# ControllerOne Testing for New Index Changes are made to controller-one to cope with fields inconsistency in elasticsearch index. --- ### URL Dummy Data from new-index ```jsonld= { "_index" : "phishing_intelligence_v2", "_type" : "_doc", "_id" : "3ebb2223a01ec16e52fd7ecf46d24ded54c595c653439a68b716005c66c400c2", "_score" : 0.9808291, "_source" : { "value" : "http://abaadteam.com/qlm/customer-area", "type" : "url", "suricata_sid" : null, "sources_info" : [ { "source" : "https://dummy-data.com/testing", "date" : "2023-05-26" } ], "frequency" : 1, "tags" : [ "url", "phishing", "malicious" ], "score" : 100, "confidence" : "Medium", "created_at" : "2023-05-26", "updated_at" : "2023-05-26", "status" : "active", "threat_actor" : null, "campaign" : null, "typosquatting_info" : { "is_typosquatting" : false, "typosquatting_of" : null }, "cluster_info" : { "webpage_hash_clusterID" : null, "webpage_screenshot_clusterID" : null, "Favicon_cluster_ID" : null, "phishing_kit_cluster_ID" : null, "geo_location_clusterID" : null, "industry_clusterID" : null, "WhoIS_clusterID" : null, "Suricata_clusterID" : null }, "geo_location" : null, "phishing_information" : { "detected" : false, "tag" : null, "tagfile" : null }, "webpage_hash" : null, "screen_shot" : null } } ``` --- ### Domain dummy data from new-index ```jsonld= { "_index" : "phishing_intelligence_v2", "_type" : "_doc", "_id" : "40110c6f7998c4c704c0925b9e635fe6eeca63a8f5e1b205a6dd780237594e0f", "_score" : 0.9808291, "_source" : { "value" : "webcuscasegure.webcindario.com", "type" : "domain", "suricata_sid" : null, "sources_info" : [ { "source" : "http://data.phishtank.com/data/online-valid.json", "date" : "2023-05-26" } ], "frequency" : 1, "tags" : [ "phishing", "domain" ], "score" : 100, "confidence" : "Medium", "created_at" : "2023-05-26", "updated_at" : "2023-05-26", "status" : "active", "threat_actor" : null, "campaign" : null, "geo_location" : null, "cluster_info" : { "webpage_hash_clusterID" : null, "webpage_screenshot_clusterID" : null, "Favicon_cluster_ID" : null, "phishing_kit_cluster_ID" : null, "geo_location_clusterID" : null, "industry_clusterID" : null, "WhoIS_clusterID" : null, "Suricata_clusterID" : null }, "phishing_information" : { "detected" : false, "tag" : null, "tagfile" : null }, "webpage_hash" : null, "screen_shot" : null, "is_infrastructure_blacklisted" : false, "is_idn" : false, "target_organization" : null, "favicon" : "-1605180542", "is_sister_domain" : false, "pivot_domain" : "", "whois_info" : { "registrar" : null, "registrar_whois_server" : null, "registrar_url" : null, "creation_date" : null, "update_date" : null, "expiry_date" : null, "name_servers" : null, "emails" : null, "status" : null, "dnssec" : null }, "typosquatting_info" : { "is_typosquatting" : false, "typosquatting_of" : "" } } ``` --- IPv4 dummy data from new-index ```jsonld= { "_index" : "phishing_intelligence_v2", "_type" : "_doc", "_id" : "99412a93d4a5f28eddcb3d71a6f6006917abc399ab65dd9ba3cff0ce49451000", "_score" : 0.9808291, "_source" : { "value" : "103.244.44.37", "type" : "IPv4", "suricata_sid" : null, "sources_info" : [ { "source" : "https://dummy-data.com/testing", "date" : "2023-05-26" } ], "frequency" : 1, "tags" : [ "url", "phishing", "malicious" ], "score" : 100, "confidence" : "Medium", "created_at" : "2023-05-26", "updated_at" : "2023-05-26", "status" : "active", "threat_actor" : null, "campaign" : null, "geo_location" : null } } ``` ### Email structure is same that of old-index ```jsonld { "_index" : "phishing_intelligence_v1", "_type" : "_doc", "_id" : "a81c43ae39cad88769b226250550a20c7d8a802d8c252e5bf6aab93a5ea2901e", "_score" : 6.6198077, "_source" : { "value" : "Romane.Boyer@live.com", "type" : "email", "sources_info" : [ { "source" : "http://untroubled.org/spam/", "date" : "2023-03-22" } ], "threat_origin" : [ ], "first_seen" : "2023-03-22", "last_seen" : "2023-03-22", "created_at" : "2023-03-22", "updated_at" : "2023-03-22", "is_phishing" : true } } ```