valitydev/Cortex-Analyzers
14
0
Fork 0
mirror of https://github.com/valitydev/Cortex-Analyzers.git synced 2024-11-06 17:15:21 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

add fqdn support

Browse Source
This commit is contained in:
Davide Arcuri 2020-05-04 14:04:31 +02:00
parent d5f3e6acf2
commit 6cee433ae0
2 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
analyzers/SinkDB/SinkDB.json
View File

@ -5,7 +5,7 @@
"url": "https://github.com/RedLegg/sinkdb-analyzer",
"version": "1.1",
"description": "Check if ip is sinkholed via the new sinkdb.abuse.ch HTTPS API. Original analyzer can be found at https://github.com/BSI-CERT-Bund/sinkdb-analyzer",
"dataTypeList": ["ip", "domain", "mail"],
"dataTypeList": ["ip", "domain", "fqdn", "mail"],
"command": "SinkDB/sinkdb.py",
"baseConfig": "SinkDB",
"configurationItems": [

4
analyzers/SinkDB/sinkdb.py
View File

@ -8,7 +8,7 @@ class SinkDBAnalyzer(Analyzer):
def __init__(self):
Analyzer.__init__(self)
if self.data_type not in ['ip', 'domain', 'mail']:
if self.data_type not in ['ip', 'domain', 'fqdn', 'mail']:
self.error('SinkDB Analyzer only usable with the ip, domain, and mail data types.')
self.apikey = self.get_param('config.key', None, 'HTTPS API Key needed for querying SinkDB.')
@ -19,7 +19,7 @@ class SinkDBAnalyzer(Analyzer):
if self.data_type == 'ip':
return self.parse_entries(json.loads(self.do_post("api_key={}&ipv4={}".format(self.apikey, self.data)).text))
elif self.data_type == 'domain':
elif self.data_type in ('domain', 'fqdn'):
return self.parse_entries(json.loads(self.do_post("api_key={}&domain={}".format(self.apikey, self.data)).text))
elif self.data_type == 'mail':