0.69.0

New Features

Reports via Atom/RSS feeds

The threatfeed now includes reporting via RSS feeds (technically, RFC 4287 Atom feeds) and JSON. Reports are available for weekly, daily, and hourly statistics depending on how frequently you want updates.

Reports include: the number of unique IPs active in the reporting period, how many of those IPs are new, the total number of interactions, the threatfeed size, and the top IPs with the most interactions.

Reporting is experimental and will change. RSS reports are currently tested and designed for Outlook and use HTML that may not look good in other readers. This will improve in future releases.

RSS endpoints

• http://threats.example.com:9000/reports/hourly.xml
• http://threats.example.com:9000/reports/daily.xml
• http://threats.example.com:9000/reports/weekly.xml
• http://threats.example.com:9000/reports/alerts.xml (currently, nothing generates an alert)

JSON endpoints

• http://threats.example.com:9000/reports/hourly.json
• http://threats.example.com:9000/reports/daily.json
• http://threats.example.com:9000/reports/weekly.json
• http://threats.example.com:9000/reports/alerts.json (currently, nothing generates an alert)
• http://threats.example.com:9000/reports/all.json (all of the above, plus your unique identifier for the Atom feeds)

Hourly reporting is generated at the top of every hour. It needs at least 1 full hour before the first hourly report is generated (if you start the server at 9:01 AM, the first hourly report will be available at 11:00 AM. The default time for daily and weekly reports is 9 AM and the default day for weekly reports is Monday. This is all configurable via the XML config file.

Reporting is enabled by default, but the report statistics do not persist by default if you are upgrading from a previous version. If you're upgrading, there's a few options you'll need to add to your configuration file if you want the data to persist across restarts.

Configuration changes

A <reporting> element is added to the <threatFeed> element. Under <reporting>, a <historyPath> element is used to specify the file for persisting report statistics. Here's a full example snippet of all the new options:

<config>
  <threatFeed>
    <reporting>
      <historyPath>/opt/deceptifeed/logs/history.json</historyPath>
      <weekly>
        <day>monday</day>
        <time>8:00</time>
      </weekly>
      <daily>
        <time>8:00</time>
      </daily>
    </reporting>
  </threatFeed>
</config>

Other Changes

• Include <useProxyProtocol> in the default configuration files.
• Include <reporting> in the default configuration files.

Full Changelog: v0.68.0...v0.69.0

Binaries built with Go 1.26.5 using make all from the project root.