Merge pull request #104

Use strict equality comparison in VAST queries
tenzir · Mar 11, 2021 · 33f4cb8 · 33f4cb8
2 parents 5ad3665 + 377c4e3
commit 33f4cb8
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 2 deletions.
diff --git a/apps/vast/CHANGELOG.md b/apps/vast/CHANGELOG.md
@@ -10,7 +10,13 @@ Every entry has a category for which we use the following visual abbreviations:
 - ⚡️ breaking change
 - 🐞 bugfix
 
-<!-- ## Unreleased -->
+## Unreleased
+
+- ⚠️ The retro-matching now applies a strict equality comparison when mapping
+  IoCs to VAST queries. Prior to this change `pyvast-threatbus` used substring
+  search, which came at heavy runtime costs when issuing hundreds of queries
+  per second.
+  [#104](https://github.com/tenzir/threatbus/pull/104)
 
 ## [2021.02.24]
 

diff --git a/apps/vast/pyvast_threatbus/message_mapping.py b/apps/vast/pyvast_threatbus/message_mapping.py
@@ -91,7 +91,7 @@ def to_vast_query(intel: Intel):
     if vast_type == "url":
         return f'"{indicator}" in net.uri'
     if vast_type == "domain":
-        return f'"{indicator}" in net.domain || "{indicator}" in net.hostname'
+        return f'"{indicator}" == net.domain || "{indicator}" == net.hostname'
     return None