diff --git a/analyzers/SinkDB/SinkDB.json b/analyzers/SinkDB/SinkDB.json index 12985b4..82f50c5 100644 --- a/analyzers/SinkDB/SinkDB.json +++ b/analyzers/SinkDB/SinkDB.json @@ -5,7 +5,7 @@ "url": "https://github.com/RedLegg/sinkdb-analyzer", "version": "1.1", "description": "Check if ip is sinkholed via the new sinkdb.abuse.ch HTTPS API. Original analyzer can be found at https://github.com/BSI-CERT-Bund/sinkdb-analyzer", - "dataTypeList": ["ip", "domain", "mail"], + "dataTypeList": ["ip", "domain", "fqdn", "mail"], "command": "SinkDB/sinkdb.py", "baseConfig": "SinkDB", "configurationItems": [ diff --git a/analyzers/SinkDB/sinkdb.py b/analyzers/SinkDB/sinkdb.py index 81f042d..018e21d 100755 --- a/analyzers/SinkDB/sinkdb.py +++ b/analyzers/SinkDB/sinkdb.py @@ -8,7 +8,7 @@ class SinkDBAnalyzer(Analyzer): def __init__(self): Analyzer.__init__(self) - if self.data_type not in ['ip', 'domain', 'mail']: + if self.data_type not in ['ip', 'domain', 'fqdn', 'mail']: self.error('SinkDB Analyzer only usable with the ip, domain, and mail data types.') self.apikey = self.get_param('config.key', None, 'HTTPS API Key needed for querying SinkDB.') @@ -19,7 +19,7 @@ class SinkDBAnalyzer(Analyzer): if self.data_type == 'ip': return self.parse_entries(json.loads(self.do_post("api_key={}&ipv4={}".format(self.apikey, self.data)).text)) - elif self.data_type == 'domain': + elif self.data_type in ('domain', 'fqdn'): return self.parse_entries(json.loads(self.do_post("api_key={}&domain={}".format(self.apikey, self.data)).text)) elif self.data_type == 'mail':