Threat Intel Feed Error Handling

[lisaSW]

Summary

Current parsing of threat intel sources can result in fatal errors that break the import process.

Requirements

Errors should be descriptive non-fatal warnings that do not interfere with the import process.

Acceptance Criteria

Custom File Feeds

The following situations should produce non-fatal warning messages:

• Invalid directory (i.e. nonexistent, empty, regular file)
• All non-text files
• Read errors per-file
• File previously added to database that becomes unreadable

Online Feeds

The following situations should produce non-fatal warning messages:

• Online feed resource references unreachable host
• Feed references nonexistent host
• Resources already exist in database

The following situation should be non-fatal and not produce warning messages:

• Resource returns garbage (invalid IP address or domain)