From 191906ab0c03d78e193576a6b5bbc3b45a76e44f Mon Sep 17 00:00:00 2001
From: Pierre Lalet <pierre.lalet@ssi.gouv.fr>
Date: Sat, 9 Jan 2021 03:54:41 +0100
Subject: [PATCH] Add IVRE Analyzer

---
 analyzers/IVRE/IVRE.json            |  59 +++++
 analyzers/IVRE/assets/ivre_logo.png | Bin 0 -> 24127 bytes
 analyzers/IVRE/ivre_analyzer.py     | 367 ++++++++++++++++++++++++++++
 analyzers/IVRE/requirements.txt     |   2 +
 4 files changed, 428 insertions(+)
 create mode 100644 analyzers/IVRE/IVRE.json
 create mode 100644 analyzers/IVRE/assets/ivre_logo.png
 create mode 100755 analyzers/IVRE/ivre_analyzer.py
 create mode 100644 analyzers/IVRE/requirements.txt

diff --git a/analyzers/IVRE/IVRE.json b/analyzers/IVRE/IVRE.json
new file mode 100644
index 000000000..2ce248b00
--- /dev/null
+++ b/analyzers/IVRE/IVRE.json
@@ -0,0 +1,59 @@
+{
+  "name": "IVRE",
+  "version": 1.0,
+  "author": "Pierre Lalet",
+  "license": "AGPL-V3",
+  "url": "https://github.com/TheHive-Project/Cortex-Analyzers",
+  "service_homepage": "https://ivre.rocks/",
+  "version": "1.0",
+  "description": "Fetch details from an IVRE instance.",
+  "dataTypeList": [
+    "autonomous-system",
+    "certificate_hash",
+    "domain",
+    "fqdn",
+    "ip",
+    "network",
+    "port",
+    "user-agent"
+  ],
+  "command": "IVRE/ivre_analyzer.py",
+  "baseConfig": "IVRE",
+  "configurationItems": [
+    {
+      "name": "use_data",
+      "description": "Use data from the data purpose (MaxMind)",
+      "type": "boolean",
+      "multi": false,
+      "required": true,
+      "defaultValue": true
+    },
+    {
+      "name": "use_passive",
+      "description": "Use data from the passive purpose",
+      "type": "boolean",
+      "multi": false,
+      "required": true,
+      "defaultValue": true
+    },
+    {
+      "name": "use_scans",
+      "description": "Use data from the scans (nmap) purpose",
+      "type": "boolean",
+      "multi": false,
+      "required": true,
+      "defaultValue": true
+    }
+  ],
+  "config": {
+    "check_tlp": false,
+    "max_tlp": 3,
+    "check_pap": false,
+    "max_pap": 3,
+    "auto_extract": false
+  },
+  "service_logo": {
+    "path": "assets/ivre_logo.png",
+    "caption": "Logo"
+  }
+}
diff --git a/analyzers/IVRE/assets/ivre_logo.png b/analyzers/IVRE/assets/ivre_logo.png
new file mode 100644
index 0000000000000000000000000000000000000000..a22935b0ced17a773705923cf9d35ae0dd918aba
GIT binary patch
literal 24127
zcmb@uc|4VC`!>F?V$oz7qKIV`DTR<wSXd&dln@z1s8ohTGNxFDkc3i(G$;v4B9Vkf
z(u`D;AtDXt;dfm2`~Cg%{k;FZ&wlpa?R(w#bzj4Io#%NR=W*Q}vn@t*1r`ZVD3rMy
