misp-modules icon indicating copy to clipboard operation
misp-modules copied to clipboard

Have the virustotal_public module use ip-src|port and ip-dst|port as input type

Open cudeso opened this issue 2 years ago • 0 comments

Current module only accepts ['hostname', 'domain', "ip-src", "ip-dst", "md5", "sha1", "sha256", "url"].

With ip-src|port or ip-dst|port: strip the port part, then query for IP with virustotal

cudeso avatar Aug 08 '23 05:08 cudeso