drb-ra/C2IntelFeeds

Print AS number

g00g1 opened this issue · 8 comments

g00g1 commented

I think it is good idea to print AS number too, because AS name cannot be used as percise ID.

Thank you for the feedback, would tend to agree but trying to not change format from the initial version as other users may be rellying on this format for their own automation.

If you note for some of the files that were added recently that information is there. (e.g. poshc2 and empire json files).

It shouldn't be too hard and probably more accurate to just re-query the IP for it's current ASN.

Hope this helps!

g00g1 commented

trying to not change format from the initial version as other users may be rellying on this format for their own automation

As I can see, in some cases you print AS number, so unsure if it can break something (unless anyone relies on mentions of AS names, which is strange)

I'm a bit confused where you are looking for this information now! Is it the tweets or the files in GitHub? I do have both sets of information, in some cases when is used when the other is not available.

g00g1 commented

I came here from tweets, sorry for not saying that earlier :)

I do have both sets of information, in some cases when is used when the other is not available

AS number is always available and can be used to more precisely detect source of abuse. I am using your feed from twitter to monitor a few providers for research purposes, so it will be more convenient if notifications will have AS number to detect interesting tweets automatically.

I see... I can update the tweets, that's not a major issue as you said it changes depending on a number of conditions, I can change it to be number preferred.

Tweets will now be consistent and show ASN numbers in most cases.

Slight tweak will be after the country name (ASxxxxx) as I think most people will still prefer a human readable form too. Hope that works for you!

g00g1 commented

Sure, that's not an issue. Thank for your awesome service!