justfalter/cif-v1

This fork is a work in progress, and diverges from the original CIF v1 codebase. The goals of this fork are to improve speed, scalability, functionality, and ease of installation.

cif-v1's Issues

Explicit address types

The type of address contained within an event should be explicit. Currently, the 'address' field is ambiguous, as it can be a domain name, URL, email address, or IPv4 address. By explicitly defining the type of address, we'll be able to route events toward systems that can perform further processing (name resolution, AS identification, etc).

Move toward explicit query types

Presently, the system guesses whether the query is for an IPv4 Address, ASN, domain, etc. For example, if I search for 'yahoo.com', CIF identifies that it is a domain name, rather than a URL. A search for 1234 is interpreted as a search for an AS number.

The guesswork prohibits us from providing more advanced queries, since any new implementation might conflict with an existing query handler. The existing implementation style would make wildcard searches for 'yahoo.com*' ambigious. Is it a domain, or is it a URL?

I want to get rid of the guesswork being performed in CIF::Client::Query, and replace it with explicit query types. (ie: I should be able to specify that I want to search for the FQDN 'yahoo.com'.)

reimplement group filtering for queries

ParseCSV doesn't parse drop quotes

malwaredomainlist has quoted strings:
'"2011/02/14_19:35","-","91.213.29.45/~samui/jhgth/fgdsfdty/panos.php","-","zeus v2 drop zone","-","51786"

ParseCSV doesn't take care of the quotes.

I thought I was so smart by making ParseCSV a subclass of ParseDelim.