mirror of https://github.com/MISP/misp-modules
add: [farsight_passivedns] Adding first_seen & last_seen (when available) in passivedns objects
- The object_relation `time_first` is added as the `first_seen` value of the object - Same with `time_last` -> `last_seen`pull/496/head
parent
eaa455a200
commit
a2282c4721
|
@ -108,6 +108,10 @@ class FarsightDnsdbParser():
|
||||||
passivedns_object.add_attribute(**self._parse_attribute(comment, 'rdata', rdata))
|
passivedns_object.add_attribute(**self._parse_attribute(comment, 'rdata', rdata))
|
||||||
for feature, value in result.items():
|
for feature, value in result.items():
|
||||||
passivedns_object.add_attribute(**self._parse_attribute(comment, feature, value))
|
passivedns_object.add_attribute(**self._parse_attribute(comment, feature, value))
|
||||||
|
if result.get('time_first'):
|
||||||
|
passivedns_object.first_seen = result['time_first']
|
||||||
|
if result.get('time_last'):
|
||||||
|
passivedns_object.last_seen = result['time_last']
|
||||||
passivedns_object.add_reference(self.attribute['uuid'], 'related-to')
|
passivedns_object.add_reference(self.attribute['uuid'], 'related-to')
|
||||||
self.misp_event.add_object(passivedns_object)
|
self.misp_event.add_object(passivedns_object)
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue