Merge pull request #3 from SEKOIA-IO/feat-valid-indicators-and-persis…

…tence App improvements
SEKOIA-IO · Dec 17, 2020 · 7f43014 · 7f43014
2 parents 848a337 + 10149f7
commit 7f43014
Show file tree

Hide file tree

Showing 257 changed files with 38 additions and 18 deletions.
diff --git a/.gitignore b/.gitignore
@@ -0,0 +1,8 @@
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[cod]
+*$py.class
+
+# Splunk local configuration files
+local/
+metadata/local.meta
diff --git a/README.md b/README.md
@@ -29,4 +29,4 @@ For each lookup, a saved search is automatically created and scheduled to run on
 
 Sightings are stored in the `sekoia_alerts` KV-store and listed on the home Dashboard.
 
-Clicking on the `matched_ioc` will open the Intelligence Center to see context aroung matched indicator.
+Clicking on the `matched_ioc` will open the Intelligence Center to see context around matched indicator.
diff --git a/README/inputs.conf.spec b/README/inputs.conf.spec
@@ -1,5 +1,4 @@
 [sekoia_indicators://<name>]
 
-interval = 1800
 api_key = <value>
 feed_id = <value>
diff --git a/bin/sekoia_indicators.py b/bin/sekoia_indicators.py
@@ -29,6 +29,13 @@
 }
 
 
+def from_rfc3339(date_string):
+    try:
+        return datetime.strptime(date_string, "%Y-%m-%dT%H:%M:%S.%fZ")
+    except ValueError:
+        return datetime.strptime(date_string, "%Y-%m-%dT%H:%M:%SZ")
+
+
 class SEKOIAIndicators(Script):
     def __init__(self):
         self._splunk = None
@@ -169,22 +176,26 @@ def revoke_indicator(self, kv_objects):
             for obj in objects:
                 try:
                     self.get_kvstore(ioc_type).delete_by_id(obj["_key"])
-                # TODO: improve error handling here
                 except Exception:
                     pass
 
     # Store indicators in Splunk KV-Stores
     def store_indicators(self, indicators):
         objects = defaultdict(list)
+        now = datetime.utcnow()
 
         for indicator in indicators:
             kv_objects = self.indicator_to_kv(indicator)
 
             if indicator.get("revoked", False):
                 self.revoke_indicator(kv_objects)
-            else:
-                for ioc_type, dicts in six.iteritems(kv_objects):
-                    objects[ioc_type] += dicts
+            # Only import IOCs with a Valid Until date set
+            elif indicator.get("valid_until"):
+                # Ignore expired indicators
+                valid_until = from_rfc3339(indicator["valid_until"])
+                if valid_until > now:
+                    for ioc_type, dicts in six.iteritems(kv_objects):
+                        objects[ioc_type] += dicts
 
         for ioc_type, batch in six.iteritems(objects):
             self.get_kvstore(ioc_type).batch_save(*batch)
@@ -225,20 +236,22 @@ def validate_input(self, validation_definition):
 
     # Method called by Splunk to get new events
     def stream_events(self, inputs, ew):
-        try:
-            self._splunk = client.connect(
-                token=self._input_definition.metadata["session_key"], owner="nobody"
-            )
-
-            for indicators in self.get_indicators(inputs):
-                self.store_indicators(indicators)
-        except Exception:
-            exception = traceback.format_exc()
+        while True:
+            try:
+                self._splunk = client.connect(
+                    token=self._input_definition.metadata["session_key"], owner="nobody"
+                )
 
-            for line in exception.splitlines():
-                print("ERROR {}".format(line), file=sys.stderr)
+                for indicators in self.get_indicators(inputs):
+                    self.store_indicators(indicators)
+            except Exception:
+                exception = traceback.format_exc()
 
-            raise
+                for line in exception.splitlines():
+                    print("ERROR {}".format(line), file=sys.stderr)
+            finally:
+                print("INFO Done fetching indicators, sleeping for 10 minutes.")
+                time.sleep(600)
 
 
 if __name__ == "__main__":

