I am using the C2Intel Feeds to find specific observables and when I do, I'd like to extract/slice out the row.
If you go to the link/CSV file, I am able to find a specific IP, i.e. - 54.161.191.72.
I would like to slice out the whole row:
www.e-enroll-benefits.com,Possible Cobalt Strike C2 Domain,/enrollmentinfo/,54.161.191.72
Since each row is different, I'm not sure how I would go about doing this process. I thought about finding the length but I'm not sure how to do it since it varies.
Here's my current code:
ip_address = "54.161.191.72"
lines = "https://raw.githubusercontent.com/drb-ra/C2IntelFeeds/master/feeds/domainC2swithURLwithIP-filter-abused.csv"
for line in lines:
if re.match("ip_address", line):
values_slice = line.split(": ")[-1]#not sure how you get the whole row?
Appreciate any help or guidance. Thanks in advance!
I tried with simpler approach and it works for me. Instead of visiting the url, I downloaded the csv file to a local folder, ideally the same folder where the python script is run to save the 'os.chdir' step. Please see below:
import os
os.chdir('/Users/***/***/') # please update this path to where your csv file downloaded is
ip_address = '54.161.191.72'
lines = open('domainC2swithURLwithIP-filter-abused.csv')
for line in lines:
if ip_address in line:
print(line)
Below is the output I got: Happy to answer any questions that you may have. Cheers!