MISP
/
misp-modules
mirror of https://github.com/MISP/misp-modules
2
0
Fork 0
Code Issues Releases Wiki Activity

added ip-dst|port and ip-src|port to request

pull/589/head
Andreas Muehlemann 2022-10-20 12:51:35 +02:00
parent af1739cec5
commit 8d240e3541
No known key found for this signature in database
GPG Key ID: A3F6AED5822D8419
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
misp_modules/modules/expansion/reversedns.py
View File

@ -5,7 +5,7 @@ misperrors = {'error': 'Error'}
mispattributes = {'input': ['ip-src', 'ip-dst', 'domain|ip'], 'output': ['hostname']} mispattributes = {'input': ['ip-src', 'ip-dst', 'domain|ip'], 'output': ['hostname']}
# possible module-types: 'expansion', 'hover' or both # possible module-types: 'expansion', 'hover' or both
moduleinfo = {'version': '0.1', 'author': 'Andreas Muehlemann', moduleinfo = {'version': '0.2', 'author': 'Andreas Muehlemann',
'description': 'Simple Reverse DNS expansion service to resolve reverse DNS from MISP attributes', 'description': 'Simple Reverse DNS expansion service to resolve reverse DNS from MISP attributes',
'module-type': ['expansion', 'hover']} 'module-type': ['expansion', 'hover']}
@ -23,6 +23,10 @@ def handler(q=False):
toquery = request['ip-src'] toquery = request['ip-src']
elif request.get('domain|ip'): elif request.get('domain|ip'):
toquery = request['domain|ip'].split('|')[1] toquery = request['domain|ip'].split('|')[1]
elif request.get('ip-src|port'):
toquery = request['ip-src|port'].split('|')[0]
elif request.get('ip-dst|port'):
toquery = request['ip-dst|port'].split('|')[0]
else: else:
return False return False