airbnb / streamalert / 3735

95%

push

travis-ci

 filter out some indicator types from threatstream ingest (#684)

* rework the threatstream query to utilize "advanced" query language

   * leverage "advanced" query language to filter the following itypes:
     - bot_ip
     - brute_ip
     - scan_ip
     - spam_ip
     - tor_ip

   * leverage "advanced" query language to restrict indicators returned to:
     - md5
     - domain
     - ip

   * remove client side filtering of indicators, as this is done by TS now

3 of 3 new or added lines in 1 file covered. (100.0%)

3295 of 3436 relevant lines covered (95.9%)

0.96 hits per line