News From The Automation Department

The talk starts from a practical gap: exposure data from leaked scan results gives only bare IP addresses for hosts with recently disclosed Exchange Server vulnerabilities. Looking up owners through WHOIS and DNS rarely produces a usable contact quickly, so the speaker's team built a pipeline to reach the responsible people faster.

The pipeline pulls results from the LeakIX API with a Go client, then resolves each IP to its DNS names and alternate domain names using OpenSSL. A validation step runs an Nmap script, written by a colleague for Exchange issues, to check whether a host is still exposed to the latest referenced attacks. WHOIS and DNS lookups then produce candidate email addresses, which can be corrected or extended by hand when the list looks thin. A notification template is attached, and a ticket is opened that sends the condensed advisory to the contacts. A live demo showed this flow end to end for one organisation whose server had been patched but was not fully covered by the check.

The second part concerns a large MISP community of roughly 3,000 users across about 1,500 organisations, many of them external and therefore outside the speaker's control. Bounce messages from departed users or full mailboxes were piling up, so a small script collects them from a mailbox fed by Postfix and Exchange bounce notices, extracts the addresses, runs sanity checks, and then either disables email notifications or disables the account. The takeaway is that modest glue scripts around existing APIs and mail handling can keep both outreach and user hygiene manageable at scale.