Properly split ip:port for ipv4 (openioc import)

2017-02-27 18:38:52 +01:00 · 2017-02-27 18:38:52 +01:00 · c348fcc7dc
parent be0c8a1f8c
commit c348fcc7dc
1 changed files with 4 additions and 0 deletions
--- a/pymisp/tools/openioc.py
+++ b/pymisp/tools/openioc.py
@ -147,5 +147,9 @@ def set_all_attributes(openioc, misp_event):
        comment = extract_field(item, 'Comment')
        if comment:
            attribute_values["comment"] = '{} {}'.format(attribute_values["comment"], comment)
+
+        if mapping['type'] in ['ip-src', 'ip-dst'] and value.count(':') == 1:
+            attribute_values['type'] = mapping['type'] + '|port'
+            attribute_values['value'] = attribute_values['value'].replace(':', '|')
        misp_event.add_attribute(**attribute_values)
    return misp_event