MISP
/
misp-modules
mirror of https://github.com/MISP/misp-modules
2
0
Fork 0
Code Issues Releases Wiki Activity

add: [farsight_passivedns] New lookup argument based on the first_seen & last_seen fields

pull/496/head
chrisr3d 2021-03-29 20:09:29 +02:00
parent 9f80d69e64
commit 25d826076c
No known key found for this signature in database
GPG Key ID: 6BBED1B63A6D639F
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
misp_modules/modules/expansion/farsight_passivedns.py
View File

@ -1,6 +1,7 @@
import dnsdb2 import dnsdb2
import json import json
from . import check_input_attribute, standard_error_message from . import check_input_attribute, standard_error_message
from datetime import datetime
from pymisp import MISPEvent, MISPObject from pymisp import MISPEvent, MISPObject
misperrors = {'error': 'Error'} misperrors = {'error': 'Error'}
@ -156,6 +157,11 @@ def parse_input(attribute, config):
'offset': 0, 'offset': 0,
'ignore_limited': True 'ignore_limited': True
} }
if attribute.get('first_seen'):
lookup_args['time_first_after'] = parse_timestamp(attribute['first_seen'])
if attribute.get('last_seen'):
lookup_args['time_last_before'] = parse_timestamp(attribute['last_seen'])
print(lookup_args)
attribute_type = attribute['type'] attribute_type = attribute['type']
if attribute_type in flex_query_input: if attribute_type in flex_query_input:
return flex_queries, (lookup_args, attribute['value']) return flex_queries, (lookup_args, attribute['value'])
@ -163,6 +169,9 @@ def parse_input(attribute, config):
to_query = lookup_ip if 'ip-' in attribute_type else lookup_name to_query = lookup_ip if 'ip-' in attribute_type else lookup_name
return to_query, (lookup_args, attribute['value'], flex) return to_query, (lookup_args, attribute['value'], flex)
def parse_timestamp(str_date):
datetime_date = datetime.strptime(str_date, '%Y-%m-%dT%H:%M:%S.%f%z')
return str(int(datetime_date.timestamp()))
def add_flex_queries(flex): def add_flex_queries(flex):
if not flex: if not flex: