Skip to content

Commit 5ad7792

Browse files
regulartimregulartim
authored
Revert "Add IOC type filter to Feeds API and page. Closes GreedyBear-Project#551 (GreedyBear-Project#610)" (GreedyBear-Project#615)
This reverts commit 3367c70.
1 parent 3367c70 commit 5ad7792

8 files changed

Lines changed: 41 additions & 168 deletions

File tree

‎api/serializers.py‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -38,9 +38,7 @@ def validate(self, data):
3838
Check a given observable against regex expression
3939
"""
4040
observable = data["query"]
41-
if re.match(r"^[\d\.]+$", observable) and not re.match(REGEX_IP, observable):
42-
raise serializers.ValidationError("Observable is not a valid IP")
43-
if not re.match(REGEX_IP, observable) and not re.match(REGEX_DOMAIN, observable):
41+
if not re.match(REGEX_IP, observable) or not re.match(REGEX_DOMAIN, observable):
4442
raise serializers.ValidationError("Observable is not a valid IP or domain")
4543
try:
4644
required_object = IOC.objects.get(name=observable)
@@ -97,7 +95,6 @@ def ordering_validation(ordering: str) -> str:
9795
class FeedsRequestSerializer(serializers.Serializer):
9896
feed_type = serializers.CharField(max_length=120)
9997
attack_type = serializers.ChoiceField(choices=["scanner", "payload_request", "all"])
100-
ioc_type = serializers.ChoiceField(choices=["ip", "domain", "all"])
10198
max_age = serializers.IntegerField(min_value=1)
10299
min_days_seen = serializers.IntegerField(min_value=1)
103100
include_reputation = serializers.ListField(child=serializers.CharField(max_length=120))

‎api/views/feeds.py‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -33,9 +33,7 @@ def feeds(request, feed_type, attack_type, prioritize, format_):
3333
"""
3434
logger.info(f"request /api/feeds with params: feed type: {feed_type}, " f"attack_type: {attack_type}, prioritization: {prioritize}, format: {format_}")
3535

36-
feed_params_data = request.query_params.dict()
37-
feed_params_data.update({"feed_type": feed_type, "attack_type": attack_type, "format_": format_})
38-
feed_params = FeedRequestParams(feed_params_data)
36+
feed_params = FeedRequestParams({"feed_type": feed_type, "attack_type": attack_type, "format_": format_})
3937
feed_params.apply_default_filters(request.query_params)
4038
feed_params.set_prioritization(prioritize)
4139

‎api/views/utils.py‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,6 @@ class FeedRequestParams:
4646
Attributes:
4747
feed_type (str): Type of feed to retrieve (default: "all")
4848
attack_type (str): Type of attack to filter (default: "all")
49-
ioc_type (str): Type of IOC to filter - 'ip', 'domain', or 'all' (default: "all")
5049
max_age (str): Maximum number of days since last occurrence (default: "3")
5150
min_days_seen (str): Minimum number of days on which an IOC must have been seen (default: "1")
5251
include_reputation (list): List of reputation values to include (default: [])
@@ -66,7 +65,6 @@ def __init__(self, query_params: dict):
6665
"""
6766
self.feed_type = query_params.get("feed_type", "all").lower()
6867
self.attack_type = query_params.get("attack_type", "all").lower()
69-
self.ioc_type = query_params.get("ioc_type", "all").lower()
7068
self.max_age = query_params.get("max_age", "3")
7169
self.min_days_seen = query_params.get("min_days_seen", "1")
7270
self.include_reputation = query_params["include_reputation"].split(";") if "include_reputation" in query_params else []
@@ -156,9 +154,6 @@ def get_queryset(request, feed_params, valid_feed_types):
156154
if feed_params.attack_type != "all":
157155
query_dict[feed_params.attack_type] = True
158156

159-
if feed_params.ioc_type != "all":
160-
query_dict["type"] = feed_params.ioc_type
161-
162157
query_dict["last_seen__gte"] = datetime.now() - timedelta(days=int(feed_params.max_age))
163158
if int(feed_params.min_days_seen) > 1:
164159
query_dict["number_of_days_seen__gte"] = int(feed_params.min_days_seen)

‎frontend/src/components/feeds/Feeds.jsx‎

Lines changed: 4 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -26,12 +26,6 @@ const attackTypeChoices = [
2626
{ label: "Payload request", value: "payload_request" },
2727
];
2828

29-
const iocTypeChoices = [
30-
{ label: "All", value: "all" },
31-
{ label: "IP addresses", value: "ip" },
32-
{ label: "Domains", value: "domain" },
33-
];
34-
3529
const prioritizationChoices = [
3630
{ label: "Recent", value: "recent" },
3731
{ label: "Persistent", value: "persistent" },
@@ -42,7 +36,6 @@ const prioritizationChoices = [
4236
const initialValues = {
4337
feeds_type: "all",
4438
attack_type: "all",
45-
ioc_type: "all",
4639
prioritize: "recent",
4740
};
4841

@@ -94,7 +87,6 @@ export default function Feeds() {
9487
params: {
9588
feed_type: initialValues.feeds_type,
9689
attack_type: initialValues.attack_type,
97-
ioc_type: initialValues.ioc_type,
9890
prioritize: initialValues.prioritize,
9991
},
10092
initialParams: {
@@ -110,11 +102,10 @@ export default function Feeds() {
110102
(values) => {
111103
try {
112104
setUrl(
113-
`${FEEDS_BASE_URI}/${values.feeds_type}/${values.attack_type}/${values.prioritize}.json?ioc_type=${values.ioc_type}`
105+
`${FEEDS_BASE_URI}/${values.feeds_type}/${values.attack_type}/${values.prioritize}.json`
114106
);
115107
initialValues.feeds_type = values.feeds_type;
116108
initialValues.attack_type = values.attack_type;
117-
initialValues.ioc_type = values.ioc_type;
118109
initialValues.prioritize = values.prioritize;
119110

