lib/mihari/analyzers/pulsedive.rb in mihari-3.12.0 vs lib/mihari/analyzers/pulsedive.rb in mihari-4.0.0
- old
+ new
@@ -6,13 +6,10 @@
module Analyzers
class Pulsedive < Base
include Mixins::Refang
param :query
- option :title, default: proc { "Pulsedive search" }
- option :description, default: proc { "query = #{query}" }
- option :tags, default: proc { [] }
attr_reader :type
def initialize(*args, **kwargs)
super
@@ -45,20 +42,25 @@
end
#
# Search
#
- # @return [Array<String>]
+ # @return [Array<Mihari::Artifact>]
#
def search
raise InvalidInputError, "#{query}(type: #{type || "unknown"}) is not supported." unless valid_type?
indicator = api.indicator.get_by_value(query)
iid = indicator["iid"]
properties = api.indicator.get_properties_by_id(iid)
(properties["dns"] || []).filter_map do |property|
- property["value"] if ["A", "PTR"].include?(property["name"])
+ if ["A", "PTR"].include?(property["name"])
+ nil
+ else
+ data = property["value"]
+ Artifact.new(data: data, source: source, metadata: property)
+ end
end
end
end
end
end