Updates to defender module

MISP / misp-modules

Modules for expansion services, enrichment, import and export in MISP and other tools.

http://misp.github.io/misp-modules

GNU Affero General Public License v3.0

344 stars 233 forks source link

Closed maikwuerth closed 1 year ago

maikwuerth commented 1 year ago

Some updates to the defender export module.

added the time period to queries. to be configured as time shorthand. for example 30d or 1h
fixed export of IPs
changed query for URLs and domains. here I used the query that defender generates for domain hunts
updated queries to be compatible with microsoft 365 defender aswell as defender for endpoint

adulau commented 1 year ago

Great! Thank you for the contribution.