[kaspersky-enrichment] Add IPV4 enrichment #5404
Conversation
…ck for first and last seen
Ninoxe
added
feature
Ninoxe
requested review from
Kakudou,
Megafredo,
Powlinett,
helene-nguyen,
jabesq,
mariot and
throuxel
mariot
left a comment
mariot
left a comment
There was a problem hiding this comment.
Generally, it works very well :)
Just a few things before merging: the new objects lack an author and markings.
You should send an Identity and Marking-Definition objects in the bundle and link them to each object.
You should also send back the original bundle even if there is an exception during the enrichment.
You can ignore the code suggestions if you don't have the time.
| if last_seen == first_seen: | ||
| return True | ||
| return False |
There was a problem hiding this comment.
| if last_seen == first_seen: | |
| return True | |
| return False | |
| return last_seen == first_seen |
| self.helper.connector_logger.info("[CONNECTOR] Starting enrichment...") | ||
|
|
||
| # Retrieve ipv4 | ||
| obs_ipv4 = observable["value"] |
There was a problem hiding this comment.
Maybe use observable_to_ref.id for the type checker?
| if entity_info["DayRequests"] >= entity_info["DayQuota"]: | ||
| return True | ||
| return False |
There was a problem hiding this comment.
| if entity_info["DayRequests"] >= entity_info["DayQuota"]: | |
| return True | |
| return False | |
| return entity_info["DayRequests"] >= entity_info["DayQuota"] |
| from datetime import datetime, timezone | ||
|
|
||
|
|
||
| def check_quota(entity_info: dict) -> bool: |
There was a problem hiding this comment.
Consider using names like is_quota_exceeded or something
| if entity_type in scopes: | ||
| return True | ||
| else: | ||
| return False |
There was a problem hiding this comment.
| if entity_type in scopes: | |
| return True | |
| else: | |
| return False | |
| return entity_type in scopes |
| def resolve_file_hash(observable: dict) -> str: | ||
| if "hashes" in observable and "SHA-256" in observable["hashes"]: | ||
| return observable["hashes"]["SHA-256"] | ||
| if "hashes" in observable and "SHA-1" in observable["hashes"]: | ||
| return observable["hashes"]["SHA-1"] | ||
| if "hashes" in observable and "MD5" in observable["hashes"]: | ||
| return observable["hashes"]["MD5"] | ||
| raise ValueError( | ||
| "Unable to enrich the observable, the observable does not have an SHA256, SHA1, or MD5" | ||
| ) |
There was a problem hiding this comment.
| def resolve_file_hash(observable: dict) -> str: | |
| if "hashes" in observable and "SHA-256" in observable["hashes"]: | |
| return observable["hashes"]["SHA-256"] | |
| if "hashes" in observable and "SHA-1" in observable["hashes"]: | |
| return observable["hashes"]["SHA-1"] | |
| if "hashes" in observable and "MD5" in observable["hashes"]: | |
| return observable["hashes"]["MD5"] | |
| raise ValueError( | |
| "Unable to enrich the observable, the observable does not have an SHA256, SHA1, or MD5" | |
| ) | |
| def resolve_file_hash(observable: dict) -> str: | |
| hashes = observable.get("hashes", {}) | |
| for key in ("SHA-256", "SHA-1", "MD5"): | |
| if key in hashes: | |
| return hashes[key] | |
| raise ValueError( | |
| "Unable to enrich the observable, the observable does not have an SHA256, SHA1, or MD5" | |
| ) |
| return False | ||
|
|
||
|
|
||
| def resolve_file_hash(observable: dict) -> str: |
There was a problem hiding this comment.
Consider sending directly hashes instead of observable
| OpenCTIStix2.put_attribute_in_extension( | ||
| observable, STIX_EXT_OCTI_SCO, "score", score | ||
| ) |
There was a problem hiding this comment.
observable variable is changed by the method, yes; but it would be more readable if you caught the returned object like
| OpenCTIStix2.put_attribute_in_extension( | |
| observable, STIX_EXT_OCTI_SCO, "score", score | |
| ) | |
| observable = OpenCTIStix2.put_attribute_in_extension( | |
| observable, STIX_EXT_OCTI_SCO, "score", score | |
| ) |
| entity_general_info["CountryCode"] | ||
| ) | ||
|
|
||
| if obs_country: |
There was a problem hiding this comment.
obs_country is never None, right?
WARNING: PR can't work without Reference models (see issue #5405 )
Proposed changes
Related issues
Checklist