MISP
/
misp-modules
mirror of https://github.com/MISP/misp-modules
2
0
Fork 0
Code Issues Releases Wiki Activity

add history mx and soa

pull/208/head
Sebdraven 2018-07-11 11:24:49 +02:00
parent 43a49dafc6
commit f47a64b364
1 changed files with 35 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

49
misp_modules/modules/expansion/dnstrails.py
View File

@ -346,20 +346,23 @@ def expand_history_dns(api, domain):
if results:
status_ok = True
if 'records' in results:
for record in results['records']:
if 'values' in record:
for item in record['values']:
r.append(
{'types': ['domain|ip'],
'values': [
'%s|%s' % (domain, item['nameserver'])],
'categories': ['Network activity'],
'comment': 'history DNS of %s last seen: %s first seen: %s' %
(domain, record['last_seen'],
record['first_seen'])
}
)
r.extend(__history_dns(results, domain, 'nameserver', 'ns'))
time.sleep(1)
results = api.history_dns_soa(results, domain)
if results:
status_ok = True
r.extend(__history_dns(results, domain, 'email', 'soa'))
time.sleep(1)
results = api.history_dns_mx(domain)
if results:
status_ok = True
r.extend(__history_dns(results, domain, 'host', 'mx'))
except APIError as e:
misperrors['error'] = e
@ -387,6 +390,24 @@ def __history_ip(results, domain, type_ip='ip'):
return r
def __history_dns(results, domain, type_serv, service):
r = []
if 'records' in results:
for record in results['records']:
if 'values' in record:
for item in record['values']:
r.append(
{'types': ['domain|ip'],
'values': [item[type_serv]],
'categories': ['Network activity'],
'comment': 'history %s of %s last seen: %s first seen: %s' %
(service, domain, record['last_seen'],
record['first_seen'])
}
)
return r
def introspection():
return mispattributes