New analyzer: Maltiverse_Search

analyzers/Maltiverse/MaltiverseAnalyzer.py

@@ -0,0 +1,55 @@
+#!/usr/bin/env python
+# encoding: utf-8
+
+import requests
+import hashlib
+from cortexutils.analyzer import Analyzer
+
+class MaltiverseAnalyzer(Analyzer):
+
+    def __init__(self):
+        Analyzer.__init__(self)
+
+    def summary(self, raw):
+        taxonomies = []
+        namespace = "Maltiverse"
+        level = 'info'
+
+        if 'classification' in raw:
+
+            value = raw.get('classification')
+
+            if value=='malicious':
+                level = 'malicious'
+            elif value=='suspicious':
+                level = 'suspicious'
+            elif value=='whitelisted':
+                level = 'safe'
+
+            taxonomies.append(self.build_taxonomy(level, namespace, 'Classification', value))
+
+        return {"taxonomies": taxonomies}
+
+    def run(self):
+        Analyzer.run(self)
+        if (self.data_type == 'fqdn' or self.data_type == 'domain' or self.data_type == 'ip' or self.data_type == 'url'):
+            try:
+                endpoint = "ip"
+                id = self.get_data()
+
+                if (self.data_type == 'fqdn' or self.data_type == 'domain'):
+                    endpoint = "hostname"
+                elif self.data_type == 'url':
+                    endpoint = "url"
+                    id = hashlib.sha256(id).hexdigest()
+
+                response = requests.get("https://api.maltiverse.com/{}/{}".format(endpoint, id))
+                self.report(response.json())
+
+            except Exception as e:
+                self.unexpectedError(e)
+        else:
+            self.notSupported()
+
+if __name__ == '__main__':
+    MaltiverseAnalyzer().run()

analyzers/Maltiverse/Maltiverse_Search.json

@@ -0,0 +1,14 @@
+{
+    "name": "Maltiverse_Search",
+    "author": "Rémi Allain, Cyberprotect",
+    "license": "AGPL-V3",
+    "url": "https://github.com/Cyberprotect/Cortex-Analyzers",
+    "version": "1.0",
+    "description": "Maltiverse is born as a service oriented to get used by cybersecurity analysts to research on indicators of compromise. In recent years, the international community of security experts has consistently confirmed that the technological infrastructures on which malware campaigns are deployed have an increasingly shorter lifespan. This means that facing a real investigation scenario, the IOC's to check are very likely to be unknown. Maltiverse analyzes all the possible dimensions and points of view of known and classified IOC's to compare them with the unknown indicators for matching.",
+    "dataTypeList": ["domain", "fqdn", "ip", "url"],
+    "command": "Maltiverse/MaltiverseAnalyzer.py",
+    "baseConfig": "Maltiverse",
+    "config": {
+        "check_tlp": true
+    }
+}

analyzers/Maltiverse/requirements.txt

@@ -0,0 +1,3 @@
+cortexutils
+requests
+hashlib

thehive-templates/Maltiverse_Search_1_0/long.html

@@ -0,0 +1,40 @@
+<div class="panel panel-info" ng-if="success">
+    <div class="panel-heading">
+        Maltiverse record for "{{artifact.data}}"</a>
+        <br/>
+        <a target="_blank" href="https://www.maltiverse.com/{{content.type}}/{{artifact.data}}">view more on www.maltiverse.com</a>
+    </div>
+    <div class="panel-body" >
+        <p ng-if="content.tag">
+            <span class="label label-default mr-1" ng-repeat="tag in ::content.tag">
+                {{tag}}
+            </span>
+        </p>
+        </hr>
+        <div ng-if="content.blacklist">
+            <h4 class="dl-horizontal">Blacklists</h4>
+            <table class="table table-bordered">
+                <tr>
+                    <th>Source</th>
+                    <th>Description</th>
+                    <th>First seen</th>
+                    <th>Last seen</th>
+                </tr>
+                <tr ng-repeat="bl in ::content.blacklist">
+                    <td>{{bl.source}}</td>
+                    <td>{{bl.description}}</td>
+                    <td>{{bl.first_seen}}</td>
+                    <td>{{bl.last_seen}}</td>
+                </tr>
+            </table>
+        </div>
+    </div>
+</div>
+<div class="panel panel-danger" ng-if="!success">
+    <div class="panel-heading">
+        <strong>{{(artifact.data || artifact.attachment.name) | fang}}</strong>
+    </div>
+    <div class="panel-body">
+        {{content.errorMessage}}
+    </div>
+</div>

thehive-templates/Maltiverse_Search_1_0/short.html

@@ -0,0 +1,3 @@
+<span class="label" ng-repeat="t in content.taxonomies" ng-class="{'info': 'label-info', 'safe': 'label-success', 'suspicious': 'label-warning', 'malicious':'label-danger'}[t.level]">
+    {{t.namespace}}:{{t.predicate}}={{t.value}}
+</span>