From a2282c47215d970ad65824dd9a5cc1da4e928ca0 Mon Sep 17 00:00:00 2001 From: chrisr3d Date: Wed, 31 Mar 2021 13:42:07 +0200 Subject: [PATCH] add: [farsight_passivedns] Adding first_seen & last_seen (when available) in passivedns objects - The object_relation `time_first` is added as the `first_seen` value of the object - Same with `time_last` -> `last_seen` --- misp_modules/modules/expansion/farsight_passivedns.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/misp_modules/modules/expansion/farsight_passivedns.py b/misp_modules/modules/expansion/farsight_passivedns.py index 98ee2ed..e6e1e25 100755 --- a/misp_modules/modules/expansion/farsight_passivedns.py +++ b/misp_modules/modules/expansion/farsight_passivedns.py @@ -108,6 +108,10 @@ class FarsightDnsdbParser(): passivedns_object.add_attribute(**self._parse_attribute(comment, 'rdata', rdata)) for feature, value in result.items(): passivedns_object.add_attribute(**self._parse_attribute(comment, feature, value)) + if result.get('time_first'): + passivedns_object.first_seen = result['time_first'] + if result.get('time_last'): + passivedns_object.last_seen = result['time_last'] passivedns_object.add_reference(self.attribute['uuid'], 'related-to') self.misp_event.add_object(passivedns_object)