lib/mihari/analyzers/pulsedive.rb in mihari-3.12.0 vs lib/mihari/analyzers/pulsedive.rb in mihari-4.0.0

- old
+ new

@@ -6,13 +6,10 @@ module Analyzers class Pulsedive < Base include Mixins::Refang param :query - option :title, default: proc { "Pulsedive search" } - option :description, default: proc { "query = #{query}" } - option :tags, default: proc { [] } attr_reader :type def initialize(*args, **kwargs) super @@ -45,20 +42,25 @@ end # # Search # - # @return [Array<String>] + # @return [Array<Mihari::Artifact>] # def search raise InvalidInputError, "#{query}(type: #{type || "unknown"}) is not supported." unless valid_type? indicator = api.indicator.get_by_value(query) iid = indicator["iid"] properties = api.indicator.get_properties_by_id(iid) (properties["dns"] || []).filter_map do |property| - property["value"] if ["A", "PTR"].include?(property["name"]) + if ["A", "PTR"].include?(property["name"]) + nil + else + data = property["value"] + Artifact.new(data: data, source: source, metadata: property) + end end end end end end