search

csirtgadgets / massive-octo-spice

DEPRECATED - USE v3 (bearded-avenger)
https://github.com/csirtgadgets/bearded-avenger-deploymentkit/wiki
GNU Lesser General Public License v3.0
227 stars 62 forks source link

bro export issue? #441

Closed villain closed 7 years ago

villain commented 8 years ago

not sure if this is a user error or not. when i run the following command, to export data into a bro format file:

cif --tags vendor --days 20 -f bro --feed --otype md5

i end up with:

cb0c100470335e8f0bd4e09042baa5fb md5 vendor|malware 85 vendor1 cc81033bb2dcfc413f53ccb2da3f3f51 md5 vendor|malware 85 vendor1

but the supported types of intel indicators for bro are:

Intel::ADDR Intel::URL Intel::SOFTWARE Intel::EMAIL Intel::DOMAIN Intel::USER_NAME Intel::FILE_HASH Intel::FILE_NAME Intel::CERT_HASH

i believe the md5 needs to be Intel::FILE_HASH

--otype sha1 is also affected

wesyoung commented 8 years ago

my guess is we'll have to add those types here:

https://github.com/csirtgadgets/cif-sdk-py/blob/master/cifsdk/format/bro.py#L9

which maps to the correct bro output?