diff --git a/lib/antlr4/BufferedTokenStream.pyc b/lib/antlr4/BufferedTokenStream.pyc
diff --git a/lib/antlr4/CodePoints.pyc b/lib/antlr4/CodePoints.pyc
diff --git a/lib/antlr4/CommonTokenFactory.pyc b/lib/antlr4/CommonTokenFactory.pyc
diff --git a/lib/antlr4/CommonTokenStream.pyc b/lib/antlr4/CommonTokenStream.pyc
diff --git a/lib/antlr4/FileStream.pyc b/lib/antlr4/FileStream.pyc
diff --git a/lib/antlr4/InputStream.pyc b/lib/antlr4/InputStream.pyc
diff --git a/lib/antlr4/IntervalSet.pyc b/lib/antlr4/IntervalSet.pyc
diff --git a/lib/antlr4/LL1Analyzer.pyc b/lib/antlr4/LL1Analyzer.pyc
diff --git a/lib/antlr4/Lexer.pyc b/lib/antlr4/Lexer.pyc
diff --git a/lib/antlr4/ListTokenSource.pyc b/lib/antlr4/ListTokenSource.pyc
diff --git a/lib/antlr4/Parser.pyc b/lib/antlr4/Parser.pyc
diff --git a/lib/antlr4/ParserInterpreter.pyc b/lib/antlr4/ParserInterpreter.pyc
diff --git a/lib/antlr4/ParserRuleContext.pyc b/lib/antlr4/ParserRuleContext.pyc
diff --git a/lib/antlr4/PredictionContext.pyc b/lib/antlr4/PredictionContext.pyc
diff --git a/lib/antlr4/Recognizer.pyc b/lib/antlr4/Recognizer.pyc
diff --git a/lib/antlr4/RuleContext.pyc b/lib/antlr4/RuleContext.pyc
diff --git a/lib/antlr4/StdinStream.pyc b/lib/antlr4/StdinStream.pyc
diff --git a/lib/antlr4/Token.pyc b/lib/antlr4/Token.pyc
diff --git a/lib/antlr4/TokenStreamRewriter.pyc b/lib/antlr4/TokenStreamRewriter.pyc
diff --git a/lib/antlr4/Utils.pyc b/lib/antlr4/Utils.pyc
diff --git a/lib/antlr4/__init__.pyc b/lib/antlr4/__init__.pyc
diff --git a/lib/antlr4/atn/ATN.pyc b/lib/antlr4/atn/ATN.pyc
diff --git a/lib/antlr4/atn/ATNConfig.pyc b/lib/antlr4/atn/ATNConfig.pyc
diff --git a/lib/antlr4/atn/ATNConfigSet.pyc b/lib/antlr4/atn/ATNConfigSet.pyc
diff --git a/lib/antlr4/atn/ATNDeserializationOptions.pyc b/lib/antlr4/atn/ATNDeserializationOptions.pyc
diff --git a/lib/antlr4/atn/ATNDeserializer.pyc b/lib/antlr4/atn/ATNDeserializer.pyc
diff --git a/lib/antlr4/atn/ATNSimulator.pyc b/lib/antlr4/atn/ATNSimulator.pyc
diff --git a/lib/antlr4/atn/ATNState.pyc b/lib/antlr4/atn/ATNState.pyc
diff --git a/lib/antlr4/atn/ATNType.pyc b/lib/antlr4/atn/ATNType.pyc
diff --git a/lib/antlr4/atn/LexerATNSimulator.pyc b/lib/antlr4/atn/LexerATNSimulator.pyc
diff --git a/lib/antlr4/atn/LexerAction.pyc b/lib/antlr4/atn/LexerAction.pyc
diff --git a/lib/antlr4/atn/LexerActionExecutor.pyc b/lib/antlr4/atn/LexerActionExecutor.pyc
diff --git a/lib/antlr4/atn/ParserATNSimulator.pyc b/lib/antlr4/atn/ParserATNSimulator.pyc
diff --git a/lib/antlr4/atn/PredictionMode.pyc b/lib/antlr4/atn/PredictionMode.pyc
diff --git a/lib/antlr4/atn/SemanticContext.pyc b/lib/antlr4/atn/SemanticContext.pyc
diff --git a/lib/antlr4/atn/Transition.pyc b/lib/antlr4/atn/Transition.pyc
diff --git a/lib/antlr4/atn/__init__.pyc b/lib/antlr4/atn/__init__.pyc
diff --git a/lib/antlr4/dfa/DFA.pyc b/lib/antlr4/dfa/DFA.pyc
diff --git a/lib/antlr4/dfa/DFASerializer.pyc b/lib/antlr4/dfa/DFASerializer.pyc
diff --git a/lib/antlr4/dfa/DFAState.pyc b/lib/antlr4/dfa/DFAState.pyc
diff --git a/lib/antlr4/dfa/__init__.pyc b/lib/antlr4/dfa/__init__.pyc
diff --git a/lib/antlr4/error/DiagnosticErrorListener.pyc b/lib/antlr4/error/DiagnosticErrorListener.pyc
diff --git a/lib/antlr4/error/ErrorListener.pyc b/lib/antlr4/error/ErrorListener.pyc
diff --git a/lib/antlr4/error/ErrorStrategy.pyc b/lib/antlr4/error/ErrorStrategy.pyc
diff --git a/lib/antlr4/error/Errors.pyc b/lib/antlr4/error/Errors.pyc
diff --git a/lib/antlr4/error/__init__.pyc b/lib/antlr4/error/__init__.pyc
diff --git a/lib/antlr4/tree/Chunk.pyc b/lib/antlr4/tree/Chunk.pyc
diff --git a/lib/antlr4/tree/ParseTreeMatch.pyc b/lib/antlr4/tree/ParseTreeMatch.pyc
diff --git a/lib/antlr4/tree/ParseTreePattern.pyc b/lib/antlr4/tree/ParseTreePattern.pyc
diff --git a/lib/antlr4/tree/ParseTreePatternMatcher.pyc b/lib/antlr4/tree/ParseTreePatternMatcher.pyc
diff --git a/lib/antlr4/tree/RuleTagToken.pyc b/lib/antlr4/tree/RuleTagToken.pyc
diff --git a/lib/antlr4/tree/TokenTagToken.pyc b/lib/antlr4/tree/TokenTagToken.pyc
diff --git a/lib/antlr4/tree/Tree.pyc b/lib/antlr4/tree/Tree.pyc
diff --git a/lib/antlr4/tree/Trees.pyc b/lib/antlr4/tree/Trees.pyc
diff --git a/lib/antlr4/tree/__init__.pyc b/lib/antlr4/tree/__init__.pyc
diff --git a/lib/antlr4/xpath/XPath.pyc b/lib/antlr4/xpath/XPath.pyc
diff --git a/lib/antlr4/xpath/__init__.pyc b/lib/antlr4/xpath/__init__.pyc
diff --git a/lib/certifi/__init__.pyc b/lib/certifi/__init__.pyc
diff --git a/lib/certifi/__main__.pyc b/lib/certifi/__main__.pyc
diff --git a/lib/certifi/core.pyc b/lib/certifi/core.pyc
diff --git a/lib/chardet/__init__.pyc b/lib/chardet/__init__.pyc
diff --git a/lib/chardet/big5freq.pyc b/lib/chardet/big5freq.pyc
diff --git a/lib/chardet/big5prober.pyc b/lib/chardet/big5prober.pyc
diff --git a/lib/chardet/chardistribution.pyc b/lib/chardet/chardistribution.pyc
diff --git a/lib/chardet/charsetgroupprober.pyc b/lib/chardet/charsetgroupprober.pyc
diff --git a/lib/chardet/charsetprober.pyc b/lib/chardet/charsetprober.pyc
diff --git a/lib/chardet/cli/__init__.pyc b/lib/chardet/cli/__init__.pyc
diff --git a/lib/chardet/cli/chardetect.pyc b/lib/chardet/cli/chardetect.pyc
diff --git a/lib/chardet/codingstatemachine.pyc b/lib/chardet/codingstatemachine.pyc
diff --git a/lib/chardet/compat.pyc b/lib/chardet/compat.pyc
diff --git a/lib/chardet/cp949prober.pyc b/lib/chardet/cp949prober.pyc
diff --git a/lib/chardet/enums.pyc b/lib/chardet/enums.pyc
diff --git a/lib/chardet/escprober.pyc b/lib/chardet/escprober.pyc
diff --git a/lib/chardet/escsm.pyc b/lib/chardet/escsm.pyc
diff --git a/lib/chardet/eucjpprober.pyc b/lib/chardet/eucjpprober.pyc
diff --git a/lib/chardet/euckrfreq.pyc b/lib/chardet/euckrfreq.pyc
diff --git a/lib/chardet/euckrprober.pyc b/lib/chardet/euckrprober.pyc
diff --git a/lib/chardet/euctwfreq.pyc b/lib/chardet/euctwfreq.pyc
diff --git a/lib/chardet/euctwprober.pyc b/lib/chardet/euctwprober.pyc
diff --git a/lib/chardet/gb2312freq.pyc b/lib/chardet/gb2312freq.pyc
diff --git a/lib/chardet/gb2312prober.pyc b/lib/chardet/gb2312prober.pyc
diff --git a/lib/chardet/hebrewprober.pyc b/lib/chardet/hebrewprober.pyc
diff --git a/lib/chardet/jisfreq.pyc b/lib/chardet/jisfreq.pyc
diff --git a/lib/chardet/jpcntx.pyc b/lib/chardet/jpcntx.pyc
diff --git a/lib/chardet/langbulgarianmodel.pyc b/lib/chardet/langbulgarianmodel.pyc
diff --git a/lib/chardet/langcyrillicmodel.pyc b/lib/chardet/langcyrillicmodel.pyc
diff --git a/lib/chardet/langgreekmodel.pyc b/lib/chardet/langgreekmodel.pyc
diff --git a/lib/chardet/langhebrewmodel.pyc b/lib/chardet/langhebrewmodel.pyc
diff --git a/lib/chardet/langhungarianmodel.pyc b/lib/chardet/langhungarianmodel.pyc
diff --git a/lib/chardet/langthaimodel.pyc b/lib/chardet/langthaimodel.pyc
diff --git a/lib/chardet/langturkishmodel.pyc b/lib/chardet/langturkishmodel.pyc
diff --git a/lib/chardet/latin1prober.pyc b/lib/chardet/latin1prober.pyc
diff --git a/lib/chardet/mbcharsetprober.pyc b/lib/chardet/mbcharsetprober.pyc
diff --git a/lib/chardet/mbcsgroupprober.pyc b/lib/chardet/mbcsgroupprober.pyc
diff --git a/lib/chardet/mbcssm.pyc b/lib/chardet/mbcssm.pyc
diff --git a/lib/chardet/sbcharsetprober.pyc b/lib/chardet/sbcharsetprober.pyc
diff --git a/lib/chardet/sbcsgroupprober.pyc b/lib/chardet/sbcsgroupprober.pyc
diff --git a/lib/chardet/sjisprober.pyc b/lib/chardet/sjisprober.pyc
diff --git a/lib/chardet/universaldetector.pyc b/lib/chardet/universaldetector.pyc
diff --git a/lib/chardet/utf8prober.pyc b/lib/chardet/utf8prober.pyc
diff --git a/lib/chardet/version.pyc b/lib/chardet/version.pyc
diff --git a/lib/enum/__init__.pyc b/lib/enum/__init__.pyc
diff --git a/lib/idna/__init__.pyc b/lib/idna/__init__.pyc
diff --git a/lib/idna/codec.pyc b/lib/idna/codec.pyc
diff --git a/lib/idna/compat.pyc b/lib/idna/compat.pyc
diff --git a/lib/idna/core.pyc b/lib/idna/core.pyc
diff --git a/lib/idna/idnadata.pyc b/lib/idna/idnadata.pyc
diff --git a/lib/idna/intranges.pyc b/lib/idna/intranges.pyc
diff --git a/lib/idna/package_data.pyc b/lib/idna/package_data.pyc
diff --git a/lib/idna/uts46data.pyc b/lib/idna/uts46data.pyc
diff --git a/lib/requests/__init__.pyc b/lib/requests/__init__.pyc
diff --git a/lib/requests/__version__.pyc b/lib/requests/__version__.pyc
diff --git a/lib/requests/_internal_utils.pyc b/lib/requests/_internal_utils.pyc
diff --git a/lib/requests/adapters.pyc b/lib/requests/adapters.pyc
diff --git a/lib/requests/api.pyc b/lib/requests/api.pyc
diff --git a/lib/requests/auth.pyc b/lib/requests/auth.pyc
diff --git a/lib/requests/certs.pyc b/lib/requests/certs.pyc
diff --git a/lib/requests/compat.pyc b/lib/requests/compat.pyc
diff --git a/lib/requests/cookies.pyc b/lib/requests/cookies.pyc
diff --git a/lib/requests/exceptions.pyc b/lib/requests/exceptions.pyc
diff --git a/lib/requests/help.pyc b/lib/requests/help.pyc
diff --git a/lib/requests/hooks.pyc b/lib/requests/hooks.pyc
diff --git a/lib/requests/models.pyc b/lib/requests/models.pyc
diff --git a/lib/requests/packages.pyc b/lib/requests/packages.pyc
diff --git a/lib/requests/sessions.pyc b/lib/requests/sessions.pyc
diff --git a/lib/requests/status_codes.pyc b/lib/requests/status_codes.pyc
diff --git a/lib/requests/structures.pyc b/lib/requests/structures.pyc
diff --git a/lib/requests/utils.pyc b/lib/requests/utils.pyc
diff --git a/lib/six.pyc b/lib/six.pyc
diff --git a/lib/splunklib/__init__.pyc b/lib/splunklib/__init__.pyc
diff --git a/lib/splunklib/__pycache__/__init__.cpython-36.pyc b/lib/splunklib/__pycache__/__init__.cpython-36.pyc
diff --git a/lib/splunklib/__pycache__/__init__.cpython-37.pyc b/lib/splunklib/__pycache__/__init__.cpython-37.pyc
diff --git a/lib/splunklib/__pycache__/binding.cpython-36.pyc b/lib/splunklib/__pycache__/binding.cpython-36.pyc
diff --git a/lib/splunklib/__pycache__/binding.cpython-37.pyc b/lib/splunklib/__pycache__/binding.cpython-37.pyc
diff --git a/lib/splunklib/__pycache__/client.cpython-36.pyc b/lib/splunklib/__pycache__/client.cpython-36.pyc
diff --git a/lib/splunklib/__pycache__/client.cpython-37.pyc b/lib/splunklib/__pycache__/client.cpython-37.pyc
diff --git a/lib/splunklib/__pycache__/data.cpython-36.pyc b/lib/splunklib/__pycache__/data.cpython-36.pyc
diff --git a/lib/splunklib/__pycache__/data.cpython-37.pyc b/lib/splunklib/__pycache__/data.cpython-37.pyc
diff --git a/lib/splunklib/__pycache__/results.cpython-36.pyc b/lib/splunklib/__pycache__/results.cpython-36.pyc
diff --git a/lib/splunklib/__pycache__/results.cpython-37.pyc b/lib/splunklib/__pycache__/results.cpython-37.pyc
diff --git a/lib/splunklib/__pycache__/six.cpython-36.pyc b/lib/splunklib/__pycache__/six.cpython-36.pyc
diff --git a/lib/splunklib/__pycache__/six.cpython-37.pyc b/lib/splunklib/__pycache__/six.cpython-37.pyc
diff --git a/lib/splunklib/binding.pyc b/lib/splunklib/binding.pyc
diff --git a/lib/splunklib/client.pyc b/lib/splunklib/client.pyc
diff --git a/lib/splunklib/data.pyc b/lib/splunklib/data.pyc
diff --git a/lib/splunklib/modularinput/__init__.pyc b/lib/splunklib/modularinput/__init__.pyc
diff --git a/lib/splunklib/modularinput/argument.pyc b/lib/splunklib/modularinput/argument.pyc
diff --git a/lib/splunklib/modularinput/event.pyc b/lib/splunklib/modularinput/event.pyc
diff --git a/lib/splunklib/modularinput/event_writer.pyc b/lib/splunklib/modularinput/event_writer.pyc
diff --git a/lib/splunklib/modularinput/input_definition.pyc b/lib/splunklib/modularinput/input_definition.pyc
diff --git a/lib/splunklib/modularinput/scheme.pyc b/lib/splunklib/modularinput/scheme.pyc
diff --git a/lib/splunklib/modularinput/script.pyc b/lib/splunklib/modularinput/script.pyc
diff --git a/lib/splunklib/modularinput/utils.pyc b/lib/splunklib/modularinput/utils.pyc
diff --git a/lib/splunklib/modularinput/validation_definition.pyc b/lib/splunklib/modularinput/validation_definition.pyc
diff --git a/lib/splunklib/searchcommands/__pycache__/__init__.cpython-36.pyc b/lib/splunklib/searchcommands/__pycache__/__init__.cpython-36.pyc
diff --git a/lib/splunklib/searchcommands/__pycache__/__init__.cpython-37.pyc b/lib/splunklib/searchcommands/__pycache__/__init__.cpython-37.pyc
diff --git a/lib/splunklib/searchcommands/__pycache__/decorators.cpython-36.pyc b/lib/splunklib/searchcommands/__pycache__/decorators.cpython-36.pyc
diff --git a/lib/splunklib/searchcommands/__pycache__/decorators.cpython-37.pyc b/lib/splunklib/searchcommands/__pycache__/decorators.cpython-37.pyc
diff --git a/lib/splunklib/searchcommands/__pycache__/environment.cpython-36.pyc b/lib/splunklib/searchcommands/__pycache__/environment.cpython-36.pyc
diff --git a/lib/splunklib/searchcommands/__pycache__/environment.cpython-37.pyc b/lib/splunklib/searchcommands/__pycache__/environment.cpython-37.pyc
diff --git a/lib/splunklib/searchcommands/__pycache__/eventing_command.cpython-36.pyc b/lib/splunklib/searchcommands/__pycache__/eventing_command.cpython-36.pyc
diff --git a/lib/splunklib/searchcommands/__pycache__/eventing_command.cpython-37.pyc b/lib/splunklib/searchcommands/__pycache__/eventing_command.cpython-37.pyc
