MISP
/
misp-modules
mirror of https://github.com/MISP/misp-modules
2
0
Fork 0
Code Issues Releases Wiki Activity

fix: Avoiding empty values + Fixed empty types error + Fixed filename KeyError

pull/343/head
chrisr3d 2019-10-17 10:42:34 +02:00
parent 5f7b127713
commit a228e2505d
No known key found for this signature in database
GPG Key ID: 6BBED1B63A6D639F
1 changed files with 7 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
misp_modules/modules/expansion/threatminer.py
View File

@ -26,10 +26,11 @@ class ThreatMiner():
def parsed_results(self): def parsed_results(self):
to_return = [] to_return = []
for key, values in self.results.items(): for key, values in self.results.items():
input_value, comment = key[:2] if values:
types = [k for k in key[2:]] input_value, comment = key[:2]
to_return.append({'types': types, 'values': list(values), types = [k for k in key[2:]]
'comment': self.comment.format(input_value, comment)}) to_return.append({'types': types, 'values': list(values),
'comment': self.comment.format(input_value, comment)})
return to_return return to_return
def parse_query(self, request): def parse_query(self, request):
@ -82,7 +83,7 @@ class ThreatMiner():
self.results[(q, comment, 'domain')].update({result for result in results if isinstance(result, str)}) self.results[(q, comment, 'domain')].update({result for result in results if isinstance(result, str)})
def _add_filename(self, results, q, comment): def _add_filename(self, results, q, comment):
self.results[(q, comment, 'filename')].update({result['filename'] for result in results if result.get('file_name')}) self.results[(q, comment, 'filename')].update({result['file_name'] for result in results if result.get('file_name')})
def _add_hash(self, results, q, comment): def _add_hash(self, results, q, comment):
self.results[(q, comment, 'sha256')].update({result for result in results if isinstance(result, str)}) self.results[(q, comment, 'sha256')].update({result for result in results if isinstance(result, str)})
@ -118,7 +119,7 @@ class ThreatMiner():
self.results[(q, comment, 'whois-registrant-email')].update({email for em_type, email in emails.items() if em_type == 'registrant' and email}) self.results[(q, comment, 'whois-registrant-email')].update({email for em_type, email in emails.items() if em_type == 'registrant' and email})
def _add_x509(self, results, q, comment): def _add_x509(self, results, q, comment):
self.results[(q, 'x509-fingerprint-sha1')].update({result for result in results if isinstance(result, str)}) self.results[(q, comment, 'x509-fingerprint-sha1')].update({result for result in results if isinstance(result, str)})
def handler(q=False): def handler(q=False):