otx_lookup_domain validation

[mudrunkar]

otx_lookup_domain pipeline function seems to expect an IP address, although the function is supposed to use domain name as argument.

Expected Behavior

I wouldn't expect error message

Unable to auto-detect IP address type for key <mcafee.com>

in case of otx_lookup_domain function. I feed the pipeline function with top level and second level domain string, for instance "googleapis.com", "firefox.com", "facebook.com etc".

Current Behavior

otx_lookup_domain function doesn't work as expected and results in the following error message in the log:

2018-01-17 15:46:24,327 WARN : org.graylog.plugins.threatintel.adapters.otx.OTXDataAdapter - Unable to auto-detect IP address type for key <google-analytics.com>

Possible Solution

Steps to Reproduce (for bugs)

I use the following pipeline function to query AlienVault's otx and to set the field in the log:

rule "add_otx_lookup"
when 
    has_field("name_tld2ld")
then
    let otx_lookup = otx_lookup_domain(to_string($message.name_tld2ld));
    set_field("otx_lookup_result", otx_lookup);
end

Context

Your Environment

• Graylog Version: 2.4.0
• Elasticsearch Version:
• MongoDB Version:
• Operating System:
• Browser version:

[bernd]

@mudrunkar Thank you for the report. A fix for this will be in the upcoming 2.4.1 release.