Separate output files for inbound and outbound

[krmaxwell]

Possibly controlled via a config option?

[alexcpsec]

I would separate the enrichments by "groups" (for the lack of a better name) in a config file. And the groups would have a list of the sources that would be harvested by them.

And we start these groups out as "inbound" and "outbound".

If too generic (i.e, too much work for now), it is fine. But I think this would give you a lot of flexibility for further research (like a "CnC" group, a "malware download" group, etc, etc).

[krmaxwell]

Ah hah! I gotcha. Need to let this brew in my head for a bit, but I think you're onto something really useful there.

[krmaxwell]

Note that this is not the final implementation but at least we'll get the initial separation.

[alexcpsec]

Maybe we should leave it like this for this milestone and open a new issue that handles the generalization of this functionality.

I would be more then OK with that.

[krmaxwell]

Roger.