drb-ra / C2IntelFeeds

Automatically created C2 Feeds
Other
525 stars 47 forks source link

Print AS number #13

Closed g00g1 closed 1 year ago

g00g1 commented 1 year ago

I think it is good idea to print AS number too, because AS name cannot be used as percise ID.

drb-ra commented 1 year ago

Thank you for the feedback, would tend to agree but trying to not change format from the initial version as other users may be rellying on this format for their own automation.

If you note for some of the files that were added recently that information is there. (e.g. poshc2 and empire json files).

It shouldn't be too hard and probably more accurate to just re-query the IP for it's current ASN.

Hope this helps!

g00g1 commented 1 year ago

trying to not change format from the initial version as other users may be rellying on this format for their own automation

As I can see, in some cases you print AS number, so unsure if it can break something (unless anyone relies on mentions of AS names, which is strange)

drb-ra commented 1 year ago

I'm a bit confused where you are looking for this information now! Is it the tweets or the files in GitHub? I do have both sets of information, in some cases when is used when the other is not available.

g00g1 commented 1 year ago

I came here from tweets, sorry for not saying that earlier :)

I do have both sets of information, in some cases when is used when the other is not available

AS number is always available and can be used to more precisely detect source of abuse. I am using your feed from twitter to monitor a few providers for research purposes, so it will be more convenient if notifications will have AS number to detect interesting tweets automatically.

drb-ra commented 1 year ago

I see... I can update the tweets, that's not a major issue as you said it changes depending on a number of conditions, I can change it to be number preferred.

drb-ra commented 1 year ago

Tweets will now be consistent and show ASN numbers in most cases.

drb-ra commented 1 year ago

Slight tweak will be after the country name (ASxxxxx) as I think most people will still prefer a human readable form too. Hope that works for you!

g00g1 commented 1 year ago

Sure, that's not an issue. Thank for your awesome service!