curben
/
splunk-malware-filter
mirror of https://gitlab.com/malware-filter/splunk-malware-filter
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fix(getopendbl): rename "cidr" column to "cidr_range" 

to avoid confusion with match_type CIDR() in lookup definition
This commit is contained in:
Ming Di Leom 2023-02-04 06:42:43 +00:00
parent f0d9ad0ecb
commit 7529622fb2
No known key found for this signature in database
GPG Key ID: 32D3E28E96A695E8
10 changed files with 12 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
README.md
View File

@ -19,7 +19,7 @@ Provide custom search commands to update [malware-filter](https://gitlab.com/mal
Releases are available at https://gitlab.com/malware-filter/splunk-malware-filter/-/releases
Instruction to build the latest commit is available at the [Build](#build) section.
Instruction to build the main branch is available at the [Build](#build) section.
## Usage
@ -141,7 +141,7 @@ Recommend to update the lookup file "opendbl_ip.csv" every 15 minutes (cron `*/1
| outputlookup override_if_empty=false opendbl_ip.csv
```
| start | end | netmask | cidr | name | updated |
| start | end | netmask | cidr_range | name | updated |
| --------------- | --------------- | ------- | ------------------ | ----------------------------------------- | -------------------- |
| 187.190.252.167 | 187.190.252.167 | 32 | 187.190.252.167/32 | Emerging Threats: Known Compromised Hosts | 2023-01-30T08:03:00Z |
| 89.248.163.0 | 89.248.163.255 | 24 | 89.248.163.0/24 | Dshield | 2023-01-30T08:01:00Z |

4
bin/getopendbl.py
View File

@ -56,7 +56,7 @@ class GetOpenDBL(Utility, GeneratingCommand):
"start": line,
"end": line,
"netmask": "32",
"cidr": f"{line}/32",
"cidr_range": f"{line}/32",
"name": name,
"updated": updated,
}
@ -64,7 +64,7 @@ class GetOpenDBL(Utility, GeneratingCommand):
if "-" in line:
row["start"], row["end"] = line.split("-")
row["netmask"] = 24
row["cidr"] = f"{row['start']}/{row['netmask']}"
row["cidr_range"] = f"{row['start']}/{row['netmask']}"
if (
isinstance(self.custom_message, str)

2
build.py
View File

@ -50,7 +50,7 @@ def exclusion(tarinfo):
# exclude certain folders/files
pathname = tarinfo.name
if search(
r"/\.|\\\.|__pycache__|pyproject.toml|requirements-dev.txt|build.py", pathname
r"/\.|\\\.|__pycache__|pyproject.toml|requirements-dev.txt|build.py|tar.gz", pathname
):
return None

1
lookups/botnet-filter-splunk.csv
View File

@ -0,0 +1 @@
ip,message,updated
1 ip message updated
1 ip message updated

1
lookups/botnet_ip.csv
View File

@ -0,0 +1 @@
first_seen_utc,dst_ip,dst_port,c2_status,last_online,malware,updated
1 first_seen_utc dst_ip dst_port c2_status last_online malware updated
1 first_seen_utc dst_ip dst_port c2_status last_online malware updated

1
lookups/opendbl_ip.csv
View File

@ -0,0 +1 @@
start,end,netmask,cidr_range,name,updated
1 start end netmask cidr_range name updated
1 start end netmask cidr_range name updated

1
lookups/phishing-filter-splunk.csv
View File

@ -0,0 +1 @@
host,path,message,updated
1 host path message updated
1 host path message updated

1
lookups/pup-filter-splunk.csv
View File

@ -0,0 +1 @@
host,path,message,updated
1 host path message updated
1 host path message updated

1
lookups/urlhaus-filter-splunk-online.csv
View File

@ -0,0 +1 @@
host,path,message,updated
1 host path message updated
1 host path message updated

1
lookups/vn-badsite-filter-splunk.csv
View File

@ -0,0 +1 @@
host,path,message,updated
1 host path message updated
1 host path message updated