zjoI5N6dpSMUP$A`l@PUiv+*z9-J6Wqlxgx;X2sPcT;V@tZ0&<5-jlz%^ySa{<07B$
z#?6L&pZSF6EK)PN{eCrt!k}zq>+SGw?)wx_diL-I-Cqqpmh-v_>Y3d7d08}>@@N%D
zMYR>BJNE9~vw4gC<+R-`OEoo<gtzQ**4n)0it~-;hJ~%WZIulTMa-z%^d3ICzEWzw
zo5RJfVWS_Zg_2)ZHvB$nmtvLE{rJy=%3+@e1LNZr1MBD>d!L?JZnt;u-VIBIICKuX
zy&y`QPM79HWk+={qRY}>EoYV)v6<+esv4Vpn7yN7yf=Es3X6=Clwp$<$w${Dn^XwV
zmEOO9Us>Y){pm^H35tj6sLojTr9d?`wPWiOjnflME^mp7lBpG=P&D&2nHS@uBLDpU
zEv2|>mEFh(=lHkZk8x5}TuoBO#>P~)=e`-GuU^Fzh!dqyK3qP6|Gv*=4&IP4IJw^Y
zz1@*DUE4XvvC_IzHBlq`+39rpg*ZOkxa>T${cb=&K;^Nak8W0bJUOZAo;Fu6tUEFl
z#I{{fvVx1k+83abY%=NC({y=w&*qum^;})Q8)C!~^wn=x^HM_93mMFOyCRn-;jxNz
z;bmLa%cPmM3DF-dHm6YB#fD{*p4?iwtE4Y3b_LzJ?$pl<#!G`!jhDWhAMY@W5;|m=
zWV|&0*3Fxf!MoPWmAqXxGLWy+Dn*}^Tt}gFYvk_uk-KBXzqEJu$?kWAylUu1B8Pvx
z=^2YERm;<%P*`Oj(o8NZT9^6u+<JYTZJMs(#ZpO|*vyvf6-VF4HZB!fo06RT;y|3(
zyTyk%;_LkSUSYVyhV1!~u)QWLtb}^9$%Uf*AB%1-wq(}ENgVNJCXN`e&uA^BP!i~t
zhBdLWo6epY7zkkuPy}i|a@e~sa&u8A3%~!0@;^E;GI(itShv7Ifi5g(nu@+m3DRes
z!tX9Qn_s+mVSX`WYV@$DJ+tjowVDz$`rAA_>FLQfwZ?RH292f+d8~U~>eW%ZOo&r1
zLZeXX1&%M-J=Oi{()_(iLaPIQe=`u~)Kt)48NNer)@%?H6`kxi&luYgylMKxg2~z?
zr!=zV6OEs5T`IK1We$a6?bdy2@j5Nfw)>-B&rWnMxXJeY@y6o-Gci?u7aHG!RlCkF
zEcblxtAS4~2UC@us;x1@2MW0<tapLybag`}+8@Wf@9$ar(@S=DQ_e<h^V~OEUHM^v
zUo$&9J1bsJ5AS52e)8=f{ne(k=#lD{b7<pU;Mm;qPcPNH+G{E|$|cR-t?OV6>vG9k
zMfdt}T6R<0$G5tz-%V<YJzfjo;jJ?R-5ANPd0RdnS-z5PVPTQMiP~1gLkUek+%q!R
z!B=vPZF*k)CL`J8MdCsV<y&!f)QDw_3ERTr?Xo4iuRX`M>atVY^E`DbP=OwRA?&rr
zoYS|ZXJmwYkDTswXw}ems*Vsw_otu2?f6?+T-|bEOndZO(z?&%5+Q{`iKcS8N=qn|
zFFa3w{P^*5>dR;UO15Ocx5Q7F@E#Rz3PlGKYg_P4C@~{r`bkvxQtag~$FZ-xVB(U$
ztz?-@oh4Efildm&6PMq8mGbnCy7++w^tvZ7tPjaMRviA}a3*TUiZyGP0&E@%rOyPb
zpoSIAA4rLcN>yBdN9PNiJAXbtsFDpI(&37C_HA5|d`^m<xYqUQ8AbYP8`xmgMf|v&
zP7heKX3dgz1EmXSYoq|}sxX;KiN>*lnCV9DPjXu?wi<EZAZ_xpvYgoVFyd?S6iVn>
zW0=No%sOQoeq6PZ9@!}?#8J#9ckX1Cbs9zpVdjdBS0w+)X5-?x{!AnN70FS|nI{sB
zmudx=uc1&1ww{53vdGW>`wwQA9f~YQ@W21?e|dtm@&D|JnYaG$Uj6@9$nT*gW(@Ao
zKCA89g&seC{3_S{>Trmit*zwc%a;>V?uNWix_<pSGug!O@ZrO1Yu6fidU~p<t8WMj
z3VQSYy^*u?r7v7)u1RmW|I?*?@AJJH_4pp^@huklRCYK<(XNbbZEfxQvw2OK-_NnB
z>4B!po6ej$<6EC`yRdMzUw`Yuw{PEu3|hg`ckI|v^YX$v=kcMR+qP|^i;9X44z(OK
zva`FuGbfWxY240XGv{e_XKIXmIezKLK-<9dKw!w>-gm3Y4)-n?9UWab7$7iv_9dfu
zsaN>Ng6Vbt{{1Tq8Xx+A-^W8L{=M6UCrUh9@(xkt>6Cj{^YT{C)BfA2@wd^yxhj-v
zV0!G!@%g91!&|3p6crUu1y7C{Rt8V{jW#4bak-DD3q4+6`B3a(zW+nP*GY$ipUT#p
zev-q*+c-}M_Pv$EmH99E%$b_1FdpZ|Oug0ajhW&ahaBffYABZ-8Bk1DZ~X8<Tta<+
z)bHQF{X62;?w%a`H&`oiu;%>12f4PC;`~{bOp1-(E&Gby-HlnReY+cnH$9SxloaBy
z^)-Ix6ci})&X<xr&NqK5rt))RqhRm*Tk-Gh16NtzvR{0|>ei{XZT?HnojVu7Tab~*
zru1DpK3_-U<XnlNU=MLE-)nDA%z2IX->Mk0$+NyKM;^L$|F_Bh=Hlhsm+J~~**Jy?
zaTV~LIB{b2v5{XI6Tcog_kAcNf9`I*ciXYZ%+Ag(&#qkkU7oe@zIS<?WCg2QbbPru
z4Arp#L)!hJz-jf-zun@R-Y&6{nkrA9KBXqXDeTzaTDsaYZzug(ic-9o!?D#XR;-}%
zU^(yQXJ#@^X|zX?CnOQSyhgr88g1K_==kCCs$C^D*DY?eUrw=)cFPD-FFE*GQ3SiC
zewOypzflMZj}aMm|LuO&@8(#!H0g=|zqeM-Pfp7g`t~&KyuByxDvQg6$|{kUmyb$Z
zVpI#iIWrpfM#k37*>5c@Eo=WY=t^%oyOQJj?Cj%~gO#ghT3_nw>PjMu#*b^4c0W&D
zy>0t;rbzQ<m9*HmH>~Qi4P$n{$~G)?dc>PWLGxNaTJ9c{^m)FTJR-h&H~ZW7@BAl<
z3t*8ui(EFYAMd-3{%jw(2B#2u%9relGt13)BRN{_{muAsSn*xN{GFwToYoK42oFA0
zxaGfg7UrcmQcC-1O<|ps#OteD<DDLz<d29|6xpgX>ax<dRN3;T&1Ez4_I*Fz<eHma
zT(5a$%Y{W9wQ(`w;oMmX7Ehl&>lmz)j<1sne7>olEKZ21h)B&gqs5}6xkBf<4Ngv3
zX7y?MgWZ?nYr|*F-d%TUF*i1FXhqNaTMox2I;7)!USBmDXsei|{}NeTG=h8$xo@!j
z@v9FX<jG9=Z}sx>l04Gt<@Ni?vO1^8#d3lp30QG|ETQw%#3*)(To`(pP(Dw0;#aDs
z&mQ#jqo1sM)|!3qY9>biI6n-ZwavjnNf3<{IXF2vnWm}8B52W#B)uY7j=B|-LoI`i
z2J;`oip5(>JcVhPnU7t#5@&sT&tnYzl26x5?l8;Krg9yR#T;S-{&YUR-JsLEtuR!G
z%cX?PB<WUcnyOnZGKPvd^O`?g*?hh|WO_KHBR*upd54wNY^oVE^!YY3GePsKTjE}C
zS@&Z0*G!%runp<yk-F01w!ll-+4>ALmvgJAs7T{y@$2?8=36)iK9%uPwRW1Do3FGf
zmhZpUb&*)#EN*!^Ypfe~k{-~R=2gwVjJ<IqhsBtC)8@{K{s-d+hBsqA8Vkq%_6WPB
zdu>SfZ|7{=v16%VJw>T<!n-w~>%w5)?FIoJbZSV|r9MGp;QpW8)e-y$&YqlOVQ()L
zGV(~e9aa(JqOzRKT61lI)1&rQpN2S&@UjieL_wNM7}++`Q@<kpyR#y*@7=Q|oi9Gc
z#lu_k(Jf<f-QpwZ$&qRn@TY#`t->7knX_lLG#2iLn;vZWJf(gyc+6wi6um5%=AFAp
zM9lV37;eAg_p^CqV0vo6A4AQ)a^=cf0sDQM8E}bsyf%Vgxc%?zt?>_!^R07Vn0f#H
z`rz@F&$UTgb#h5djoxs-aSg#kx4oXPuG<-4Z2qV7Ma;VX(j`B7dtV1<r=+Ba85$aT
zJ)9+0^E^#;@%=f4NB{j8`7{tL79*y#fESBi{{GIs_aony=`OsQ?j3z~)#bvB>4~n@
zAyX6AZry6Qrh5dIn11Z{lflPI!LRh5GsvbUFR%~%xyFe?r_cU9{;&5)oMdQrcD6=u
z-tG4DpC|UjN@;8T{`2R=>005kmILLhIt18kwvUfb-mbffC+96*1lR1NtjdP>Z_i2E
z5<N9JUbpX7#R5bs{jk=Od=_s)3tV3N8}qGkFuHY!Y%3Dxm|0jPzuNU2KV)CO{xs})
zRfoD~bFs$I2j`Bjk<zCerpMkRtjUPiZ!@8OE5NGN8j9J8@bJzN+`#K`;K0l7^LFOB
zXX>K%{I1E$WRT79`pV{*@qtR+;OX(th`Ki&$!_^XVuF~R?>6Fks_R)Fe{EM*Qh#>r
zg4W^a+b^{gPHA?gj$ksrcJ6~M?SFgEr%Pjc;!lTg#t2(PL}OCb0;XGgi><b1jb?&%
z_QB5&ykNg|(V`0Nx>Fsx#2oawWV!2k5pAz*&5#na_jiJ)HDH)T2<hFBShIIWE5g^z
z<_wv9AMzLx`vf<(dM@ugNpU!Muh@mE8^o=dX{LLQaSARhU-!MMs}9$8x7TpIdT-vX
z?TFV^6hYTaw<E>qx)^xi`MEXE-d$elEF13o{<d2~>5uC-+G~Wj#_l?BPgeb4+e&h?
zFUk8#N7`dN?VfIb;-Yft);G7YjEuAEe%CMQIJ@frhfn&La(`*Zysci`vfRc-6-WO?
zZ&JLsRBrRRrLimb$cD$BbB7=FxO!m$aSRz#f3Ft0JQ2!bEvOgfa(MuML3Vvdo$gd2
zcOp-#u%4XOw*-Us^3Rh8j{Upg5LZ;B62`jXzz~FUA(2(F;%}1%-hCo*$s!4fAYPU2
z%)}_+EgCYwNn*N_JzG0^u4XI{fKv#BOO8=}sj)=oPg(;T@r`wcmJt?9Qk0RQyOoO@
zw1;h5kNtU3=-Hy4#k%ssfK5qrt51;eLXJ?|r8BHKi^=EuXp-8`VK9k97);8TSW2t|
zc>yCqFOSWVyEAqFzQ*L=*B$r&yfl|0&F7if*er6G`kms8S)X~LEqL5BizWAbBbv_&
znVuTFH9dCA>y@F{azT@b2G+YYHIMBR<CW8ah<gU&30!FR+@_^MUd<j?AD<AjzqVeG
zo+!Gt1YkFY=ZQnWL5tnU54`@oSZn0!df5zyIb;zprQQDfnGy*y0>_74AJrgjd>ZC*
zmslhT@-w4!f5i-AEh@Ue-}DACyxmB5ERp-6!^g72`)WgYw{|!kM6x9Hd1~lxM~uV7
zZjl8G1gK51$uwhCWTu1Pl|nROlZtcvmP;I1fAiY4LyV6%uy(3$FJtl6+SYqM&cuGh
z)SP6wo9c~pekYcGJt-kV8|uDrq-}6v{c>!#D2W55GJ9U8FP~#9Y{_J7ex9!R`o-%$
zixtVy$e&`TB|rXJ=<a|_h`5y18{!s;P7fWN?tHMQ+tHGld0bRXtPXj}B8Q1~F;Uvk
z^|CT80Rffiv90FjNp~%8JDdVjG4dW;LtM>0L7Bw~ZGBT2GEKTce2Eb6s_n>aNwzwz
zDIg%Q{y`GYSpUS=`61%VF8XKB-0$7aSysDw?I#f)zIh_NtA<{#8(`bpcZM7m6A|%O
zUCozs?V7w|d0){;WXMRQ{Hj%=G<kZ$r0z(5X?t{OU(vJmB?*%&=sL3}GA^CcT5$lc
z7GLjQK$`A*1FI_?YTl<E#F?~&Es72cElt{}KrcRrZ1?f};9tj6wGLmOxm9KFn`@;=
zP@TWkCss4MHnEZD2Qu9)WMyT&-db2ahVwcjx@(H@DWFE7_&D)AI^!Q3#vaykAztsw
z*`AA;+`M^no6Y9)8h@Uvb`(6C7t@<x{&LgYths5gSQ0CcV&BLwTcI<2uVJ}harEMK
