Fixing a few Host indicator related bugs in thresher and winnower

mlsecproject / combine

Tool to gather Threat Intelligence indicators from publicly available sources

https://www.mlsecproject.org/

GNU General Public License v3.0

655 stars 171 forks source link

Closed alexcpsec closed 10 years ago

alexcpsec commented 10 years ago

Our output documentation (and tiq-test) expect the indicator name to be "FQDN" and not "DNS"
The domain regex was not being matched as ignore-case, so a bunch of missed stuff there
For some weird reason, there was no IN (India) on our regex pattern

krmaxwell commented 10 years ago

Looks good on first inspection. Have you run / tested it?

alexcpsec commented 10 years ago

"Works on my machine"TM

krmaxwell commented 10 years ago

:shipit: