Little adjusts

api_app/analyzers_manager/observable_analyzers/threatfox.py

@@ -26,11 +26,14 @@ def run(self):
         response.raise_for_status()
 
         result = response.json()
-        data = result.get("data", {})
-        if isinstance(data, dict):
-            ioc_id = data.get("id", "")
-            if ioc_id:
-                result["link"] = f"https://threatfox.abuse.ch/ioc/{ioc_id}"
+        data = result.get("data", [])
+        if data and isinstance(data, list):
+            for index, element in enumerate(data):
+                ioc_id = element.get("id", "")
+                if ioc_id:
+                    result["data"][index][
+                        "link"
+                    ] = f"https://threatfox.abuse.ch/ioc/{ioc_id}"
         return result
 
     @classmethod
@@ -39,7 +42,18 @@ def _monkeypatch(cls):
             if_mock_connections(
                 patch(
                     "requests.post",
-                    return_value=MockUpResponse({}, 200),
+                    return_value=MockUpResponse(
+                        {
+                            "query_status": "ok",
+                            "data": [
+                                {
+                                    "id": "12",
+                                    "ioc": "139.180.203.104:443",
+                                },
+                            ],
+                        },
+                        200,
+                    ),
                 ),
             )
         ]

configuration/elastic_search_mappings/intel_owl_bi.json

@@ -1,6 +1,7 @@
 {
   "settings" : {
-    "number_of_shards" : 1
+    "number_of_shards" : 1,
+    "number_of_replicas": 0
   },
   "mappings": {
     "dynamic": false,