MISP
/
misp-modules
mirror of https://github.com/MISP/misp-modules
2
0
Fork 0
Code Issues Releases Wiki Activity

correct key and return of functions

pull/208/head
Sebdraven 2018-07-12 14:27:59 +02:00
parent 731c06a939
commit 9063da88cd
1 changed files with 38 additions and 36 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

74
misp_modules/modules/expansion/securitytrails.py
View File

@ -394,40 +394,41 @@ def expand_history_whois(api, domain):
if 'items' in results['result']: if 'items' in results['result']:
for item in results['result']['items']: for item in results['result']['items']:
item_registrant = __select_registrant_item(item) item_registrant = __select_registrant_item(item)
if item_registrant:
r.extend( r.extend(
{
'type': ['domain'],
'values': item['nameServers'],
'categories': ['Network activity'],
'comment': 'Whois history Name Servers of %s '
'Status: %s ' % (domain, item['status'])
}
)
if 'email' in item_registrant:
r.append(
{ {
'types': ['whois-registrant-email'], 'type': ['domain'],
'values': [item_registrant['email']], 'values': item['nameServers'],
'categories': ['Attribution'], 'categories': ['Network activity'],
'comment': 'Whois history registrant email of %s' 'comment': 'Whois history Name Servers of %s '
'Status: %s' % ( 'Status: %s ' % (
domain, item['status']) domain, item['status'])
} }
) )
if 'email' in item_registrant:
r.append(
{
'types': ['whois-registrant-email'],
'values': [item_registrant['email']],
'categories': ['Attribution'],
'comment': 'Whois history registrant email of %s'
'Status: %s' % (
domain, item['status'])
}
)
if 'telephone' in item_registrant: if 'telephone' in item_registrant:
r.append( r.append(
{ {
'types': ['whois-registrant-phone'], 'types': ['whois-registrant-phone'],
'values': [item_registrant['telephone']], 'values': [item_registrant['telephone']],
'categories': ['Attribution'], 'categories': ['Attribution'],
'comment': 'Whois history registrant phone of %s' 'comment': 'Whois history registrant phone of %s'
'Status: %s' % ( 'Status: %s' % (
domain, item['status']) domain, item['status'])
} }
) )
@ -502,10 +503,11 @@ def version():
def __select_registrant_item(entry): def __select_registrant_item(entry):
print(entry)
if 'contacts' in entry: if 'contacts' in entry:
for c in entry['contacts']: return list(filter(lambda x: x['type'] == 'registrant',
print(c) entry['contacts']))[0]
if c['type'] == 'registrant':
print(c) if 'contact' in entry:
return c return list(filter(lambda x: x['type'] == 'registrant',
entry['contact']))[0]