MISP
/
mail_to_misp
mirror of https://github.com/MISP/mail_to_misp
2
0
Fork 0
Code Issues Releases Wiki Activity

new: Allow to disable DNS lookups 

Fix #26
pull/31/head
Raphaël Vinot 2018-08-02 11:55:37 +02:00
parent c823e5496c
commit cbf0c07b67
1 changed files with 14 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
mail2misp/mail2misp.py
View File

@ -14,7 +14,11 @@ from pyfaup.faup import Faup
from pymisp import PyMISP, MISPEvent, MISPObject, MISPSighting
from pymisp.tools import EMailObject, make_binary_objects
from defang import refang
import dns.resolver
try:
import dns.resolver
HAS_DNS = True
except ImportError:
HAS_DNS = False
def is_ip(address):
@ -299,15 +303,16 @@ class Mail2MISP():
email_object.add_reference(attribute.uuid, 'contains')
else:
related_ips = []
try:
syslog.syslog(hostname)
for rdata in dns.resolver.query(hostname, 'A'):
if HAS_DNS and self.config.enable_dns:
try:
syslog.syslog(hostname)
for rdata in dns.resolver.query(hostname, 'A'):
if self.debug:
syslog.syslog(str(rdata))
related_ips.append(rdata.to_text())
except Exception as e:
if self.debug:
syslog.syslog(str(rdata))
related_ips.append(rdata.to_text())
except Exception as e:
if self.debug:
syslog.syslog(str(e))
syslog.syslog(str(e))
if related_ips:
hip = MISPObject(name='ip-port')