Graylog2 / graylog-plugin-threatintel

Graylog Processing Pipeline functions to enrich log messages with IoC information from threat intelligence databases
Other
151 stars 19 forks source link

Improve WHOIS adapter handling of multiple results #179

Open waab76 opened 4 years ago

waab76 commented 4 years ago

Currently, when ARIN has multiple results for an IP address, the WHOIS data adapter fails to return data. Sample IPs that demonstrate this include 24.255.164.88, 65.118.97.162, and 68.110.253.17

In each of these cases, ARIN has multiple records with different Network Type values. We want to update the WHOIS plugin to better handle these cases and return the data from the most specific record. The preference order for Network Types will be: 1) Reassigned 2) Direct Assignment 3) Direct Allocation 4) Reallocated

Input Criteria

Output Criteria

Tasks