bad endpoint in misp_modules/modules/expansion/intel471.py

[MathiasVbech]

The module uses the v1/ioc endpoint.

This endpoint almost always returns “nothing found.”

The v1/indicators or v1/search endpoint seems to be a better alternative, at least based on our observations.

[adulau]

Did Intel471 change their API recently?

[MathiasVbech]

I do not know if the API changed recently.

From my own observations, the /v1/ioc endpoint seems to only contain a small subset of IOCs only the IOCs in Intel471's intelligence reports, not data from other data streams on their platform (Malware, Sources, News, Search, etc.). /v1/indicators or /v1/search seem to hit a much larger set of IOCs, similar to using the search function on their platform. /v1/search might be the better option.

I don't know if this result is from a change in the API, or a design choice for the module to only use adversary reports. But I can say from our use case, this module returns primarily "Nothing has been found" on every IOC in our MISP, even though there is data about the IOC on Intel471's platform if i use the search function.