From f08fc6d9a5784da92200e0344ab4f75398af4b14 Mon Sep 17 00:00:00 2001 From: chrisr3d Date: Sun, 17 Nov 2019 19:11:26 -0500 Subject: [PATCH] chg: Reintroducing the limit to reduce the number of recursive calls to the API when querying for a domain --- misp_modules/modules/expansion/virustotal.py | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/misp_modules/modules/expansion/virustotal.py b/misp_modules/modules/expansion/virustotal.py index cd0e738..77a99a2 100644 --- a/misp_modules/modules/expansion/virustotal.py +++ b/misp_modules/modules/expansion/virustotal.py @@ -12,14 +12,13 @@ moduleinfo = {'version': '4', 'author': 'Hannah Ward', 'module-type': ['expansion']} # config fields that your code expects from the site admin -moduleconfig = ["apikey"] +moduleconfig = ["apikey", "event_limit"] -# TODO: Parse the report with a private API key to be able to get more advanced results from a query with 'allinfo' set to True - class VirusTotalParser(object): - def __init__(self, apikey): + def __init__(self, apikey, limit): self.apikey = apikey + self.limit = limit self.base_url = "https://www.virustotal.com/vtapi/v2/{}/report" self.misp_event = MISPEvent() self.parsed_objects = {} @@ -57,7 +56,7 @@ class VirusTotalParser(object): uuid = self.parse_resolutions(req['resolutions'], req['subdomains'], siblings) for feature_type, relationship in feature_types.items(): for feature in ('undetected_{}_samples', 'detected_{}_samples'): - for sample in req.get(feature.format(feature_type), []): + for sample in req.get(feature.format(feature_type), [])[:self.limit]: status_code = self.parse_hash(sample[hash_type], False, uuid, relationship) if status_code != 200: return status_code @@ -197,7 +196,10 @@ def handler(q=False): if not request.get('config') or not request['config'].get('apikey'): misperrors['error'] = "A VirusTotal api key is required for this module." return misperrors - parser = VirusTotalParser(request['config']['apikey']) + event_limit = request['config'].get('event_limit') + if not isinstance(event_limit, int): + event_limit = 5 + parser = VirusTotalParser(request['config']['apikey'], event_limit) attribute = request['attribute'] status = parser.query_api(attribute) if status != 200: