MISP
/
misp-modules
mirror of https://github.com/MISP/misp-modules
2
0
Fork 0
Code Issues Releases Wiki Activity

chg: [onyphe] fix #252

pull/266/head
Alexandre Dulaunoy 2018-11-11 15:49:14 +01:00
parent 2ccc8fd405
commit 5d1583d88b
No known key found for this signature in database
GPG Key ID: 09E2CD4944E6CBCD
3 changed files with 7 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
misp_modules/modules/expansion/onyphe.py
View File

@ -65,16 +65,16 @@ def handle_expansion(api, ip, misperrors):
for r in result['results']: for r in result['results']:
if r['@category'] == 'pastries': if r['@category'] == 'pastries':
if r['@type'] == 'pastebin': if r['source'] == 'pastebin':
urls_pasties.append('https://pastebin.com/raw/%s' % r['key']) urls_pasties.append('https://pastebin.com/raw/%s' % r['key'])
elif r['@category'] == 'synscan': elif r['@category'] == 'synscan':
asn_list.append(r['asn']) asn_list.append(r['asn'])
os_target = r['os'] os_target = r['os']
if os_target != 'Unknown': if os_target != 'Unknown':
os_list.append(r['os']) os_list.append(r['os'])
elif r['@category'] == 'resolver' and r['@type'] =='reverse': elif r['@category'] == 'resolver' and r['type'] =='reverse':
domains_resolver.append(r['reverse']) domains_resolver.append(r['reverse'])
elif r['@category'] == 'resolver' and r['@type'] =='forward': elif r['@category'] == 'resolver' and r['type'] =='forward':
domains_forward.append(r['forward']) domains_forward.append(r['forward'])
result_filtered['results'].append({'types': ['url'], 'values': urls_pasties, result_filtered['results'].append({'types': ['url'], 'values': urls_pasties,

2
misp_modules/modules/expansion/onyphe_full.py
View File

@ -315,7 +315,7 @@ def expand_pastries(api, misperror, **kwargs):
status_ok = True status_ok = True
for item in result['results']: for item in result['results']:
if item['@category'] == 'pastries': if item['@category'] == 'pastries':
if item['@type'] == 'pastebin': if item['source'] == 'pastebin':
urls_pasties.append('https://pastebin.com/raw/%s' % item['key']) urls_pasties.append('https://pastebin.com/raw/%s' % item['key'])
if 'domain' in item: if 'domain' in item:

2
tests/bodyhashdd.json
View File

@ -1 +1 @@
{"module": "hashdd", "md5": "838DE99E82C5B9753BAC96D82C1A8DCB"} {"module": "hashdd", "md5": "838DE99E82C5B9753BAC96D82C1A8DCC"}