MISP WarningLists CIDR notation support

[srilumpa]

Request Type

Bug / Feature

Work Environment

Question	Answer
OS version (server)	Debian
Cortex Analyzer Name	MISPWarningLists
Cortex Analyzer Version	1.0
Cortex Version	1.1.4

Description

Some data shipped by the MISP WarningLists project are IP ranges registered through their CIDR notation. The analyzer is not able to properly check if an IP address is included in those ranges.

Steps to Reproduce

1. Analyze the IP address 139.217.32.10 (included in the 139.217.32.0/24 range from the microsoft-office365-cn list when this issue is registered)
2. The analyzer outputs "No hits"

Possible Solutions

• Having a separate check process for IP data type and checking inclusion instead of equality thanks to the ipaddress python module (https://docs.python.org/3/library/ipaddress.htm)

[3c7]

Already merged. Thanks again, @srilumpa.