MISP
/
mail_to_misp
mirror of https://github.com/MISP/mail_to_misp
2
0
Fork 0
Code Issues Releases Wiki Activity

Quick fix for everything getting classified as external analysis 

With the OR statement everything gets classified as external analysis when not running with --urlsonly.
pull/49/head
eidurorng 2021-01-25 18:03:18 +00:00
parent 3818ac92ea
commit 5ccb365f93
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
mail2misp/mail2misp.py
View File

@ -284,7 +284,7 @@ class Mail2MISP():
to_ids=False, enforceWarninglist=False) to_ids=False, enforceWarninglist=False)
if email_object: if email_object:
email_object.add_reference(attribute.uuid, 'contains') email_object.add_reference(attribute.uuid, 'contains')
elif domainname in self.config.externallist or self.urlsonly is False: # External analysis elif domainname in self.config.externallist and self.urlsonly is False: # External analysis
attribute = self.misp_event.add_attribute('link', entry, category='External analysis', attribute = self.misp_event.add_attribute('link', entry, category='External analysis',
to_ids=False, enforceWarninglist=False) to_ids=False, enforceWarninglist=False)
if email_object: if email_object: