From 59c994678da633d55ce79056d80186198ed82ad7 Mon Sep 17 00:00:00 2001 From: Christian Studer Date: Thu, 26 Sep 2024 11:08:22 +0200 Subject: [PATCH] chg: [circl_passivedns] Using `time_first` & `time_last` as `first_seen` and `last_seen` fields on the `passive-dns` objects - Should fix #692 --- .../modules/expansion/circl_passivedns.py | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/misp_modules/modules/expansion/circl_passivedns.py b/misp_modules/modules/expansion/circl_passivedns.py index c02d4b9d..dc2084ad 100755 --- a/misp_modules/modules/expansion/circl_passivedns.py +++ b/misp_modules/modules/expansion/circl_passivedns.py @@ -48,14 +48,20 @@ def parse(self): self.result = {'error': 'Not found'} return - mapping = {'count': 'counter', 'origin': 'text', - 'time_first': 'datetime', 'rrtype': 'text', - 'rrname': 'text', 'rdata': 'text', - 'time_last': 'datetime'} + mapping = { + 'count': 'counter', 'origin': 'text', 'rrtype': 'text', + 'rrname': 'text', 'rdata': 'text', + } for result in results: pdns_object = MISPObject('passive-dns') for relation, attribute_type in mapping.items(): - pdns_object.add_attribute(relation, type=attribute_type, value=result[relation]) + pdns_object.add_attribute(relation, result[relation], type=attribute_type) + first_seen = result['time_first'] + pdns_object.add_attribute('time_first', first_seen, type='datetime') + pdns_object.first_seen = first_seen + last_seen = result['time_last'] + pdns_object.add_attribute('time_last', last_seen, type='datetime') + pdns_object.last_seen = last_seen pdns_object.add_reference(self.attribute.uuid, 'associated-to') self.misp_event.add_object(**pdns_object)