diff --git a/pymisp/tools/openioc.py b/pymisp/tools/openioc.py index 6251b48..9d337b1 100755 --- a/pymisp/tools/openioc.py +++ b/pymisp/tools/openioc.py @@ -100,7 +100,7 @@ iocMispMapping = { 'RouteEntryItem/Destination': {'type': 'ip-dst'}, 'RouteEntryItem/Destination/IP': {'type': 'ip-dst', 'comment': 'RouteDestination. '}, - 'RouteEntryItem/Destination/string': {'type': 'url', 'comment': 'RouteDestination. '}, + 'RouteEntryItem/Destination/string': {'type': 'hostname', 'comment': 'RouteDestination. '}, 'ServiceItem/name': {'type': 'windows-service-name'}, @@ -218,7 +218,12 @@ def set_values(value1, value2=None): compositeMapping = '{}|{}'.format(value1.find('context')['search'], value2.find('context')['search']) mapping = get_mapping(compositeMapping, mappingDict=iocMispCompositeMapping) else: - mapping = get_mapping(value1.find('context')['search']) + context_search = value1.find('context')['search'] + content_type = value1.find('content').get('type', None) + if "RouteEntryItem/Destination" in context_search and content_type: + mapping = get_mapping(context_search + '/' + content_type) + else: + mapping = get_mapping(context_search) if mapping: attribute_values.update(mapping)