CERT-FR's IOC

[18info]

Hi again!

I try to add IOC from cert-fr without success. I tried:

• c/p raw json
• import json file
  In all cases, I get
  ✗ 303 IOCs not imported, see details below.
  with

[…]
"galaxy":,                                   | Wrong IOC format
"shadowattribute":,                          | Wrong IOC format
"tag":,                                      | Wrong IOC format
"category":"network activity",       | Wrong IOC format
"comment":"adresses ip reliu00e9es", | Wrong IOC format
"deleted":false,                             | Wrong IOC format
"disable_correlation":false,                 | Wrong IOC format
[…]

I suppose it's parsing related. Can I do something to get it work?
(for example a script to preprocessing the file before importing it in TC)

Wich IOC format is used by TC?

'good'day!

[felixaime]

Hello,

Sorry for the late reply, I don't have internet since few weeks. Yeah, it is possible that they are MISP-or-whatever formatted. You can try with jq to get the IOCs, here is a command line example:

curl -s https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-IOC-003-IOC.json 2>&1 | jq -r '.Event.Attribute[].value'

And then, copy paste the result in the backend.

Félix.

[18info]

Hello,
No problem about the delay, thanks for reply.
I ran a loop to download all of them (see AD) and cleaned it out since I found dates, e-mail addresses or URL
cert-fr_iocs.txt
I try it by copy/past, TC seems to stop randomly before the end.
Is there a limit to import or something like this?

Thanks again,

[felixaime]

Yeah,

I've seen that the other day by adding the Pegasus-liked domains.
I'll see how to work on that, maybe import them in bulk in the next update and not one by one...

Félix.

[18info]

Many thanks, Félix! :)