carbonblack / cbfeeds

Carbon Black Feeds
Other
70 stars 31 forks source link

Timestamp field is not checked #19

Open edeca opened 5 years ago

edeca commented 5 years ago

The documentation says that timestamp is required for report. However, a feed without timestamps passes validation:

{"reports": [{"link": "https://nccgroup.com/blog/", "id": "50d858e0985ecc7f60418aaf0cc5ab587f42c2570a884095a9e8ccacd0f6545c", "score": 50, "title": "IOCs from NCC Group APT123 blog post", "iocs": {"ipv6": ["2001:DB8::1"], "ipv4": ["203.0.113.17"], "md5": ["79054025255fb1a26e4bc422aef54eb4"], "dns": ["rat.example.com"]}} ], "feedinfo": {"summary": "This is my feed", "tech_data": "Some technical data", "provider_url": "https://nccgroup.com/", "display_name": "NCC Group collated feed", "name": "nccgroup"}}

Checking this shows:

-> % python validate_feed.py -f test.json
-> Validated that file exists and is readable
-> Validated that feed file is valid JSON
-> Validated that the feed file includes all necessary CB elements
-> Validated that all element values are within CB feed requirements