MISP
/
misp-modules
mirror of https://github.com/MISP/misp-modules
2
0
Fork 0
Code Issues Releases Wiki Activity

Merge remote-tracking branch 'origin/main'

pull/702/head
Sami Mokaddem 2024-11-18 09:57:41 +01:00
parent e8537592d7 5e31eee588
commit d45dec6273
No known key found for this signature in database
GPG Key ID: 164C473F627A06FA
1 changed files with 36 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
misp_modules/modules/expansion/urlscan.py
View File

@ -81,6 +81,8 @@ def lookup_indicator(client, query):
for request in result['data']['requests']:
if request['response'].get('failed'):
if request['response']['failed']['errorText']:
if request['response']['failed']['errorText'] in ["net::ERR_ABORTED", "net::ERR_FAILED", "net::ERR_QUIC_PROTOCOL_ERROR"]:
continue
log.debug('The page could not load')
r.append(
{'error': 'Domain could not be resolved: {}'.format(request['response']['failed']['errorText'])})
@ -91,14 +93,21 @@ def lookup_indicator(client, query):
r.append({'types': 'domain',
'categories': ['Network activity'],
'values': misp_val,
'comment': misp_comment})
'comment': f"{misp_comment} - Domain"})
if result['page'].get('ip'):
misp_val = result['page']['ip']
r.append({'types': 'ip-dst',
'categories': ['Network activity'],
'values': misp_val,
'comment': misp_comment})
'comment': f"{misp_comment} - IP"})
if result['page'].get('ptr'):
misp_val = result['page']['ptr']
r.append({'types': 'hostname',
'categories': ['Network activity'],
'values': misp_val,
'comment': f"{misp_comment} - PTR"})
if result['page'].get('country'):
misp_val = 'country: ' + result['page']['country']
@ -107,18 +116,40 @@ def lookup_indicator(client, query):
r.append({'types': 'text',
'categories': ['External analysis'],
'values': misp_val,
'comment': misp_comment})
'comment': f"{misp_comment} - Country/City"})
if result['page'].get('asn'):
misp_val = result['page']['asn']
r.append({'types': 'AS', 'categories': ['External analysis'], 'values': misp_val, 'comment': misp_comment})
r.append({'types': 'AS', 'categories': ['External analysis'], 'values': misp_val, 'comment': f"{misp_comment} - ASN"})
if result['page'].get('asnname'):
misp_val = result['page']['asnname']
r.append({'types': 'text',
'categories': ['External analysis'],
'values': misp_val,
'comment': misp_comment})
'comment': f"{misp_comment} - ASN name"})
if result['page'].get('tlsIssuer'):
misp_val = result['page']['tlsIssuer']
r.append({'types': 'text',
'categories': ['External analysis'],
'values': misp_val,
'comment': f"{misp_comment} - TLS Issuer"})
if result['page'].get('title'):
misp_val = result['page']['title']
r.append({'types': 'text',
'categories': ['External analysis'],
'values': misp_val,
'comment': f"{misp_comment} - Page title"})
if result['page'].get('server'):
misp_val = result['page']['server']
r.append({'types': 'text',
'categories': ['External analysis'],
'values': misp_val,
'comment': f"{misp_comment} - Server"})
if result.get('stats'):
if result['stats'].get('malicious'):