Merge pull request #706 from TheHive-Project/URLhaus

fqdn support for Url haus
TheHive-Project · Mar 3, 2020 · 4c6106d · 4c6106d
2 parents d5cd95f + 8cda4f0
commit 4c6106d
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 3 deletions.
diff --git a/analyzers/URLhaus/URLhaus.json b/analyzers/URLhaus/URLhaus.json
@@ -6,7 +6,7 @@
   "version": "2.0",
   "baseConfig": "URLhaus",
   "description": "Search domains, IPs, URLs or hashes on URLhaus.",
-  "dataTypeList": ["domain", "url", "hash", "ip"],
+  "dataTypeList": ["domain", "fqdn", "url", "hash", "ip"],
   "command": "URLhaus/URLhaus_analyzer.py",
   "configurationItems": [
   ]

diff --git a/analyzers/URLhaus/URLhaus_analyzer.py b/analyzers/URLhaus/URLhaus_analyzer.py
@@ -15,7 +15,7 @@ def run(self):
         results = {}
         if self.data_type == 'url':
             results = URLhausClient.search_url(data)
-        elif self.data_type in ['domain', 'ip']:
+        elif self.data_type in ['domain', 'fqdn', 'ip']:
             results = URLhausClient.search_host(data)
         elif self.data_type == 'hash':
             if len(data) in [32, 64]:
@@ -50,7 +50,7 @@ def summary(self, raw):
                     'Threat',
                     raw['threat']
                 ))
-            elif self.data_type in ['domain', 'ip']:
+            elif self.data_type in ['domain', 'fqdn', 'ip']:
                 threat_types = []
                 for url in raw['urls']:
                     if url['threat'] not in threat_types: