IOCs are incorrectly excluded when a general honeypot is disabled

[regulartim]

Disabling a general honeypot will exclude all IOCs from the feeds that were seen by that honeypot. Even if they have been seen by other honeypots. I do not think this behaviour is intended.

The bug is located here, I guess:

GreedyBear/api/views.py

Line 156 in 602fcf9

iocs = IOC.objects.exclude(general_honeypot__active=False).filter(**query_dict).order_by(ordering)[:5000]

[regulartim]

The question is, which API behaviour is the right one in this case?

1. Exclude every IOC that was seen by the disabled honeypot (as it does right now)
2. Exclude every IOC that was only seen by the disabled honeypot
3. Do not exclude any IOC, even if it only was seen by the disabled honeypot (this would mean that disabling a honeypot would only affect the extraction process)

[drosetti]

Hi,
Nice catch! From my point of view the right solution is the number 2. What do you think about it ?

[regulartim]

That would be my preferred solution. I'll implement it. :)