Created
September 6, 2012 15:27
-
-
Save krmaxwell/3657361 to your computer and use it in GitHub Desktop.
Maltego-CIF troubleshooting
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
When I run my test script (https://github.com/technoskald/maltegoxforms/blob/master/cif-maltego.py) against a test IP address, I get the appropriate JSON back from my API call and then use the MaltegoTransform.py library from Andrew MacPherson to create and return the entities. output.xml above shows the XML from the Debug tab in the Output pane, but the Transform Output tab says "Transform CIF lookup returned with 0 entities." |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
<MaltegoMessage> | |
<MaltegoTransformResponseMessage> | |
<Entities> | |
<Entity Type="URL"> | |
<Value>http://www.autoshun.org</Value> | |
<Weight>100</Weight> | |
<AdditionalFields> | |
<Field Name="Description" DisplayName="Description">driveby malware</Field> | |
<Field Name="Confidence" DisplayName="Confidence">50</Field> | |
<Field Name="Impact" DisplayName="General impact">scanner infrastructure</Field> | |
<Field Name="Time" DisplayName="Time of observation">2012-09-04T12:51:19Z</Field> | |
</AdditionalFields> | |
</Entity> | |
<Entity Type="URL"> | |
<Value>alienvault reputation DB https://reputation.alienvault.com/reputation.generic</Value> | |
<Weight>100</Weight> | |
<AdditionalFields> | |
<Field Name="Description" DisplayName="Description">malicious host</Field> | |
<Field Name="Confidence" DisplayName="Confidence">65</Field> | |
<Field Name="Impact" DisplayName="General impact">botnet infrastructure</Field> | |
<Field Name="Time" DisplayName="Time of observation">2012-09-05T00:00:00Z</Field> | |
</AdditionalFields> | |
</Entity> | |
<Entity Type="URL"> | |
<Value>alienvault reputation DB https://reputation.alienvault.com/reputation.generic</Value> | |
<Weight>100</Weight> | |
<AdditionalFields> | |
<Field Name="Description" DisplayName="Description">malicious host</Field> | |
<Field Name="Confidence" DisplayName="Confidence">65</Field> | |
<Field Name="Impact" DisplayName="General impact">botnet infrastructure</Field> | |
<Field Name="Time" DisplayName="Time of observation">2012-09-06T00:00:00Z</Field> | |
</AdditionalFields> | |
</Entity> | |
</Entities> | |
<UIMessages> | |
</UIMessages> | |
</MaltegoTransformResponseMessage> | |
</MaltegoMessage> |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment