From 036933ea14d4f90bd7c05e2466837d0c8c107ab7 Mon Sep 17 00:00:00 2001 From: Koen Van Impe Date: Fri, 17 Jan 2020 11:26:35 +0100 Subject: [PATCH] 2nd fix for VT Public module --- misp_modules/modules/expansion/virustotal_public.py | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/misp_modules/modules/expansion/virustotal_public.py b/misp_modules/modules/expansion/virustotal_public.py index a6c093a..f31855e 100644 --- a/misp_modules/modules/expansion/virustotal_public.py +++ b/misp_modules/modules/expansion/virustotal_public.py @@ -85,9 +85,10 @@ class DomainQuery(VirusTotalParser): whois_object = MISPObject(whois) whois_object.add_attribute('text', type='text', value=query_result[whois]) self.misp_event.add_object(**whois_object) - if 'domain_siblings' in query_result['domain_siblings']: - siblings = (self.parse_siblings(domain) for domain in query_result['domain_siblings']) - self.parse_resolutions(query_result['resolutions'], query_result['subdomains'], siblings) + if 'domain_siblings' in query_result: + siblings = (self.parse_siblings(domain) for domain in query_result['domain_siblings']) + if 'subdomains' in query_result: + self.parse_resolutions(query_result['resolutions'], query_result['subdomains'], siblings) self.parse_urls(query_result) def parse_siblings(self, domain):