diff --git a/mvt/common/indicators.py b/mvt/common/indicators.py index cbd98fe..01c3eb4 100644 --- a/mvt/common/indicators.py +++ b/mvt/common/indicators.py @@ -23,6 +23,12 @@ class Indicators: self.ioc_processes = [] self.ioc_emails = [] self.ioc_files = [] + self.ioc_count = 0 + + def _add_indicator(self, ioc, iocs_list): + if ioc not in iocs_list: + iocs_list.append(ioc) + self.ioc_count += 1 def parse_stix2(self, file_path): """Extract indicators from a STIX2 file. @@ -45,20 +51,18 @@ class Indicators: if key == "domain-name:value": # We force domain names to lower case. - value = value.lower() - if value not in self.ioc_domains: - self.ioc_domains.append(value) + self._add_indicator(ioc=value.lower(), + iocs_list=self.ioc_domains) elif key == "process:name": - if value not in self.ioc_processes: - self.ioc_processes.append(value) + self._add_indicator(ioc=value, + iocs_list=self.ioc_processes) elif key == "email-addr:value": # We force email addresses to lower case. - value = value.lower() - if value not in self.ioc_emails: - self.ioc_emails.append(value) + self._add_indicator(ioc=value.lower(), + iocs_list=self.ioc_emails) elif key == "file:name": - if value not in self.ioc_files: - self.ioc_files.append(value) + self._add_indicator(ioc=value, + iocs_list=self.ioc_files) def check_domain(self, url): # TODO: If the IOC domain contains a subdomain, it is not currently diff --git a/mvt/ios/cli.py b/mvt/ios/cli.py index af203fe..d46f296 100644 --- a/mvt/ios/cli.py +++ b/mvt/ios/cli.py @@ -153,6 +153,7 @@ def check_backup(ctx, iocs, output, fast, backup_path, list_modules, module): except IndicatorsFileBadFormat as e: log.critical(e) ctx.exit(1) + log.info("Loaded a total of %d indicators", indicators.ioc_count) timeline = [] timeline_detected = [] @@ -215,6 +216,7 @@ def check_fs(ctx, iocs, output, fast, dump_path, list_modules, module): except IndicatorsFileBadFormat as e: log.critical(e) ctx.exit(1) + log.info("Loaded a total of %d indicators", indicators.ioc_count) timeline = [] timeline_detected = [] @@ -274,6 +276,7 @@ def check_iocs(ctx, iocs, list_modules, module, folder): except IndicatorsFileBadFormat as e: log.critical(e) ctx.exit(1) + log.info("Loaded a total of %d indicators", indicators.ioc_count) for file_name in os.listdir(folder): name_only, ext = os.path.splitext(file_name)