diff --git a/lib/splunklib/searchcommands/__pycache__/external_search_command.cpython-36.pyc b/lib/splunklib/searchcommands/__pycache__/external_search_command.cpython-36.pyc
diff --git a/lib/splunklib/searchcommands/__pycache__/external_search_command.cpython-37.pyc b/lib/splunklib/searchcommands/__pycache__/external_search_command.cpython-37.pyc
diff --git a/lib/splunklib/searchcommands/__pycache__/generating_command.cpython-36.pyc b/lib/splunklib/searchcommands/__pycache__/generating_command.cpython-36.pyc
diff --git a/lib/splunklib/searchcommands/__pycache__/generating_command.cpython-37.pyc b/lib/splunklib/searchcommands/__pycache__/generating_command.cpython-37.pyc
diff --git a/lib/splunklib/searchcommands/__pycache__/internals.cpython-36.pyc b/lib/splunklib/searchcommands/__pycache__/internals.cpython-36.pyc
diff --git a/lib/splunklib/searchcommands/__pycache__/internals.cpython-37.pyc b/lib/splunklib/searchcommands/__pycache__/internals.cpython-37.pyc
diff --git a/lib/splunklib/searchcommands/__pycache__/reporting_command.cpython-36.pyc b/lib/splunklib/searchcommands/__pycache__/reporting_command.cpython-36.pyc
diff --git a/lib/splunklib/searchcommands/__pycache__/reporting_command.cpython-37.pyc b/lib/splunklib/searchcommands/__pycache__/reporting_command.cpython-37.pyc
diff --git a/lib/splunklib/searchcommands/__pycache__/search_command.cpython-36.pyc b/lib/splunklib/searchcommands/__pycache__/search_command.cpython-36.pyc
diff --git a/lib/splunklib/searchcommands/__pycache__/search_command.cpython-37.pyc b/lib/splunklib/searchcommands/__pycache__/search_command.cpython-37.pyc
diff --git a/lib/splunklib/searchcommands/__pycache__/streaming_command.cpython-36.pyc b/lib/splunklib/searchcommands/__pycache__/streaming_command.cpython-36.pyc
diff --git a/lib/splunklib/searchcommands/__pycache__/streaming_command.cpython-37.pyc b/lib/splunklib/searchcommands/__pycache__/streaming_command.cpython-37.pyc
diff --git a/lib/splunklib/searchcommands/__pycache__/validators.cpython-36.pyc b/lib/splunklib/searchcommands/__pycache__/validators.cpython-36.pyc
diff --git a/lib/splunklib/searchcommands/__pycache__/validators.cpython-37.pyc b/lib/splunklib/searchcommands/__pycache__/validators.cpython-37.pyc
diff --git a/lib/splunklib/six.pyc b/lib/splunklib/six.pyc
diff --git a/lib/stix2patterns/__init__.pyc b/lib/stix2patterns/__init__.pyc
diff --git a/lib/stix2patterns/exceptions.pyc b/lib/stix2patterns/exceptions.pyc
diff --git a/lib/stix2patterns/grammars/STIXPatternLexer.pyc b/lib/stix2patterns/grammars/STIXPatternLexer.pyc
diff --git a/lib/stix2patterns/grammars/STIXPatternListener.pyc b/lib/stix2patterns/grammars/STIXPatternListener.pyc
diff --git a/lib/stix2patterns/grammars/STIXPatternParser.pyc b/lib/stix2patterns/grammars/STIXPatternParser.pyc
diff --git a/lib/stix2patterns/grammars/STIXPatternVisitor.pyc b/lib/stix2patterns/grammars/STIXPatternVisitor.pyc
diff --git a/lib/stix2patterns/grammars/__init__.pyc b/lib/stix2patterns/grammars/__init__.pyc
diff --git a/lib/stix2patterns/helpers.pyc b/lib/stix2patterns/helpers.pyc
diff --git a/lib/stix2patterns/inspector.pyc b/lib/stix2patterns/inspector.pyc
diff --git a/lib/stix2patterns/pattern.pyc b/lib/stix2patterns/pattern.pyc
diff --git a/lib/stix2patterns/test/__init__.pyc b/lib/stix2patterns/test/__init__.pyc
diff --git a/lib/stix2patterns/test/test_helpers.pyc b/lib/stix2patterns/test/test_helpers.pyc
diff --git a/lib/stix2patterns/test/v20/__init__.pyc b/lib/stix2patterns/test/v20/__init__.pyc
diff --git a/lib/stix2patterns/test/v20/test_inspector.pyc b/lib/stix2patterns/test/v20/test_inspector.pyc
diff --git a/lib/stix2patterns/test/v20/test_validator.pyc b/lib/stix2patterns/test/v20/test_validator.pyc
diff --git a/lib/stix2patterns/test/v21/__init__.pyc b/lib/stix2patterns/test/v21/__init__.pyc
diff --git a/lib/stix2patterns/test/v21/test_inspector.pyc b/lib/stix2patterns/test/v21/test_inspector.pyc
diff --git a/lib/stix2patterns/test/v21/test_validator.pyc b/lib/stix2patterns/test/v21/test_validator.pyc
diff --git a/lib/stix2patterns/v20/__init__.pyc b/lib/stix2patterns/v20/__init__.pyc
diff --git a/lib/stix2patterns/v20/grammars/STIXPatternLexer.pyc b/lib/stix2patterns/v20/grammars/STIXPatternLexer.pyc
diff --git a/lib/stix2patterns/v20/grammars/STIXPatternListener.pyc b/lib/stix2patterns/v20/grammars/STIXPatternListener.pyc
diff --git a/lib/stix2patterns/v20/grammars/STIXPatternParser.pyc b/lib/stix2patterns/v20/grammars/STIXPatternParser.pyc
diff --git a/lib/stix2patterns/v20/grammars/STIXPatternVisitor.pyc b/lib/stix2patterns/v20/grammars/STIXPatternVisitor.pyc
diff --git a/lib/stix2patterns/v20/grammars/__init__.pyc b/lib/stix2patterns/v20/grammars/__init__.pyc
diff --git a/lib/stix2patterns/v20/inspector.pyc b/lib/stix2patterns/v20/inspector.pyc
diff --git a/lib/stix2patterns/v20/object_validator.pyc b/lib/stix2patterns/v20/object_validator.pyc
diff --git a/lib/stix2patterns/v20/pattern.pyc b/lib/stix2patterns/v20/pattern.pyc
diff --git a/lib/stix2patterns/v20/validator.pyc b/lib/stix2patterns/v20/validator.pyc
diff --git a/lib/stix2patterns/v21/__init__.pyc b/lib/stix2patterns/v21/__init__.pyc
diff --git a/lib/stix2patterns/v21/grammars/STIXPatternLexer.pyc b/lib/stix2patterns/v21/grammars/STIXPatternLexer.pyc
diff --git a/lib/stix2patterns/v21/grammars/STIXPatternListener.pyc b/lib/stix2patterns/v21/grammars/STIXPatternListener.pyc
diff --git a/lib/stix2patterns/v21/grammars/STIXPatternParser.pyc b/lib/stix2patterns/v21/grammars/STIXPatternParser.pyc
diff --git a/lib/stix2patterns/v21/grammars/STIXPatternVisitor.pyc b/lib/stix2patterns/v21/grammars/STIXPatternVisitor.pyc
diff --git a/lib/stix2patterns/v21/grammars/__init__.pyc b/lib/stix2patterns/v21/grammars/__init__.pyc
diff --git a/lib/stix2patterns/v21/inspector.pyc b/lib/stix2patterns/v21/inspector.pyc
diff --git a/lib/stix2patterns/v21/object_validator.pyc b/lib/stix2patterns/v21/object_validator.pyc
diff --git a/lib/stix2patterns/v21/pattern.pyc b/lib/stix2patterns/v21/pattern.pyc
diff --git a/lib/stix2patterns/v21/validator.pyc b/lib/stix2patterns/v21/validator.pyc
diff --git a/lib/stix2patterns/validator.pyc b/lib/stix2patterns/validator.pyc
diff --git a/lib/urllib3/__init__.pyc b/lib/urllib3/__init__.pyc
diff --git a/lib/urllib3/_collections.pyc b/lib/urllib3/_collections.pyc
diff --git a/lib/urllib3/_version.pyc b/lib/urllib3/_version.pyc
diff --git a/lib/urllib3/connection.pyc b/lib/urllib3/connection.pyc
