Let the Badlist client perform data normalization of tags

CybercentreCanada · Nov 29, 2024 · 3de363e · 3de363e
1 parent 3821ce7
commit 3de363e
Showing 1 changed file with 4 additions and 5 deletions.
diff --git a/badlist/update_server.py b/badlist/update_server.py
@@ -154,9 +154,6 @@ def prepare_item(bl_item):
             references = [r for r in references if re.match(FULL_URI, r)]
             badlist_items = []
 
-            # Normalize IOC values for when performing lookups
-            ioc_value = ioc_value.lower()
-
             # Build item for badlist
             badlist_item_base = {
                 "classification": default_classification,
@@ -188,7 +185,7 @@ def prepare_item(bl_item):
                 badlist_item.update(
                     {
                         "type": "file",
-                        "hashes": {ioc_type: ioc_value},
+                        "hashes": {ioc_type: ioc_value.lower()},
                     }
                 )
                 badlist_items.append(badlist_item)
@@ -282,7 +279,9 @@ def prepare_item(bl_item):
                                 # Get attribution
                                 attribution = sanitize_data(data.get(source_cfg.get("attribution")), type="attribution")
 
-                                campaign = sanitize_data(data.get(source_cfg.get("campaign")), type="campaign", validate=False)
+                                campaign = sanitize_data(
+                                    data.get(source_cfg.get("campaign")), type="campaign", validate=False
+                                )
 
                                 for ioc_type in NETWORK_IOC_TYPES + FILEHASH_TYPES:
                                     ioc_value = data.get(source_cfg.get(ioc_type))