zel9QEU<fyOOwP}k3)~D6&_hm$VriF=@2@`6ZyV_AVe!#dT2Eb+*|fFcqIL(L?uedb
z$i!eZavhaNh>5%VTkoxQsTXu=yk69!!@bol`=;oE1-0K(9HhvuUy^7{qn@D|JCJk;
zzHtK*?g+gbH}dmeo@*%b>Dt0~Mm@!NX?yr=#i)b9f6i~SwOuLbE_)#Fq~(O(;jbse
zYSY{<_C$+$!od*;^zPWjva&K`xukxvY&+tTU%`cqbcIa0#fzP^{BmBxMh{;9*krFm
zJmzRqSmq0)7#sBThHS^5G&D3^PZn+Z97SI;vk`7y$z-$Y6ciL<G<`Zr3aBur`3?N*
z?d$N|BK}s?pZyhYqgFfD(s<6$y2T?Uy^U={CjSMCzf#0jE82TmK}o40i0&JOe5JJW
z+`iq&Hpsj*zeiq0*ByHm-;NAQl=r74vncMTsqdNa@Nn3SLVJ6RQpsG=p)N@wuD<e)
zQ|lBT4Bfe9h(uA@{XPE?m9*#Q8j?)ql4)A4#DM}9dcEGf)({5If>D)tb*8z^cq*&>
z?gXJ%t*z-6vekZaO%IWXN^1uW#bVjF6rNasO>YC{pk}lyLmB}rky|hF+V$(vwY9Z*
zqwC}1;^g+{#9?qXci!7eU>6JX%F`Q7mYLYw+xmTU^#Tny`}n*+WHYQtemc`3?F*b@
z6+o2I{<7X|w}y*ktn*CCba$=$%z-!76ZgFq9W9W--~1tzi>Ljh#DOTi<GlQsy$`ye
z@=k?J)P=+%5(^xkml8KTe<z2r_+R&{CHdw3Wg2}2k0O8~`p)OumDlP{zSezwZQG@Y
zFrlxiiOxuM+XFw3UmT_YHLZGobJyLGw&4e2k0R%b@p>$gIH>REyrw5FCuiw{KNkk%
zg)-SyZHoZ_1}6tXbdg`InA2o}t?@4CN^`Rf-`V1KK-{USZd<@Y+Kc1n{C_>Km*rPZ
zjR8PrDjO3VYeMxU84S70G(*RZ+~qJ6p~gQ?2mkGPZ6uy^!9``^+_`hDhwm*~w5aGu
z;T@O3h~-L3ij@<;M@H&&73Y{Szch>u{gn7TJvH0`sJnpIBe$eP9bTxY-v?28R~+L~
zbd76@U1#EF7$O@GpaY|{|J(m*mw3)in0Y-c_NmY|E2}O_(l*2PrcFwB?(lbo)9PKx
zG7p4Ik9*b2MAD8IzXL!;{?Myqg|Jv#yMZq?RzWDmAvl15hH4m%t<SHAe0BfcJKSO=
z&=Emz7ZLd6`n^Kx+lItc?La@%3tAT9@M{Xdlyu<So2yLa=^mN6xlg#{oMUQ|t?WGv
z5$V14-sjtONKX$+Uvj7nu4Y^^VXK=g6|x@fw(-7UZ0q${bhSs*QYQ?jWX1C3oEx_u
zXd$^>I!DDs{orV!klqyqV8mM?lf49!&D^$p<;qxc+q`vs%1#N1MTgfV4YL#GM#scB
zzf9L$?f=V>+@>xXH4r>p4#ew@o1&wmi~Nc}ne<VTL`^nr>L}~YH(zSTWGL{CmdCeC
zsP2hXR(`cb6@)Erm2@n+ZfxuGV$G|oTct^3a^*;Dw8P``<mn&FgtFKPo^65LjtHkP
zH?FkqyxT9M&9`V83cB2fGjRJpw;sl`&Bo>jCFw9(PoK``9Q-hw2OjVV|FU#Jq-<G?
