{"action":"opened","issue":{"url":"https://api.github.com/repos/certtools/intelmq/issues/738","repository_url":"https://api.github.com/repos/certtools/intelmq","labels_url":"https://api.github.com/repos/certtools/intelmq/issues/738/labels{/name}","comments_url":"https://api.github.com/repos/certtools/intelmq/issues/738/comments","events_url":"https://api.github.com/repos/certtools/intelmq/issues/738/events","html_url":"https://github.com/certtools/intelmq/issues/738","id":182561109,"number":738,"title":"n6stomp parser classification","user":{"login":"sykaeh","id":2568336,"avatar_url":"https://avatars.githubusercontent.com/u/2568336?v=3","gravatar_id":"","url":"https://api.github.com/users/sykaeh","html_url":"https://github.com/sykaeh","followers_url":"https://api.github.com/users/sykaeh/followers","following_url":"https://api.github.com/users/sykaeh/following{/other_user}","gists_url":"https://api.github.com/users/sykaeh/gists{/gist_id}","starred_url":"https://api.github.com/users/sykaeh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sykaeh/subscriptions","organizations_url":"https://api.github.com/users/sykaeh/orgs","repos_url":"https://api.github.com/users/sykaeh/repos","events_url":"https://api.github.com/users/sykaeh/events{/privacy}","received_events_url":"https://api.github.com/users/sykaeh/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-10-12T15:44:51Z","updated_at":"2016-10-12T15:44:51Z","closed_at":null,"body":"While trying to create a parser for the n6 HTTP report, I was looking at the n6stomp parser. I thought that I would be able to re-use much of the parser since the format looks to be the same (although I don't know if/where there is any documentation available).\r\n\r\nHowever, the classification seems to introduce a couple of new `classification.type` that are not defined in the [Data-Harmonization](https://github.com/certtools/intelmq/blob/master/docs/Data-Harmonization.md):\r\n* account numbers\r\n* leak\r\n* proxy\r\n* tor\r\n* ignore\r\n* other\r\n\r\nMy understanding was that the Data-Harmonization was an exhaustive list of all possible values for `classification.type`. Is that not correct? \r\n\r\nAccording to Harmonization-fields.md:\r\n> Furthermore, the value data set should be kept as minimal as possible to avoid “type explosion”, which in turn dilutes the business value of the dynamic typing. \r\n\r\nSo, if the Data-Harmonization is not a complete list, can we have a complete list somewhere?"}}
{"actor":{"display_login":"sykaeh"}}