CalvinBackup/mvt
1
0
Fork 0
mirror of https://github.com/mvt-project/mvt.git synced 2026-08-17 16:37:23 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add basic support for IP indicators in MVT (#556)

Browse Source 
* Add prelimary ipv4-addr ioc matching support under collection domains

* Add IP addresses as a valid IOC type

This currently just supports IPv4 addresses which
are treated as domains internally in MVT.

---------

Co-authored-by: renini <renini@local>
This commit is contained in:
Donncha Ó Cearbhaill
2024-10-17 18:20:17 +02:00
committed by GitHub
co-authored by renini
parent 5ef19a327c
commit 81b647beac
3 changed files with 24 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/common/test_indicators.py
+7 -3
View File
@@ -15,8 +15,8 @@ class TestIndicators:
ind = Indicators(log=logging)
ind.load_indicators_files([indicator_file], load_default=False)
assert len(ind.ioc_collections) == 1
assert ind.ioc_collections[0]["count"] == 8
assert len(ind.ioc_collections[0]["domains"]) == 1
assert ind.ioc_collections[0]["count"] == 9
assert len(ind.ioc_collections[0]["domains"]) == 2
assert len(ind.ioc_collections[0]["emails"]) == 1
assert len(ind.ioc_collections[0]["file_names"]) == 1
assert len(ind.ioc_collections[0]["processes"]) == 1
@@ -74,6 +74,10 @@ class TestIndicators:
assert ind.check_url("https://github.com") is None
assert ind.check_url("https://example.com/") is None
# Test detecting IP address indicators from STIX.
assert ind.check_url("https://198.51.100.1:8080/")
assert ind.check_url("https://1.1.1.1/") is None
def test_check_file_hash(self, indicator_file):
ind = Indicators(log=logging)
ind.load_indicators_files([indicator_file], load_default=False)
@@ -98,4 +102,4 @@ class TestIndicators:
os.environ["MVT_STIX2"] = indicator_file
ind = Indicators(log=logging)
ind.load_indicators_files([], load_default=False)
assert ind.total_ioc_count == 8
assert ind.total_ioc_count == 9