unify abusech config

rkoumis · Feb 18, 2025 · 1ab9a14 · 1ab9a14
1 parent d7519b0
commit 1ab9a14
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 5 deletions.
diff --git a/conf/default/integrations.conf.default b/conf/default/integrations.conf.default
@@ -20,8 +20,10 @@ api_access =
 api_secret =
 
 # Create your apikey: https://threatfox.abuse.ch/api/#auth_key
-[threatfox]
-enabled = no
+# MalwareBazaar uses this key too
+[abusech]
+threatfox = no
+malwarebazaar = no
 apikey =
 
 

diff --git a/lib/cuckoo/common/abstracts.py b/lib/cuckoo/common/abstracts.py
@@ -1365,13 +1365,13 @@ def check_argument(self, pattern, name=None, api=None, category=None, process=No
         return None
 
     def check_threatfox(self, searchterm: str):
-        if not integrations_conf.threatfox.enabled or not integrations_conf.threatfox.apikey:
+        if not integrations_conf.abusech.threatfox or not integrations_conf.abusech.apikey:
             return
         try:
             response = requests.post(
                 "https://threatfox-api.abuse.ch/api/v1/",
-                data={"query": "search_ioc", "search_term": searchterm},
-                headers={"Auth-Key": integrations_conf.threatfox.apikey, "User-Agent": "CAPE Sandbox"},
+                json={"query": "search_ioc", "search_term": searchterm,  "exact_match": True},
+                headers={"Auth-Key": integrations_conf.abusech.apikey, "User-Agent": "CAPE Sandbox"},
             )
             return response.json()
         except Exception as e: