MCPcopy Create free account
hub / github.com/SpyGuard/SpyGuard / IOCIndex

Class IOCIndex

analysis/classes/engine.py:217–300  ·  view source on GitHub ↗

Pre-index IOCs for fast lookups. Engine keeps legacy attributes (self.bl_* and self._bl_*_map) sourced from this object.

Source from the content-addressed store, hash-verified

215
216
217class IOCIndex:
218 """Pre-index IOCs for fast lookups.
219
220 Engine keeps legacy attributes (self.bl_* and self._bl_*_map) sourced from this object.
221 """
222
223 def __init__(
224 self,
225 *,
226 bl_cidrs: list[list[Any]],
227 bl_hosts: list[list[Any]],
228 bl_asns: list[list[Any]],
229 tor_nodes: list[str],
230 bl_domains: list[list[Any]],
231 bl_freedns: list[list[Any]],
232 bl_certs: list[list[Any]],
233 bl_jarms: list[list[Any]],
234 bl_nameservers: list[list[Any]],
235 bl_tlds: list[list[Any]],
236 bl_issuers: list[list[Any]],
237 enabled_indicator_types: set[str],
238 ) -> None:
239 self.bl_cidrs = bl_cidrs
240 self.bl_hosts = bl_hosts
241 self.bl_asns = bl_asns
242 self.tor_nodes = tor_nodes
243 self.bl_domains = bl_domains
244 self.bl_freedns = bl_freedns
245 self.bl_certs = bl_certs
246 self.bl_jarms = bl_jarms
247 self.bl_nameservers = bl_nameservers
248 self.bl_tlds = bl_tlds
249 self.bl_issuers = bl_issuers
250 self.enabled_indicator_types = enabled_indicator_types
251
252 self.tor_nodes_set = set(self.tor_nodes or [])
253
254 self.bl_hosts_map: dict[str, str] = {}
255 for value, tag in (self.bl_hosts or []):
256 self.bl_hosts_map[value] = tag
257
258 self.bl_asns_map: dict[int, str] = {}
259 for value, tag in (self.bl_asns or []):
260 if value is None:
261 continue
262 s = str(value).strip()
263 if not s:
264 continue
265 m = re.match(r"^(?:AS|as)?\s*(\d+)$", s)
266 if not m:
267 continue
268 try:
269 n = int(m.group(1))
270 except Exception:
271 continue
272 if n > 0:
273 self.bl_asns_map[n] = str(tag or "asn")
274

Callers 1

__init__Method · 0.85

Calls

no outgoing calls

Tested by

no test coverage detected