diff --git a/Packs/DomainTools_Iris/IndicatorFields/indicatorfield-domaintoolsirisriskscorecomponents.json b/Packs/DomainTools_Iris/IndicatorFields/indicatorfield-domaintoolsirisriskscorecomponents.json index 2844c133be74..4250b54dfbe6 100644 --- a/Packs/DomainTools_Iris/IndicatorFields/indicatorfield-domaintoolsirisriskscorecomponents.json +++ b/Packs/DomainTools_Iris/IndicatorFields/indicatorfield-domaintoolsirisriskscorecomponents.json @@ -18,7 +18,8 @@ "group": 2, "hidden": false, "openEnded": false, - "associatedToAll": true, + "associatedToAll": false, + "associatedTypes": ["DomainTools Iris"], "unmapped": false, "unsearchable": false, "caseInsensitive": true, diff --git a/Packs/DomainTools_Iris/Scripts/CheckPivotableDomains/CheckPivotableDomains.py b/Packs/DomainTools_Iris/Scripts/CheckPivotableDomains/CheckPivotableDomains.py index 4143220ed398..001110b54673 100644 --- a/Packs/DomainTools_Iris/Scripts/CheckPivotableDomains/CheckPivotableDomains.py +++ b/Packs/DomainTools_Iris/Scripts/CheckPivotableDomains/CheckPivotableDomains.py @@ -256,13 +256,13 @@ def check_pivotable_domains(args: dict[str, Any]) -> CommandResults: results["PivotableNameServerHost"]["pivotable"] = True results["PivotableNameServerHost"]["items"] = pivotable_ns_hosts - pivotable_ns_ips = check_pivotable_nameserver_ip(domain_hosting_data.get("NameServers"), max_name_server_ip_count) + pivotable_ns_ips = check_pivotable_nameserver_ip(domain_hosting_data.get("NameServers") or [], max_name_server_ip_count) if len(pivotable_ns_ips) > 0: results["PivotableNameServerIp"]["pivotable"] = True results["PivotableNameServerIp"]["items"] = pivotable_ns_ips pivotable_ns_domains = check_pivotable_nameserver_host_or_domain( - domain_hosting_data.get("NameServers"), "domain", max_name_server_domain_count + domain_hosting_data.get("NameServers") or [], "domain", max_name_server_domain_count ) if len(pivotable_ns_domains) > 0: results["PivotableNameServerDomain"]["pivotable"] = True @@ -270,14 +270,14 @@ def check_pivotable_domains(args: dict[str, Any]) -> CommandResults: # Registrant pivotable_registrant_contact_name = check_pivotable_registrant_contact_name( - domain_identity_data.get("RegistrantContact"), max_registrant_contact_name_count + domain_identity_data.get("RegistrantContact") or {}, max_registrant_contact_name_count ) if pivotable_registrant_contact_name is not None: results["PivotableRegistrantContactName"]["pivotable"] = True results["PivotableRegistrantContactName"]["items"] = pivotable_registrant_contact_name pivotable_registrant_org_name = check_pivotable_registrant_org( - domain_identity_data.get("RegistrantContact"), max_registrant_org_count + domain_identity_data.get("RegistrantContact") or {}, max_registrant_org_count ) if pivotable_registrant_org_name is not None: results["PivotableRegistrantOrg"]["pivotable"] = True @@ -291,7 +291,7 @@ def check_pivotable_domains(args: dict[str, Any]) -> CommandResults: # SSL pivotable_ssl_org = check_pivotable_ssl_info( - domain_hosting_data.get("SSLCertificate"), + domain_hosting_data.get("SSLCertificate") or [], "organization", max_ssl_info_organization_count, ) @@ -299,58 +299,64 @@ def check_pivotable_domains(args: dict[str, Any]) -> CommandResults: results["PivotableSslInfoOrganization"]["pivotable"] = True results["PivotableSslInfoOrganization"]["items"] = pivotable_ssl_org - pivotable_ssl_hash = check_pivotable_ssl_info(domain_hosting_data.get("SSLCertificate"), "hash", max_ssl_info_hash_count) + pivotable_ssl_hash = check_pivotable_ssl_info( + domain_hosting_data.get("SSLCertificate") or [], "hash", max_ssl_info_hash_count + ) if len(pivotable_ssl_hash) > 0: results["PivotableSslInfoHash"]["pivotable"] = True results["PivotableSslInfoHash"]["items"] = pivotable_ssl_hash - pivotalbe_ssl_subject = check_pivotable_ssl_info(domain_hosting_data.get("SSLCertificate"), "subject", max_ssl_subject_count) + pivotalbe_ssl_subject = check_pivotable_ssl_info( + domain_hosting_data.get("SSLCertificate") or [], "subject", max_ssl_subject_count + ) if len(pivotalbe_ssl_subject) > 0: results["PivotableSslSubject"]["pivotable"] = True results["PivotableSslSubject"]["items"] = pivotalbe_ssl_subject # PivotableSslEmail - pivotable_ssl_email = check_pivotable_ssl_email(domain_hosting_data.get("SSLCertificate"), max_ssl_email_count) + pivotable_ssl_email = check_pivotable_ssl_email(domain_hosting_data.get("SSLCertificate") or [], max_ssl_email_count) if len(pivotable_ssl_email) > 0: results["PivotableSslEmail"]["pivotable"] = True results["PivotableSslEmail"]["items"] = pivotable_ssl_email # SOA - pivotable_soa_email = check_pivotable_soa_email(domain_identity_data.get("SOAEmail"), max_soa_email_count) + pivotable_soa_email = check_pivotable_soa_email(domain_identity_data.get("SOAEmail") or [], max_soa_email_count) if len(pivotable_soa_email) > 0: results["PivotableSoaEmail"]["pivotable"] = True results["PivotableSoaEmail"]["items"] = pivotable_soa_email - pivotable_ip_address = check_pivotable_ip_address(domain_hosting_data.get("IPAddresses"), max_ip_address_count) + pivotable_ip_address = check_pivotable_ip_address(domain_hosting_data.get("IPAddresses") or [], max_ip_address_count) if len(pivotable_ip_address) > 0: results["PivotableIpAddress"]["pivotable"] = True results["PivotableIpAddress"]["items"] = pivotable_ip_address - pivotable_mx_ip = check_pivotable_mx_ip(domain_hosting_data.get("MailServers"), max_mx_ip_count) + pivotable_mx_ip = check_pivotable_mx_ip(domain_hosting_data.get("MailServers") or [], max_mx_ip_count) if len(pivotable_mx_ip) > 0: results["PivotableMxIp"]["pivotable"] = True results["PivotableMxIp"]["items"] = pivotable_mx_ip - pivotable_mx_host = check_pivotable_mx_host_or_domain(domain_hosting_data.get("MailServers"), "host", max_mx_host_count) + pivotable_mx_host = check_pivotable_mx_host_or_domain(domain_hosting_data.get("MailServers") or [], "host", max_mx_host_count) if len(pivotable_mx_host) > 0: results["PivotableMxHost"]["pivotable"] = True results["PivotableMxHost"]["items"] = pivotable_mx_host - pivotable_mx_domain = check_pivotable_mx_host_or_domain(domain_hosting_data.get("MailServers"), "domain", max_mx_domain_count) + pivotable_mx_domain = check_pivotable_mx_host_or_domain( + domain_hosting_data.get("MailServers") or [], "domain", max_mx_domain_count + ) if len(pivotable_mx_domain) > 0: results["PivotableMxDomain"]["pivotable"] = True results["PivotableMxDomain"]["items"] = pivotable_mx_domain # Google props pivotable_google_analytics = check_pivotable_google_props( - domain_analytics_data.get("GoogleAnalyticTrackingCode"), max_google_analytics_count + domain_analytics_data.get("GoogleAnalyticTrackingCode") or {}, max_google_analytics_count ) if pivotable_google_analytics is not None: results["PivotableGoogleAnalytics"]["pivotable"] = True results["PivotableGoogleAnalytics"]["item"] = pivotable_google_analytics pivotable_google_adsense = check_pivotable_google_props( - domain_analytics_data.get("GoogleAdsenseTrackingCode"), max_google_adsense_count + domain_analytics_data.get("GoogleAdsenseTrackingCode") or {}, max_google_adsense_count ) if pivotable_google_adsense is not None: results["PivotableAdsense"]["pivotable"] = True diff --git a/Packs/DomainTools_Iris/Scripts/CheckPivotableDomains/CheckPivotableDomains_test.py b/Packs/DomainTools_Iris/Scripts/CheckPivotableDomains/CheckPivotableDomains_test.py index 8485fea19b8e..44206302683f 100644 --- a/Packs/DomainTools_Iris/Scripts/CheckPivotableDomains/CheckPivotableDomains_test.py +++ b/Packs/DomainTools_Iris/Scripts/CheckPivotableDomains/CheckPivotableDomains_test.py @@ -237,3 +237,56 @@ def test_check_pivotable_output(mocker): assert results[0]["Type"] == entryTypes["note"] assert results[0]["ContentsFormat"] == formats["json"] assert results[0]["Contents"] == expected_context + + +def test_check_pivotable_null_fields(mocker): + """Script should not crash when hosting/identity/analytics fields are null.""" + domaintools_data = { + "Name": "example.com", + "Analytics": { + "GoogleAdsenseTrackingCode": None, + "GoogleAnalyticTrackingCode": None, + }, + "Identity": { + "RegistrantContact": None, + "Registrar": None, + "SOAEmail": None, + }, + "Hosting": { + "NameServers": None, + "SSLCertificate": None, + "IPAddresses": None, + "MailServers": None, + }, + } + + mocker.patch.object( + demisto, + "args", + return_value={ + "domaintools_data": domaintools_data, + "max_name_server_host_count": "250", + "max_name_server_ip_count": "250", + "max_name_server_domain_count": "250", + "max_registrant_contact_name_count": "200", + "max_registrant_org_count": "200", + "max_registrar_count": "200", + "max_ssl_info_organization_count": "350", + "max_ssl_info_hash_count": "350", + "max_ssl_email_count": "350", + "max_ssl_subject_count": "350", + "max_soa_email_count": "200", + "max_ip_address_count": "200", + "max_mx_ip_count": "200", + "max_mx_host_count": "200", + "max_mx_domain_count": "200", + "max_google_adsense_count": "200", + "max_google_analytics_count": "200", + }, + ) + mocker.patch.object(demisto, "results") + main() + + results = demisto.results.call_args[0] + assert results[0]["Contents"]["Name"] == "example.com" + assert all(not v.get("pivotable") for v in results[0]["Contents"].values() if isinstance(v, dict))