diff --git a/analyzers/Abuse_Finder/Abuse_Finder.json b/analyzers/Abuse_Finder/Abuse_Finder.json index fd85ab757..9a8a6dce5 100644 --- a/analyzers/Abuse_Finder/Abuse_Finder.json +++ b/analyzers/Abuse_Finder/Abuse_Finder.json @@ -5,7 +5,7 @@ "url": "https://github.com/TheHive-Project/Cortex-Analyzers", "license": "AGPL-V3", "description": "Find abuse contacts associated with domain names, URLs, IPs and email addresses.", - "dataTypeList": ["ip", "domain", "url", "mail"], + "dataTypeList": ["ip", "domain", "fqdn", "url", "mail"], "baseConfig": "Abuse_Finder", "command": "Abuse_Finder/abusefinder.py" } diff --git a/analyzers/Abuse_Finder/abusefinder.py b/analyzers/Abuse_Finder/abusefinder.py index 93fedda29..a0d3cb8ad 100755 --- a/analyzers/Abuse_Finder/abusefinder.py +++ b/analyzers/Abuse_Finder/abusefinder.py @@ -31,6 +31,8 @@ def abuse(self): return ip_abuse(self.get_data()) elif self.data_type == "domain": return domain_abuse(self.get_data()) + elif self.data_type == "fqdn": + return domain_abuse(self.get_data()) elif self.data_type == "mail": return email_abuse(self.get_data()) elif self.data_type == "url": diff --git a/analyzers/C1fApp/C1fApp_osint.json b/analyzers/C1fApp/C1fApp_osint.json index 577a28a67..0647c53cc 100644 --- a/analyzers/C1fApp/C1fApp_osint.json +++ b/analyzers/C1fApp/C1fApp_osint.json @@ -5,7 +5,7 @@ "url": "https://github.com/TheHive-Project/Cortex-Analyzers", "license": "AGPL-V3", "description": "Query C1fApp OSINT Aggregator for IPs, domains and URLs", - "dataTypeList": ["url", "domain", "ip"], + "dataTypeList": ["url", "domain", "fqdn", "ip"], "baseConfig": "C1fApp", "command": "C1fApp/cifquery.py", "configurationItems": [ diff --git a/analyzers/C1fApp/cifquery.py b/analyzers/C1fApp/cifquery.py index fb8bfe26e..76a176974 100755 --- a/analyzers/C1fApp/cifquery.py +++ b/analyzers/C1fApp/cifquery.py @@ -45,6 +45,7 @@ def cleanup(return_data): asn_descs.append(entry.get('asn_desc')) countries.append(entry.get('country')) domains.append(entry.get('domain')) + domains.append(entry.get('fqdn')) dga_indication = entry.get('dga') if len(list(entry.get('ip_address'))) > 0: