From 5082a835d83acc3f48f301ea5b24adf806a3b4ba Mon Sep 17 00:00:00 2001
From: Iglocska <andras.iklody@gmail.com>
Date: Wed, 17 Feb 2016 23:43:53 +0100
Subject: [PATCH] Changed the output format to include all matching attribute
 types

- changed the output format to give us a bit more flexibility
  - return an array of results
  - return the valid misp attribute types for each result
---
 modules/expansion/dns.py | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)
 mode change 100644 => 100755 modules/expansion/dns.py

diff --git a/modules/expansion/dns.py b/modules/expansion/dns.py
old mode 100644
new mode 100755
index 06b947f..2f8117d
--- a/modules/expansion/dns.py
+++ b/modules/expansion/dns.py
@@ -1,7 +1,7 @@
 import json
 import dns.resolver
 
-mispattributes = ['hostname', 'domain']
+mispattributes = {'input':['hostname', 'domain'], 'output':['ip-src', 'ip-dst']}
 
 def handler(q=False):
     if q is False:
@@ -21,10 +21,9 @@ def handler(q=False):
         return False
     except dns.exception.Timeout:
         return False
-    r = {}
-    r["ip-dst"] = str(answer[0])
+    r = {'results':[{'types':mispattributes['output'], 'values':[str(answer[0])]}]}
     return r
 
 def introspection():
 
-    return mispattributes
+    return mispattributes['input']