Closed eldraco closed 3 months ago
The domains in this issue are valid domains, so these warning were FPs, we were using validators library to validate these domains.
In the fix i used tldextract, here #890 , now we're no longer getting these FP warnings, however, we still have many warnings because some of our TI feeds do contain invalid domains e.g.
2024/08/06 19:12:16.777268 [Update Manager] The data amazing.lab is not valid. It was found in modules/threat_intelligence/remote_data_files/civilsphereindicators.csv.
2024/08/06 19:15:08.718958 [Update Manager] The data performer.api.naiadsystems.comm is not valid. It was found in modules/threat_intelligence/remote_data_files/adservers.txt.
2024/08/06 19:15:08.756786 [Update Manager] The data fhits.xy is not valid. It was found in modules/threat_intelligence/remote_data_files/adservers.txt.
2024/08/06 19:15:08.757079 [Update Manager] The data www.fhits.xy is not valid. It was found in modules/threat_intelligence/remote_data_files/adservers.txt.
2024/08/06 19:15:08.757363 [Update Manager] The data cdn1.fhits.xy is not valid. It was found in modules/threat_intelligence/remote_data_files/adservers.txt.
2024/08/06 19:15:18.740840 [Update Manager] The data www.xxx.xxx.bucket is not valid. It was found in modules/threat_intelligence/remote_data_files/mifitblocklist.txt.
2024/08/06 19:15:32.602095 [Update Manager] The data 7thebook.gogofinder.com.twvote is not valid. It was found in modules/threat_intelligence/remote_data_files/cps-collected-iocs.intel.
2024/08/06 19:15:32.849274 [Update Manager] The data aenigmatica.ita is not valid. It was found in modules/threat_intelligence/remote_data_files/cps-collected-iocs.intel.
2024/08/06 19:15:32.991267 [Update Manager] The data antikregiseg.hufelh is not valid. It was found in modules/threat_intelligence/remote_data_files/cps-collected-iocs.intel.
2024/08/06 19:15:33.150239 [Update Manager] The data autotouch.netuser is not valid. It was found in modules/threat_intelligence/remote_data_files/cps-collected-iocs.intel.
2024/08/06 19:15:33.165102 [Update Manager] The data awardsdaily.comwp is not valid. It was found in modules/threat_intelligence/remote_data_files/cps-collected-iocs.intel.
2024/08/06 19:15:33.272243 [Update Manager] The data berlin.demix is not valid. It was found in modules/threat_intelligence/remote_data_files/cps-collected-iocs.intel.
2024/08/06 19:15:33.413416 [Update Manager] The data botdevelopment.comcscart is not valid. It was found in modules/threat_intelligence/remote_data_files/cps-collected-iocs.intel.
2024/08/06 19:15:33.655319 [Update Manager] The data chesspro.ruchon is not valid. It was found in modules/threat_intelligence/remote_data_files/cps-collected-iocs.intel.
2024/08/06 19:15:33.956109 [Update Manager] The data desktop.ini is not valid. It was found in modules/threat_intelligence/remote_data_files/cps-collected-iocs.intel.
now any domain with a suffix that doesnt exist in https://publicsuffix.org/list/public_suffix_list.dat is discarded by slips
These domains are really not valid, and we should ignore them
Describe the bug Some threat intelligence files/rows, give errors when processed
To Reproduce Steps to reproduce the behavior:
Expected behavior No errorz
Branch Main
Environment (please complete the following information):