Implementing IEP008 - contituency field

CHANGELOG.md

@@ -21,6 +21,11 @@ Please refer to the [NEWS](NEWS.md) for a list of changes which have an affect o
 
 ### Data Format
 
+- Implementing [IEP008](https://github.com/certtools/ieps/tree/main/008) introducing the `constituency` field for easier identification in
+  multi-constituency setups. (PR# by Kamil Mańkowski)
+  To use in current PostgreSQL installations, a schema update may be
+  necessary: `ALTER TABLE events ADD "constituency" text;`.
+
 ### Bots
 #### Collectors
 

NEWS.md

@@ -18,6 +18,11 @@ Please refer to the change log for a full list of changes.
 ### Tools
 
 ### Data Format
+To save new fields from IntelMQ Data Format in existing PostgreSQL instances, the following schema
+update is necessary:
+```sql
+ALTER TABLE events ADD "constituency" text;
+```
 
 ### Configuration
 

intelmq/etc/harmonization.conf

@@ -17,6 +17,10 @@
             "description": "Free text commentary about the abuse event inserted by an analyst.",
             "type": "String"
         },
+        "constituency": {
+            "description": "Internal identifier for multi-constituency setup",
+            "type": "String"
+        },
         "destination.abuse_contact": {
             "description": "Abuse contact for destination address. A comma separated list.",
             "type": "LowercaseString"

intelmq/lib/upgrades.py

@@ -41,7 +41,8 @@
            'v320_update_turris_greylist_url',
            'v322_url_replacement',
            'v322_removed_feeds_and_bots',
-           'v340_deprecations'
+           'v340_deprecations',
+           'v341_new_fields'
            ]
 
 
@@ -974,6 +975,29 @@ def v340_deprecations(configuration, harmonization, dry_run, **kwargs):
     return message or changed, configuration, harmonization
 
 
+def v341_new_fields(configuration, harmonization, dry_run, **kwargs):
+    """
+    Add new fields to IntelMQ Data Format
+    """
+    changed = None
+    if "event" not in harmonization:
+        return changed, configuration, harmonization
+
+    builtin_harmonisation = load_configuration(
+        resource_filename("intelmq", "etc/harmonization.conf")
+    )
+    for field in [
+        "constituency",
+    ]:
+        if field not in harmonization["event"]:
+            if field not in builtin_harmonisation["event"]:
+                # ensure forward-compatibility if we ever remove something from harmonisation
+                continue
+            harmonization["event"][field] = builtin_harmonisation["event"][field]
+            changed = True
+    return changed, configuration, harmonization
+
+
 UPGRADES = OrderedDict([
     ((1, 0, 0, 'dev7'), (v100_dev7_modify_syntax,)),
     ((1, 1, 0), (v110_shadowserver_feednames, v110_deprecations)),
@@ -1004,7 +1028,7 @@ def v340_deprecations(configuration, harmonization, dry_run, **kwargs):
     ((3, 3, 0), ()),
     ((3, 3, 1), ()),
     ((3, 4, 0), (v340_deprecations, )),
-    ((3, 4, 1), ()),
+    ((3, 4, 1), (v341_new_fields, )),
 ])
 
 ALWAYS = (harmonization,)

intelmq/tests/bin/initdb.sql

@@ -4,6 +4,7 @@ CREATE TABLE events (
     "classification.taxonomy" varchar(100),
     "classification.type" text,
     "comment" text,
+    "constituency" text,
     "destination.abuse_contact" text,
     "destination.account" text,
     "destination.allocated" timestamp with time zone,

intelmq/tests/lib/test_upgrades.py

@@ -856,6 +856,12 @@ def test_v340_twitter_collector(self):
         self.assertIn('twitter-collector', result[0])
         self.assertEqual(V340_TWITTER_COLLECTOR_IN, result[1])
 
+    def test_v341_new_fields(self):
+        """ Test adding new harmonisation fields """
+        result = upgrades.v341_new_fields({}, {"event": {"old-field": "must stay"}}, False)
+        self.assertTrue(result[0])
+        self.assertIn("old-field", result[2]["event"])
+        self.assertIn("constituency", result[2]["event"])
 
 for name in upgrades.__all__:
     setattr(TestUpgradeLib, 'test_function_%s' % name,