New in XARF Version 2: Internal Processing
March 2021: Starting with version 2 XARF allows including information that helps with processing when you use it for internal reporting. You can, for example, include information about the subscriber and contract, or add tags. The following is an example of the new structure:
You can view a complete and valid example here: https://github.com/abusix/xarf/blob/master/samples/positive/2/openservice_sample_optional_api_info.json
Internal Processing is completely optional and only needed for use cases where you already know certain information at the point where you are creating the report. This simplifies internal processes because you don’t need to perform additional lookup steps later on.
Automatic Parsing and Resolving in AbuseHQ
If you are using AbuseHQ you can immediately leverage the new XARF version for internal reporting. If you include a subscriber id and potentially some more data about subscriber and contract, then you don’t have to perform additional resolving in the Inbound Processing part of AbuseHQ anymore.
There are only two requisites needed for that:
- You need to send XARF reports as explained above. They need to include at least a subscriber id. You can send them via API as explained here or via email as explained here.
- In your inbound processing configuration, you need to add a filter to check whether that id has already been set and avoid any other resolver components, because otherwise the information would be overwritten.
To setup inbound processing correctly create a new filter component first:
Then attach this component before any resolvers and make sure that the green/positive output doesn’t route through any resolvers. This is a simplified example:
Don’t forget to save the configuration and take it live. From now on all your XARF reports that contain subscriber (and contract) information won’t need to be resolved during inbound processing anymore. As you can see here, the subscriber information is added to the subscriber and case in AbuseHQ:
