CIRCL
/
lookyloo
mirror of https://github.com/CIRCL/lookyloo
2
0
Fork 0
Code Issues Releases Wiki Activity

fix: Add first_seen to screenshot and lookyloo URL

pull/993/head
Raphaël Vinot 2024-11-13 12:06:54 +01:00
parent 3bd8556ecb
commit ab6598931d
2 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
lookyloo/lookyloo.py
View File

@ -1182,6 +1182,7 @@ class Lookyloo():
screenshot: MISPAttribute = event.add_attribute('attachment', 'screenshot_landing_page.png', screenshot: MISPAttribute = event.add_attribute('attachment', 'screenshot_landing_page.png',
data=self.get_screenshot(cache.uuid), data=self.get_screenshot(cache.uuid),
disable_correlation=True) # type: ignore[assignment] disable_correlation=True) # type: ignore[assignment]
screenshot.first_seen = cache.timestamp
# If the last object attached to tht event is a file, it is the rendered page # If the last object attached to tht event is a file, it is the rendered page
if event.objects and event.objects[-1].name == 'file': if event.objects and event.objects[-1].name == 'file':
event.objects[-1].add_reference(screenshot, 'rendered-as', 'Screenshot of the page') event.objects[-1].add_reference(screenshot, 'rendered-as', 'Screenshot of the page')

1
lookyloo/modules/misp.py
View File

@ -107,6 +107,7 @@ class MISPs(Mapping, AbstractModule): # type: ignore[type-arg]
lookyloo_link: MISPAttribute = event.add_attribute('link', f'https://{public_domain}/tree/{cache.uuid}') # type: ignore[assignment] lookyloo_link: MISPAttribute = event.add_attribute('link', f'https://{public_domain}/tree/{cache.uuid}') # type: ignore[assignment]
if not is_public_instance: if not is_public_instance:
lookyloo_link.distribution = 0 lookyloo_link.distribution = 0
lookyloo_link.first_seen = cache.timestamp
initial_obj.add_reference(lookyloo_link, 'captured-by', 'Capture on lookyloo') initial_obj.add_reference(lookyloo_link, 'captured-by', 'Capture on lookyloo')
redirects: list[URLObject] = [] redirects: list[URLObject] = []