IPv4 address Extractor regex does not match only IPv4 address

[srilumpa]

Request Type

Bug

Work Environment

Question	Answer
OS version (server)	Debian
Cortex Analyzer Name	cortexutils
Cortex Analyzer Version	1.2.0
Cortex Version	1.0.0, hash of the commit

Description

The regular expression used to detect if an artifact is an IPv4 address is "too wide" and will detect as an IP address every string containing four groups of one, two or three digits separated by dots.

Steps to Reproduce

1. Call Extractor().check_string("1.0.0.127.localhost.localdomain.")
2. This will return ip but should return fqdn (or an empty string)

Possible Solutions

Use the following regular expression for ip type detection/extraction: ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(?:\/\d\d?)?$

[3c7]

Some thoughts in the PR (#199).

[3c7]

I'll close this for now. The automatic extraction should be the one to use, if you've no idea of how to extract your observables properly and the behaviour can always be changed through overwriting the artifacts function. Maybe we need to add this to the "How to create an analyzer" manual.