With the UI search and Bulk search, it would be useful to search against example.com as well as example[.]com as we may receive large amounts of defanged IOCs we would like to search for
Current Workaround
Removing the brackets
Proposed Solution
clean search input for common methods of defanging
Sample (likely overly simple) approach
def refang_indicator(self, indicator: str) -> str:
"""
Makes those IOCs more spicy 🔥
:indicator: The indicator to defang
Example `malwarz[.]co` -> `malwarz.co`
"""
return indicator \
.replace(']', '') \
.replace('[', '') \
.replace('(', '') \
.replace(')', '')
Additional Information
N/A
If the feature request is approved, would you be willing to submit a PR?
Use case
With the UI search and Bulk search, it would be useful to search against example.com as well as example[.]com as we may receive large amounts of defanged IOCs we would like to search for
Current Workaround
Removing the brackets
Proposed Solution
clean search input for common methods of defanging
Sample (likely overly simple) approach
Additional Information
N/A
If the feature request is approved, would you be willing to submit a PR?
Yep!
Thanks Y'all!