MISP
/
misp-modules
mirror of https://github.com/MISP/misp-modules
2
0
Fork 0
Code Issues Releases Wiki Activity

add: [farsight_passivedns] Adding first_seen & last_seen (when available) in passivedns objects 

- The object_relation `time_first` is added as the
  `first_seen` value of the object
- Same with `time_last` -> `last_seen`
pull/496/head
chrisr3d 2021-03-31 13:42:07 +02:00
parent eaa455a200
commit a2282c4721
No known key found for this signature in database
GPG Key ID: 6BBED1B63A6D639F
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
misp_modules/modules/expansion/farsight_passivedns.py
View File

@ -108,6 +108,10 @@ class FarsightDnsdbParser():
passivedns_object.add_attribute(**self._parse_attribute(comment, 'rdata', rdata))
for feature, value in result.items():
passivedns_object.add_attribute(**self._parse_attribute(comment, feature, value))
if result.get('time_first'):
passivedns_object.first_seen = result['time_first']
if result.get('time_last'):
passivedns_object.last_seen = result['time_last']
passivedns_object.add_reference(self.attribute['uuid'], 'related-to')
self.misp_event.add_object(passivedns_object)