Graylog2 / Graylog2/graylog-plugin-threatintel

OTX lookup result doesn't use validation informations from the OTX response

Open
#102 2 comments 3 reactions 0 assignees View on GitHub
feature triaged
Dominant language
Java
Stars
158
Forks
18
PR merge metrics
No merged PRs in 30d

Description

**As-Is**: [OTXLookupResult](https://github.com/Graylog2/graylog-plugin-threatintel/blob/master/src/main/java/org/graylog/plugins/threatintel/functions/otx/OTXLookupResult.java) checks in the result only non-zero count of pulses. But some of the results have `validation` field, where can be found information about whitelisting of IP/Domain (not malicious, even if found in pulses). This causes return of the false positive result into Graylog.

**To-Be**: OTXLookupResult should check the occurence of validation key first and if it is false, then continue with checking the non-zero count of pulses.

**Example of the result** from OTX API, indicator IPv4, IP=8.8.8.8
```
...
"validation": [
{
"message": "suspiciously short IP (len: 7)",
"name": "Suspicious IP format / Possible version number",
"source": "suspicious"
},
{
"message": "contained in 8.8.8.8",
"name": "Whitelisted IP",
"source": "whitelist"
}
],
...
```
**Example**: for inspiration, here is code in Python [OTX-Python-SDK example](https://github.com/AlienVault-OTX/OTX-Python-SDK/blob/master/examples/is_malicious/get_malicious.py), function `def ip()`

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.