From 217a7ecc7463c16ab542a2cc835f568f631b499c Mon Sep 17 00:00:00 2001
From: Birger Schacht <schacht@cert.at>
Date: Tue, 10 Aug 2021 12:31:45 +0200
Subject: [PATCH 1/2] ECSExpertBot: write some fields to the output field in
 ECS format

---
 intelmq/bots/experts/ecs/expert.py | 37 ++++++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)
 create mode 100644 intelmq/bots/experts/ecs/expert.py

diff --git a/intelmq/bots/experts/ecs/expert.py b/intelmq/bots/experts/ecs/expert.py
new file mode 100644
index 0000000000..e21f76526d
--- /dev/null
+++ b/intelmq/bots/experts/ecs/expert.py
@@ -0,0 +1,37 @@
+# SPDX-FileCopyrightText: 2021 Birger Schacht
+#
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+from intelmq.lib.bot import Bot
+
+
+class ECSExpertBot(Bot):
+    """Write some fields to the output field in ECS format"""
+
+    def process(self):
+        msg = self.receive_message()
+
+        ecs = {}
+
+        # If the event source has no original timestamp, this value is
+        # typically populated by the first time the event was received by the
+        # pipeline.
+        # (https://www.elastic.co/guide/en/ecs/current/ecs-base.html)
+        ecs['@timestamp'] = msg['time.source'] if 'time.source' in msg else msg['time.observation']
+
+        if 'feed.provider' in msg:
+            ecs['event.provider'] = msg['feed.provider']
+        if 'source.ip' in msg:
+            ecs['server.ip'] = msg['source.ip']
+        if 'source.fqdn' in msg:
+            ecs['server.domain'] = msg['source.fqdn']
+        if 'feed.name' in msg:
+            ecs['event.dataset'] = msg['feed.name']
+
+        msg.add("output", str(ecs))
+
+        self.send_message(msg)
+        self.acknowledge_message()
+
+
+BOT = ECSExpertBot

From 9969e8634ebae3eeea4493fe21c98d8c67ba7d9d Mon Sep 17 00:00:00 2001
From: Sebastian Wagner <wagner@cert.at>
Date: Thu, 26 Aug 2021 12:58:06 +0200
Subject: [PATCH 2/2] BUG: ecs expert: fix formatting of output field

output needs to be valid json dict, not python repr
---
 intelmq/bots/experts/ecs/expert.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/intelmq/bots/experts/ecs/expert.py b/intelmq/bots/experts/ecs/expert.py
index e21f76526d..ccaadde200 100644
--- a/intelmq/bots/experts/ecs/expert.py
+++ b/intelmq/bots/experts/ecs/expert.py
@@ -2,6 +2,7 @@
 #
 # SPDX-License-Identifier: AGPL-3.0-or-later
 
+import json
 from intelmq.lib.bot import Bot
 
 
@@ -28,7 +29,7 @@ def process(self):
         if 'feed.name' in msg:
             ecs['event.dataset'] = msg['feed.name']
 
-        msg.add("output", str(ecs))
+        msg.add("output", json.dumps(ecs))
 
         self.send_message(msg)
         self.acknowledge_message()