120111
const resetPage = {
@@ -157,7 +148,7 @@ export default function Feeds() {
157148
{(formik) => (
158149
<Form>
159150
<FormGroup row>
160-
<Col sm={12} md={3}>
151+
<Col sm={12} md={4}>
161152
<Label
162153
className="form-control-label"
163154
htmlFor="Feeds__feeds_type"
@@ -175,7 +166,7 @@ export default function Feeds() {
175166
}}
176167
/>
177168
</Col>
178-
<Col sm={12} md={3}>
169+
<Col sm={12} md={4}>
179170
<Label
180171
className="form-control-label"
181172
htmlFor="Feeds__attack_type"
@@ -193,25 +184,7 @@ export default function Feeds() {
193184
}}
194185
/>
195186
</Col>
196-
<Col sm={12} md={3}>
197-
<Label
198-
className="form-control-label"
199-
htmlFor="Feeds__ioc_type"
200-
>
201-
IOC type:
202-
</Label>
203-
<Select
204-
id="Feeds__ioc_type"
205-
name="ioc_type"
206-
value={initialValues.ioc_type}
207-
choices={iocTypeChoices}
208-
onChange={(e) => {
209-
formik.handleChange(e);
210-
formik.submitForm();
211-
}}
212-
/>
213-
</Col>
214-
<Col sm={12} md={3}>
187+
<Col sm={12} md={4}>
215188
<Label
216189
className="form-control-label"
217190
htmlFor="Feeds__prioritize"

‎frontend/tests/components/feeds/Feeds.test.jsx‎

Lines changed: 2 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -72,8 +72,6 @@ describe("Feeds component", () => {
7272
expect(feedTypeSelectElement).toBeInTheDocument();
7373
const attackTypeSelectElement = screen.getByLabelText("Attack type:");
7474
expect(attackTypeSelectElement).toBeInTheDocument();
75-
const iocTypeSelectElement = screen.getByLabelText("IOC type:");
76-
expect(iocTypeSelectElement).toBeInTheDocument();
7775
const prioritizationSelectElement = screen.getByLabelText("Prioritize:");
7876
expect(prioritizationSelectElement).toBeInTheDocument();
7977

@@ -85,23 +83,13 @@ describe("Feeds component", () => {
8583

8684
await user.selectOptions(feedTypeSelectElement, "log4j");
8785
await user.selectOptions(attackTypeSelectElement, "scanner");
88-
await user.selectOptions(iocTypeSelectElement, "ip");
8986
await user.selectOptions(prioritizationSelectElement, "persistent");
9087

9188
await waitFor(() => {
92-
// check link has been changed including ioc_type parameter
89+
// check link has been changed
9390
expect(buttonRawData).toHaveAttribute(
9491
"href",
95-
"/api/feeds/log4j/scanner/persistent.json?ioc_type=ip"
96-
);
97-
});
98-
99-
// Test selecting domain IOC type
100-
await user.selectOptions(iocTypeSelectElement, "domain");
101-
await waitFor(() => {
102-
expect(buttonRawData).toHaveAttribute(
103-
"href",
104-
"/api/feeds/log4j/scanner/persistent.json?ioc_type=domain"
92+
"/api/feeds/log4j/scanner/persistent.json"
10593
);
10694
});
10795
});

‎tests/__init__.py‎

Lines changed: 0 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -81,36 +81,12 @@ def setUpTestData(cls):
8181
expected_interactions=11.1,
8282
)
8383

84-
cls.ioc_domain = IOC.objects.create(
85-
name="malicious.example.com",
86-
type=iocType.DOMAIN.value,
87-
first_seen=cls.current_time,
88-
last_seen=cls.current_time,
89-
days_seen=[cls.current_time],
90-
number_of_days_seen=1,
91-
attack_count=1,
92-
interaction_count=1,
93-
log4j=True,
94-
cowrie=False,
95-
scanner=False,
96-
payload_request=True,
97-
related_urls=[],
98-
ip_reputation="",
99-
asn=None,
100-
destination_ports=[],
101-
login_attempts=0,
102-
recurrence_probability=0.2,
103-
expected_interactions=5.5,
104-
)
105-
10684
cls.ioc.general_honeypot.add(cls.heralding) # FEEDS
10785
cls.ioc.general_honeypot.add(cls.ciscoasa) # FEEDS
10886
cls.ioc.save()
10987
cls.ioc_2.general_honeypot.add(cls.heralding) # FEEDS
11088
cls.ioc_2.general_honeypot.add(cls.ciscoasa) # FEEDS
11189
cls.ioc_2.save()
112-
cls.ioc_domain.general_honeypot.add(cls.heralding) # FEEDS
113-
cls.ioc_domain.save()
11490

11591
cls.cmd_seq = ["cd foo", "ls -la"]
11692
cls.hash = sha256("\n".join(cls.cmd_seq).encode()).hexdigest()

‎tests/test_serializers.py‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,6 @@ def test_valid_fields(self):
2525
choices = {
2626
"feed_type": ["all", "log4j", "cowrie", "adbhoney"],
2727
"attack_type": ["all", "scanner", "payload_request"],
28-
"ioc_type": ["ip", "domain", "all"],
2928
"max_age": [str(n) for n in [1, 2, 4, 8, 16]],
3029
"min_days_seen": [str(n) for n in [1, 2, 4, 8, 16]],
3130
"include_reputation": [[], ["known attacker"], ["known attacker", "mass scanner"]],

0 commit comments

Comments
 (0)