DCSO / TIE-Splunk-TA

DCSO Threat Intelligence Engine (TIE) Add-On for Splunk v8
BSD 3-Clause "New" or "Revised" License
3 stars 2 forks source link

Fix seqid handling #14

Closed satta closed 3 years ago

satta commented 3 years ago

This PR ensures that the highest observed sequence number in the previous query that is kept in a state file is actually passed to the fetcher method in the next query. It also changes the behaviour to store the maximum of the max_seq value seen in the previous run, to reflect the highest seqnum of all of an IoC's observations.

This addresses a problem where old data is read when querying the TIE, as the seq parameter of the REST request would never be anything but 0. Hence the query would never start at another position, and also never move forward the query window between tie2index invocations.