{"action":"created","issue":{"url":"https://api.github.com/repos/certtools/intelmq/issues/320","labels_url":"https://api.github.com/repos/certtools/intelmq/issues/320/labels{/name}","comments_url":"https://api.github.com/repos/certtools/intelmq/issues/320/comments","events_url":"https://api.github.com/repos/certtools/intelmq/issues/320/events","html_url":"https://github.com/certtools/intelmq/issues/320","id":106141098,"number":320,"title":"Timefilter bot","user":{"login":"robcza","id":11228982,"avatar_url":"https://avatars.githubusercontent.com/u/11228982?v=3","gravatar_id":"","url":"https://api.github.com/users/robcza","html_url":"https://github.com/robcza","followers_url":"https://api.github.com/users/robcza/followers","following_url":"https://api.github.com/users/robcza/following{/other_user}","gists_url":"https://api.github.com/users/robcza/gists{/gist_id}","starred_url":"https://api.github.com/users/robcza/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/robcza/subscriptions","organizations_url":"https://api.github.com/users/robcza/orgs","repos_url":"https://api.github.com/users/robcza/repos","events_url":"https://api.github.com/users/robcza/events{/privacy}","received_events_url":"https://api.github.com/users/robcza/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/certtools/intelmq/labels/bots","name":"bots","color":"d4c5f9"},{"url":"https://api.github.com/repos/certtools/intelmq/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"open","locked":false,"assignee":{"login":"robcza","id":11228982,"avatar_url":"https://avatars.githubusercontent.com/u/11228982?v=3","gravatar_id":"","url":"https://api.github.com/users/robcza","html_url":"https://github.com/robcza","followers_url":"https://api.github.com/users/robcza/followers","following_url":"https://api.github.com/users/robcza/following{/other_user}","gists_url":"https://api.github.com/users/robcza/gists{/gist_id}","starred_url":"https://api.github.com/users/robcza/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/robcza/subscriptions","organizations_url":"https://api.github.com/users/robcza/orgs","repos_url":"https://api.github.com/users/robcza/repos","events_url":"https://api.github.com/users/robcza/events{/privacy}","received_events_url":"https://api.github.com/users/robcza/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/certtools/intelmq/milestones/2","html_url":"https://github.com/certtools/intelmq/milestones/Release%201","labels_url":"https://api.github.com/repos/certtools/intelmq/milestones/2/labels","id":719078,"number":2,"title":"Release 1","description":"","creator":{"login":"SYNchroACK","id":4184292,"avatar_url":"https://avatars.githubusercontent.com/u/4184292?v=3","gravatar_id":"","url":"https://api.github.com/users/SYNchroACK","html_url":"https://github.com/SYNchroACK","followers_url":"https://api.github.com/users/SYNchroACK/followers","following_url":"https://api.github.com/users/SYNchroACK/following{/other_user}","gists_url":"https://api.github.com/users/SYNchroACK/gists{/gist_id}","starred_url":"https://api.github.com/users/SYNchroACK/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/SYNchroACK/subscriptions","organizations_url":"https://api.github.com/users/SYNchroACK/orgs","repos_url":"https://api.github.com/users/SYNchroACK/repos","events_url":"https://api.github.com/users/SYNchroACK/events{/privacy}","received_events_url":"https://api.github.com/users/SYNchroACK/received_events","type":"User","site_admin":false},"open_issues":31,"closed_issues":150,"state":"open","created_at":"2014-07-12T18:19:52Z","updated_at":"2015-09-13T02:44:26Z","due_on":"2014-08-31T07:00:00Z","closed_at":null},"comments":5,"created_at":"2015-09-12T08:24:08Z","updated_at":"2015-09-13T19:27:41Z","closed_at":null,"body":"Lots of feeds provide historical IoCs and there could be several reasons not to process them. You may want to exclude such obsolete events from the output and it could actually improve the performance a little if it would be possible to exclude those events before passing them to the pipeline of experts, hence the ideal positioning of the bot would be right after the parsers, even before deduplicator.\r\n\r\nMy proposal is to prepare an expert bot with two specific runtime parameters: ```not_before``` and ```not_after``` This should allow even configurations to gather IoCs from specific timeframe.\r\nThe timestamp for the comparison would be just and only ```time.source```\r\n\r\nIt could be completely independent new bot or it could be an extension to the existing filter bot. What do you think?"},"comment":{"url":"https://api.github.com/repos/certtools/intelmq/issues/comments/139910769","html_url":"https://github.com/certtools/intelmq/issues/320#issuecomment-139910769","issue_url":"https://api.github.com/repos/certtools/intelmq/issues/320","id":139910769,"user":{"login":"aaronkaplan","id":750019,"avatar_url":"https://avatars.githubusercontent.com/u/750019?v=3","gravatar_id":"","url":"https://api.github.com/users/aaronkaplan","html_url":"https://github.com/aaronkaplan","followers_url":"https://api.github.com/users/aaronkaplan/followers","following_url":"https://api.github.com/users/aaronkaplan/following{/other_user}","gists_url":"https://api.github.com/users/aaronkaplan/gists{/gist_id}","starred_url":"https://api.github.com/users/aaronkaplan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aaronkaplan/subscriptions","organizations_url":"https://api.github.com/users/aaronkaplan/orgs","repos_url":"https://api.github.com/users/aaronkaplan/repos","events_url":"https://api.github.com/users/aaronkaplan/events{/privacy}","received_events_url":"https://api.github.com/users/aaronkaplan/received_events","type":"User","site_admin":false},"created_at":"2015-09-13T19:27:41Z","updated_at":"2015-09-13T19:27:41Z","body":"\nOn Sep 13, 2015, at 9:25 PM, Sebastian <notifications@github.com> wrote:\n\n> I would implement it with relative times, i.e. timedeltas (module datetime.timedelta). So e.g.:\n> \n> no before: 1 month\n> not after: None (deactivating check, same as empty)\n> \n\nmakes sense to me, good idea!\n\n\n"}}