chg: Reintroducing the limit to reduce the number of recursive calls to the API when querying for a domain

chrisr3d 4 years ago
parent 4990bcebd8
commit f08fc6d9a5
No known key found for this signature in database
GPG Key ID: 6BBED1B63A6D639F
  1. 14

@ -12,14 +12,13 @@ moduleinfo = {'version': '4', 'author': 'Hannah Ward',
'module-type': ['expansion']}
# config fields that your code expects from the site admin
moduleconfig = ["apikey"]
moduleconfig = ["apikey", "event_limit"]
# TODO: Parse the report with a private API key to be able to get more advanced results from a query with 'allinfo' set to True
class VirusTotalParser(object):
def __init__(self, apikey):
def __init__(self, apikey, limit):
self.apikey = apikey
self.limit = limit
self.base_url = "{}/report"
self.misp_event = MISPEvent()
self.parsed_objects = {}
@ -57,7 +56,7 @@ class VirusTotalParser(object):
uuid = self.parse_resolutions(req['resolutions'], req['subdomains'], siblings)
for feature_type, relationship in feature_types.items():
for feature in ('undetected_{}_samples', 'detected_{}_samples'):
for sample in req.get(feature.format(feature_type), []):
for sample in req.get(feature.format(feature_type), [])[:self.limit]:
status_code = self.parse_hash(sample[hash_type], False, uuid, relationship)
if status_code != 200:
return status_code
@ -197,7 +196,10 @@ def handler(q=False):
if not request.get('config') or not request['config'].get('apikey'):
misperrors['error'] = "A VirusTotal api key is required for this module."
return misperrors
parser = VirusTotalParser(request['config']['apikey'])
event_limit = request['config'].get('event_limit')
if not isinstance(event_limit, int):
event_limit = 5
parser = VirusTotalParser(request['config']['apikey'], event_limit)
attribute = request['attribute']
status = parser.query_api(attribute)
if status != 200: