Have the virustotal_public module use ip-src|port and ip-dst|port as input type

MISP / misp-modules

Modules for expansion services, enrichment, import and export in MISP and other tools.

http://misp.github.io/misp-modules

GNU Affero General Public License v3.0

344 stars 233 forks source link

Closed cudeso closed 4 months ago

cudeso commented 1 year ago

Current module only accepts ['hostname', 'domain', "ip-src", "ip-dst", "md5", "sha1", "sha256", "url"].

With ip-src|port or ip-dst|port: strip the port part, then query for IP with virustotal

adulau commented 4 months ago

Thank for the issue. It's now fixed.