From 505bbbc20ad5bd6c4b9abb749c93ea86fc0cac0d Mon Sep 17 00:00:00 2001 From: chrisr3d Date: Tue, 30 Mar 2021 17:34:01 +0200 Subject: [PATCH] fix: [farsight_passivedns] Excluding last_seen value for now, in order to get the available results - With last_seen set we can easily get results included in a certain time frame (between first seen and last seen), but we do not get the latest results. In order to get those ones, we skip filtering on the time_last_before value --- misp_modules/modules/expansion/farsight_passivedns.py | 2 -- 1 file changed, 2 deletions(-) diff --git a/misp_modules/modules/expansion/farsight_passivedns.py b/misp_modules/modules/expansion/farsight_passivedns.py index 1a0bd7f..98ee2ed 100755 --- a/misp_modules/modules/expansion/farsight_passivedns.py +++ b/misp_modules/modules/expansion/farsight_passivedns.py @@ -160,8 +160,6 @@ def parse_input(attribute, config): } if attribute.get('first_seen'): lookup_args['time_first_after'] = parse_timestamp(attribute['first_seen']) - if attribute.get('last_seen'): - lookup_args['time_last_before'] = parse_timestamp(attribute['last_seen']) attribute_type = attribute['type'] if attribute_type in flex_query_input: return flex_queries, (lookup_args, attribute['value'])