diff --git a/lib/urllib3/connectionpool.pyc b/lib/urllib3/connectionpool.pyc
diff --git a/lib/urllib3/contrib/__init__.pyc b/lib/urllib3/contrib/__init__.pyc
diff --git a/lib/urllib3/contrib/_appengine_environ.pyc b/lib/urllib3/contrib/_appengine_environ.pyc
diff --git a/lib/urllib3/contrib/_securetransport/__init__.pyc b/lib/urllib3/contrib/_securetransport/__init__.pyc
diff --git a/lib/urllib3/contrib/_securetransport/bindings.pyc b/lib/urllib3/contrib/_securetransport/bindings.pyc
diff --git a/lib/urllib3/contrib/_securetransport/low_level.pyc b/lib/urllib3/contrib/_securetransport/low_level.pyc
diff --git a/lib/urllib3/contrib/appengine.pyc b/lib/urllib3/contrib/appengine.pyc
diff --git a/lib/urllib3/contrib/ntlmpool.pyc b/lib/urllib3/contrib/ntlmpool.pyc
diff --git a/lib/urllib3/contrib/pyopenssl.pyc b/lib/urllib3/contrib/pyopenssl.pyc
diff --git a/lib/urllib3/contrib/securetransport.pyc b/lib/urllib3/contrib/securetransport.pyc
diff --git a/lib/urllib3/contrib/socks.pyc b/lib/urllib3/contrib/socks.pyc
diff --git a/lib/urllib3/exceptions.pyc b/lib/urllib3/exceptions.pyc
diff --git a/lib/urllib3/fields.pyc b/lib/urllib3/fields.pyc
diff --git a/lib/urllib3/filepost.pyc b/lib/urllib3/filepost.pyc
diff --git a/lib/urllib3/packages/__init__.pyc b/lib/urllib3/packages/__init__.pyc
diff --git a/lib/urllib3/packages/backports/__init__.pyc b/lib/urllib3/packages/backports/__init__.pyc
diff --git a/lib/urllib3/packages/backports/makefile.pyc b/lib/urllib3/packages/backports/makefile.pyc
diff --git a/lib/urllib3/packages/six.pyc b/lib/urllib3/packages/six.pyc
diff --git a/lib/urllib3/packages/ssl_match_hostname/__init__.pyc b/lib/urllib3/packages/ssl_match_hostname/__init__.pyc
diff --git a/lib/urllib3/packages/ssl_match_hostname/_implementation.pyc b/lib/urllib3/packages/ssl_match_hostname/_implementation.pyc
diff --git a/lib/urllib3/poolmanager.pyc b/lib/urllib3/poolmanager.pyc
diff --git a/lib/urllib3/request.pyc b/lib/urllib3/request.pyc
diff --git a/lib/urllib3/response.pyc b/lib/urllib3/response.pyc
diff --git a/lib/urllib3/util/__init__.pyc b/lib/urllib3/util/__init__.pyc
diff --git a/lib/urllib3/util/connection.pyc b/lib/urllib3/util/connection.pyc
diff --git a/lib/urllib3/util/queue.pyc b/lib/urllib3/util/queue.pyc
diff --git a/lib/urllib3/util/request.pyc b/lib/urllib3/util/request.pyc
diff --git a/lib/urllib3/util/response.pyc b/lib/urllib3/util/response.pyc
diff --git a/lib/urllib3/util/retry.pyc b/lib/urllib3/util/retry.pyc
diff --git a/lib/urllib3/util/ssl_.pyc b/lib/urllib3/util/ssl_.pyc
diff --git a/lib/urllib3/util/timeout.pyc b/lib/urllib3/util/timeout.pyc
diff --git a/lib/urllib3/util/url.pyc b/lib/urllib3/util/url.pyc
diff --git a/lib/urllib3/util/wait.pyc b/lib/urllib3/util/wait.pyc
Original file line number	Diff line number	Diff line change
Expand Up		@@ -29,4 +29,4 @@ For each lookup, a saved search is automatically created and scheduled to run on

		Sightings are stored in the `sekoia_alerts` KV-store and listed on the home Dashboard.

		Clicking on the `matched_ioc` will open the Intelligence Center to see context aroung matched indicator.
		Clicking on the `matched_ioc` will open the Intelligence Center to see context around matched indicator.