IP type for CIRCL Passive DNS and others

[ppanero]

IP type for CIRCL Passive DNS and others.

Request Type

Feature

Work Environment

Question	Answer
OS version (server)	CentOS
OS version (client)	7
Cortex Analyzer Name	CIRCLPassiveDNS
Cortex Analyzer Version	latest
Cortex Version	latest
Browser type & version	N/A

Description

In the CIRCL passive DNS analyzer only domain and url types are listed. However in the pypdns module IPs can also be queried. I have already made the extension for it and I could make a PR, but I also found that IPs pass the domain/url filters since they dont have '/' and http to split (therefore the query succeeds.

Possible Solutions

1- Do you want the PR
2- Do you want me to do stronger checks (url is url, domain domain and IP ip? or leave it as it is

[saadkadhi]

Hi @ppanero thanks. @jeromeleonard will contact you as soon as feasible.

[saadkadhi]

@jeromeleonard any update on this front? Thanks.

[jeromeleonard]

Hi @ppanero,

We would be pleased to review your PR to improve the analyzer. If you do so, could you please base the PR on the develop branch ?

Thx.

J.