Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Feature] Deduplication of captures for takedown requests #901

Open
Rafiot opened this issue Mar 28, 2024 · 0 comments
Open

[Feature] Deduplication of captures for takedown requests #901

Rafiot opened this issue Mar 28, 2024 · 0 comments

Comments

@Rafiot
Copy link
Member

Rafiot commented Mar 28, 2024

Is your feature request related to a problem? Please describe.

A duplicate captures on lookyloo doesn't match what we need for the takedown process:

  • It makes sense to have the same URL in multiple captures multiple times a day, even without changing any setting between two captures because they change. Or just because the URL is part of a chain of redirects
  • It makes very little sense to trigger takedown multiple times a day on the same URL

Describe the solution you'd like

MISP. When a takedown request has been validated by an analyst, it is added to MISP. When we trigger a report for suspicious URL from lookyloo, we need to add a lookup against MISP. If we have a hit, we will also know when it was added (timestamp). With that information, we can warn the analyst before they trigger the takedown that this URL was (probably) already processed recently.

Describe alternatives you've considered

Pushing back to Lookyloo a note saying that we already triggered a takedown request for a specific URL is not really an option as a URL can be somewhere in the chain of redirect an that's going to be really hard to keep track of.

Additional context

No response

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant