Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Bug] MineMeld responder domain IOC incorrect type #892

Closed
colin-stubbs opened this issue Nov 11, 2020 · 1 comment · Fixed by #893
Closed

[Bug] MineMeld responder domain IOC incorrect type #892

colin-stubbs opened this issue Nov 11, 2020 · 1 comment · Fixed by #893
Labels
category:bug Issue is related to a bug status:merged

Comments

@colin-stubbs
Copy link
Contributor

Describe the bug

Incorrect case used when assigning IOC type in MineMeld responder.

To Reproduce

Try to use MineMeld responder, experience fail.

Expected behavior

Try to use MineMeld responder, do not experience fail.

Complementary information

diff --git a/responders/Minemeld/minemeld.py b/responders/Minemeld/minemeld.py
index 84285c9..5d569bc 100755
--- a/responders/Minemeld/minemeld.py
+++ b/responders/Minemeld/minemeld.py
@@ -40,7 +40,7 @@ class Minemeld(Responder):
        elif self.observable_type == "url":
          indicator_type = "URL"
        elif self.observable_type == "domain":
-         indicator_type = "Domain"
+         indicator_type = "domain"
        
        # Check for comment
        if self.observable_description == "":

Work environment

  • Client OS: n/a
  • Server OS: n/a
  • Browse type and version: n/a
  • Cortex version:
  • Cortex Analyzer/Responder name: minemeld
  • Cortex Analyzer/Responder version:

Possible solutions

Accept pull request when submitted.

Additional context

n/a

@colin-stubbs
Copy link
Contributor Author

Refer to schema here: https://github.com/PaloAltoNetworks/minemeld-core/blob/master/docs/schema-indicator-0-1.json

In particular type node,

"type": {
            "description": "type of the indicator",
            "type": "string",
            "enum": [
                "IPv4",
                "IPv6",
                "domain",
                "URL",
                "sha512",
                "sha256",
                "sha1",
                "md5",
                "ssdeep",
                "mutex",
                "windows-registry-value",
                "user-agent.fragment",
                "file.name",
                "process.command_line",
                "email-addr",
                "autonomous-system"
            ]
        },

dadokkio added a commit that referenced this issue Nov 11, 2020
[Bug] MineMeld responder domain IOC incorrect type #892
@jeromeleonard jeromeleonard linked a pull request Nov 18, 2020 that will close this issue
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
category:bug Issue is related to a bug status:merged
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants