-
Notifications
You must be signed in to change notification settings - Fork 385
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Feature/domain tools more flavors (#321)
* Add HostingHistory and ReverseIPWhois flavors Split Whois flavor in parsed and unparsed, and group IP and domain Add support for Reverse-Whois scope parameter * Remove flavor WhoisLookupIP * Update taxonomies and TheHive templates * Add taxonomies for new flavors
- Loading branch information
Showing
14 changed files
with
265 additions
and
49 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| { | ||
| "name": "DomainTools_HostingHistory", | ||
| "version": "2.0", | ||
| "author": "CERT-BDF", | ||
| "url": "https://github.com/TheHive-Project/Cortex-Analyzers", | ||
| "license": "AGPL-V3", | ||
| "description": "Use DomainTools to get a list of historical registrant, name servers and IP addresses for a domain name.", | ||
| "dataTypeList": ["domain"], | ||
| "command": "DomainTools/domaintools_analyzer.py", | ||
| "baseConfig": "DomainTools", | ||
| "config": { | ||
| "service": "hosting-history" | ||
| }, | ||
| "configurationItems": [ | ||
| { | ||
| "name": "username", | ||
| "description": "DomainTools API credentials", | ||
| "type": "string", | ||
| "multi": false, | ||
| "required": true | ||
| }, | ||
| { | ||
| "name": "key", | ||
| "description": "DomainTools API credentials", | ||
| "type": "string", | ||
| "multi": false, | ||
| "required": true | ||
| } | ||
| ] | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| { | ||
| "name": "DomainTools_ReverseIPWhois", | ||
| "version": "2.0", | ||
| "author": "CERT-BDF", | ||
| "url": "https://github.com/TheHive-Project/Cortex-Analyzers", | ||
| "license": "AGPL-V3", | ||
| "description": "Use DomainTools to get a list of IP addresses which share the same registrant information.", | ||
| "dataTypeList": ["mail", "ip", "domain", "other"], | ||
| "command": "DomainTools/domaintools_analyzer.py", | ||
| "baseConfig": "DomainTools", | ||
| "config": { | ||
| "service": "reverse-ip-whois" | ||
| }, | ||
| "configurationItems": [ | ||
| { | ||
| "name": "username", | ||
| "description": "DomainTools API credentials", | ||
| "type": "string", | ||
| "multi": false, | ||
| "required": true | ||
| }, | ||
| { | ||
| "name": "key", | ||
| "description": "DomainTools API credentials", | ||
| "type": "string", | ||
| "multi": false, | ||
| "required": true | ||
| } | ||
| ] | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
6 changes: 3 additions & 3 deletions
6
...omainTools/DomainTools_WhoisLookupIP.json → ...ools/DomainTools_WhoisLookupUnparsed.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
83 changes: 83 additions & 0 deletions
83
thehive-templates/DomainTools_HostingHistory_2_0/long.html
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,83 @@ | ||
| <div class="panel panel-danger" ng-if="!success"> | ||
| <div class="panel-heading"> | ||
| <strong>{{artifact.data | fang}}</strong> | ||
| </div> | ||
| <div class="panel-body"> | ||
| {{content.errorMessage}} | ||
| </div> | ||
| </div> | ||
|
|
||
| <div class="panel panel-info" ng-if="success"> | ||
| <div class="panel-heading"> | ||
| <strong>{{artifact.data | fang}}</strong> | ||
| </div> | ||
| <div class="panel-body"> | ||
| <p> | ||
| Registrar History | ||
| </p> | ||
| <table class="table"> | ||
| <thead> | ||
| <tr> | ||
| <th>domain</th> | ||
| <th>registrar</th> | ||
| <th>date_created</th> | ||
| <th>date_updated</th> | ||
| <th>date_expires</th> | ||
| </tr> | ||
| </thead> | ||
| <tbody ng-repeat="row in content.registrar_history"> | ||
| <td>{{row.domain}}</td> | ||
| <td>{{row.registrar}}</td> | ||
| <td>{{row.date_created | shortDate}}</td> | ||
| <td>{{row.date_updated | shortDate}}</td> | ||
| <td>{{row.date_expires | shortDate}}</td> | ||
| </tbody> | ||
| </table> | ||
| </div> | ||
| <div class="panel-body"> | ||
| <p> | ||
| IP History | ||
| </p> | ||
| <table class="table"> | ||
| <thead> | ||
| <tr> | ||
| <th>domain</th> | ||
| <th>actiondate</th> | ||
| <th>action</th> | ||
| <th>pre_ip</th> | ||
| <th>post_ip</th> | ||
| </tr> | ||
| </thead> | ||
| <tbody ng-repeat="row in content.ip_history"> | ||
| <td>{{row.domain}}</td> | ||
| <td>{{row.actiondate | shortDate}}</td> | ||
| <td>{{row.action_in_words}}</td> | ||
| <td>{{row.pre_ip}}</td> | ||
| <td>{{row.post_ip}}</td> | ||
| </tbody> | ||
| </table> | ||
| </div> | ||
| <div class="panel-body"> | ||
| <p> | ||
| IP History | ||
| </p> | ||
| <table class="table"> | ||
| <thead> | ||
| <tr> | ||
| <th>domain</th> | ||
| <th>actiondate</th> | ||
| <th>action</th> | ||
| <th>pre_mns</th> | ||
| <th>post_mns</th> | ||
| </tr> | ||
| </thead> | ||
| <tbody ng-repeat="row in content.nameserver_history"> | ||
| <td>{{row.domain}}</td> | ||
| <td>{{row.actiondate | shortDate}}</td> | ||
| <td>{{row.action_in_words}}</td> | ||
| <td>{{row.pre_mns}}</td> | ||
| <td>{{row.post_mns}}</td> | ||
| </tbody> | ||
| </table> | ||
| </div> | ||
| </div> |
File renamed without changes.
40 changes: 40 additions & 0 deletions
40
thehive-templates/DomainTools_ReverseIPWhois_2_0/long.html
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,40 @@ | ||
| <div class="panel panel-info" ng-if="success"> | ||
| <div class="panel-heading"> | ||
| <strong>{{artifact.data | fang}}</strong> | ||
| </div>- | ||
| <div class="panel-body"> | ||
| <dl class="dl-horizontal"> | ||
| <dt>Number of records</dt> | ||
| <dd>{{content.record_count}}</dd> | ||
| </dl> | ||
| </div> | ||
| <div class="panel-body"> | ||
| <table class="table"> | ||
| <thead> | ||
| <tr> | ||
| <th>range</th> | ||
| <th>organization</th> | ||
| <th>country</th> | ||
| <th>server</th> | ||
| <th>record_date</th> | ||
| </tr> | ||
| </thead> | ||
| <tbody ng-repeat="row in content.records"> | ||
| <td>{{row.range}}</td> | ||
| <td>{{row.organization}}</td> | ||
| <td>{{row.country}}</td> | ||
| <td>{{row.server}}</td> | ||
| <td>{{row.record_date | shortDate}}</td> | ||
| </tbody> | ||
| </table> | ||
| </div> | ||
| </div> | ||
|
|
||
| <div class="panel panel-danger" ng-if="!success"> | ||
| <div class="panel-heading"> | ||
| <strong>{{artifact.data | fang}}</strong> | ||
| </div> | ||
| <div class="panel-body"> | ||
| {{content.errorMessage}} | ||
| </div> | ||
| </div> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,3 @@ | ||
| <span class="label" ng-repeat="t in content.taxonomies" ng-class="{'info': 'label-info', 'safe': 'label-success', 'suspicious': 'label-warning', 'malicious':'label-danger'}[t.level]"> | ||
| {{t.namespace}}:{{t.predicate}}="{{t.value}}" | ||
| </span> |
File renamed without changes.
3 changes: 3 additions & 0 deletions
3
thehive-templates/DomainTools_WhoisLookupUnparsed_2_0/short.html
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,3 @@ | ||
| <span class="label" ng-repeat="t in content.taxonomies" ng-class="{'info': 'label-info', 'safe': 'label-success', 'suspicious': 'label-warning', 'malicious':'label-danger'}[t.level]"> | ||
| {{t.namespace}}:{{t.predicate}}="{{t.value}}" | ||
| </span> |