.bots.parsers.ioc_extractor`) with backwards-compatible stub at `intelmq.bots.parsers.twitter` • Adds Ubuntu 24.04 package support Breaking changes: • Drops compatibility with Python versions older than 3.8 Full history on Cyber Toolchain: https://cybertoolchain.io/tools/intelmq https://github.com/certtools/intelmq/releases/tag/3.3.1 https://github.com/certtools/intelmq/releases/tag/3.3.1 Tue, 03 Sep 2024 10:26:08 GMT IntelMQ 3.3.1 adds Shodan alert stream support, per-bot field copying, and Sieve variable handling • Adds `alert` parameter to Shodan stream collector (`intelmq.bots.collectors.shodan.collector_stream`) to fetch streams by configured alert ID • Adds `copy_collector_provided_fields` parameter to all parsers for copying additional fields from the report (e.g. `extra.file_name`) • Adds support for variables in Sieve scripts within `intelmq.bots.experts.sieve.expert` Breaking changes: • The deprecated parameter `attach_unzip` is removed from the default parameters of `intelmq.bots.collectors.mail._lib` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/intelmq https://github.com/certtools/intelmq/releases/tag/3.2.0 https://github.com/certtools/intelmq/releases/tag/3.2.0 Tue, 18 Jul 2023 20:55:04 GMT IntelMQ 3.2.0 introduces SMTP batch output, IEP007 library usage, new sieve keywords, and rsync collector improvements. • Adds `smtp_batch` bot for gathering events and sending them as CSV email attachments • Implements IEP007 allowing IntelMQ bots to run as a Python library • Adds `:before` and `:after` keywords to sieve expert rules • Adds optional private key, relative time parsing, extra rsync parameters, and strict host key checking to rsync collector • Adds `-o` parameter to `intelmq_psql_initdb` to set output file destination • Adds `fail_on_errors` parameter to SQL output bot • Adds `TimeFormat` class for the `time_format` bot parameter in CSV and HTML table parsers Full history on Cyber Toolchain: https://cybertoolchain.io/tools/intelmq https://github.com/certtools/intelmq/releases/tag/3.1.0 https://github.com/certtools/intelmq/releases/tag/3.1.0 Fri, 10 Feb 2023 16:43:02 GMT IntelMQ 3.1.0 adds ExpertBots, Shadowserver protocol support, MSSQL connectivity, and Shodan report fields. • `intelmq.bots.experts.domain_valid` - New ExpertBot for domain validity checks • `intelmq.bots.experts.truncate_by_delimiter` - New ExpertBot to truncate strings by a delimiter • `intelmq.bots.parsers.shadowserver._config` adds support for `Accessible AMQP`, `Device Identification Report`, `Malware-URL`, `Sandbox-Connection`, `Sandbox-DNS`, and more Shadowserver protocols • Introduces the `ExpertBot` base class, replacing manual inheritance in expert bots • `intelmq.lib.datatypes` module adds `LogLevel` and `ReturnType` Enums Breaking changes: • Dropped Python 3.6 support; IntelMQ now requires a newer Python version • Shadowserver field names updated: `scan_rsync:extra.password` renamed to `extra.has_password` • Shadowserver report field types standardized across reports (e.g., `extra.status` is now an integer via `convert_int`) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/intelmq