Skip to content

Commit 20ddb0c

Browse files
authored
Update osqueryexport.py
Remove double returns (MISP export modules only return the first return)
1 parent 50588f3 commit 20ddb0c

1 file changed

Lines changed: 0 additions & 3 deletions

File tree

misp_modules/modules/export_mod/osqueryexport.py

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,6 @@ def handle_service(value):
8484

8585

8686
def handle_yara(value):
87-
return "// WARNING make sure you examine and modify the path parameter below otherwise this is a very expensive search"
8887
return "SELECT * FROM file JOIN yara USING (path) WHERE (path LIKE '/%%' AND type = 'regular' AND size < 8000000 AND sigrule='%s' AND count > 0);" % value
8988

9089

@@ -101,12 +100,10 @@ def handle_ip_src(value):
101100

102101

103102
def handle_filename(value):
104-
return "// WARNING make sure you examine and modify the path parameter below otherwise this is a very expensive search"
105103
return "select * from file where path LIKE '%s';" % value
106104

107105

108106
def handle_sha256(value):
109-
return "// WARNING make sure you examine and modify the file.directory parameter below otherwise this is a very expensive search"
110107
return "SELECT *, sha256 FROM file JOIN hash USING (path) WHERE file.directory LIKE '/%%' AND sha256 like '%s' ORDER BY mtime DESC LIMIT 1;" % value
111108

112109

0 commit comments

Comments
 (0)