Abuse_Finder_2_0 - Invalid analyzer output format

[nadouani]

By @MAXXIT4HACK

Hi,

During the setup and validation of TheHive and Cortex analyzers. I have an error with the Abuse_Finder analyzer output. Any clues, as to the issue or is this expected output? The outup of the job is below:

{
"errorMessage": "Invalid analyzer output format : {"artifacts":[{"type":"fqdn","value":"abf.co.uk"}],"full":{"abuse_finder":{"raw":"\r\n Domain name:\r\n abf.co.uk\r\n\r\n Registrant:\r\n Associated British Foods plc\r\n\r\n Registrant type:\r\n Unknown\r\n\r\n Registrant's address:\r\n Weston Centre\r\n 10 Grosvenor Street\r\n London\r\n EN\r\n W1K 4QY\r\n United Kingdom\r\n\r\n Data validation:\r\n Nominet was able to match the registrant's name and address against a 3rd party data source on 29-Jul-2014\r\n\r\n Registrar:\r\n Corporation Service Company (UK) Limited [Tag = CSC-CORP-DOMAINS]\r\n URL: http://www.cscprotectsbrands.com\\r\\n\\r\\n Relevant dates:\r\n Registered on: before Aug-1996\r\n Expiry date: 28-Jan-2019\r\n Last updated: 24-Jan-2018\r\n\r\n Registration status:\r\n Registered until expiry date.\r\n\r\n Name servers:\r\n ns.domainnetwork.se\r\n ns2.domainnetwork.se\r\n\r\n WHOIS lookup made at 09:22:33 27-Feb-2018\r\n\r\n-- \r\nThis WHOIS information is provided for free by Nominet UK the central registry\r\nfor .uk domain names. This information and the .uk WHOIS are:\r\n\r\n Copyright Nominet UK 1996 - 2018.\r\n\r\nYou may not access the .uk WHOIS or use any data from it except as permitted\r\nby the terms of use available in full at http://www.nominet.uk/whoisterms,\\r\\nwhich includes restrictions on: (A) use of the data for advertising, or its\r\nrepackaging, recompilation, redistribution or reuse (B) obscuring, removing\r\nor hiding any or all of this notice and (C) exceeding query rate or volume\r\nlimits. The data is provided on an 'as-is' basis and may lag behind the\r\nregister. Access may be withdrawn or restricted at any time. \r\n","abuse":[],"names":["Corporation Service Company (UK) Limited [Tag = CSC-CORP-DOMAINS]"],"value":"abf.co.uk"}},"success":true,"summary":null}",
"input": null,
"success": false
}

Thanks
MAXXIT4HACK

[3c7]

Note: Not directly related, but if pushing changes to that analyzer maybe considering #161.

[nadouani]

looks like both issues are related, the fix of #211 also solves #161

[MAXXIT4HACK]

Thank you all for your feedback.