zdVx>nN8*8Vbxll6iaJ$64lgGjdc)lVpU{J*#w>%5U7yD+;aO<p$%n6uq!*{yAN6>r
z^WtQyZ|y?28W?<0`&3kWd%L*yQD2g#g~{Gn3?|U)d$QFA`-{uPOsF|`9?e^~a!<p>
zpR>>B`QrMXiM?zrI&ncr<Rs0!s|l7RN&75}rsq0x50Y?}Z%fLvAV~_+V%4K-vP(-f
z(8vXgUAG+%?s;)e^lC<M83Qx;36NfvY$G-n`h=dP1bRYXFVc6_{sw!%w<NjE(c3O<
z&`kK29-~+$e@g3zydEaC%zwc1O{CP(Ys&Tf1aWQ1-+*kQ*4pjDcgpGWN%{Bh6EmA5
ztz%2fY@WkYE4#xMlEEWis~K*RN4v9LH8v)Ah4i01d9wR+WhIaCOA@g5<=>OTlq<}E
z|26K)2nm)9`ui%JaTP?E+qXwN$o*A{CV<VG@9ZN!Xz-K>Zj@hk!FT(yALbcCR82Pk
zpoOD-qt(^bA4<J0p;-x#L?k>k)CZntaTu54fK3$deG}44NU}fLb2;|d@xug}*xY%_
z6%i%A_CUH(Wj31?_ybV$`9<xPU92b8v&9sj*L&*0O@K+*suB7tp8#LvvR-5&b}5iZ
z3ya21l9}VZoiI7TInL7)AnW3gzVHdP{X=H;QTV(WGjkO<(3y!@sKOTimiPTxiV@&>
z?bK*YbaXqAwlCwW9bt*wUZ!_{ynR)fJd%F+owfZNgO`Cna<68?qoC<KckT=V7_LkB
z#YN2UU{LR_g+XEP&rMBWV>%FB1*w_`K`A7fTvi!s$S}D~_=R~(kJXc4sNgUfjm6Kr
z1J|>T#3I*kK7(0n0H>D2SEx?;ym|Zf@!3_oB+W(=04H>|tRG}!s8wMgm!c1bjJLeH
zxofRc!XNu%gO6kFPxx<zL5eC^YGfA7PO<goNZj1U{K5(%c|GA*xS6}b9f6L>7|gho
zpRag!rFDB~wIZ<=-HAuKrT!;{xW;?GC2c(gKP|xB_78r~^@UrZ5LfyC;FbLyhMdr#
zH6ZOqNDi%6RqogKfev2U`cD8j6nO6HuoIueRri>t2ln3!hXXvjV%4g+gU31~qz>~*
z7wmm|Jx^;H*h}ZP*DdC)?0a|>7(!e(_&%8h*$00wD;a)%5HyQR`WJck-*Fk8Jj}CY
zzHLuc^+mb80Rdj4-%|qVixID05UkZ)>=7P1-}=F^0L%4hJ=y?FXO$fKtE%mN2immr
zLHrFHVY>R~EL2&l_+VtWUR5OE;A7B*hy<P=3S^K7OFDjt0Z6HH)A_TI%xxsd&C>bY
ze$GFe?|`{Db2#G$ILUW6cXd$=W)tg<CW#4LvQGEFRR2IW+;MoQoj*K6(eLOWnDG7I
zPZj1V7rQi_O%X$mbgKVTIdNG`CSkC!MNTsu*Pd0hTl8NH13};nuz?56z$<qUT)}3_
zVBdM~B5B_yhcR-0(IoFTVxlT(zL{AkYU8D)Rrfp>q?%AQ*HixdZU?Cr3kI6T<LCVE
z$6J&uGVWxcGEf6B-^qHUGg2+~KyY$=SPT!`>v^u)Kv3Ci?jc8*gY~`S9&IEggP>S6
z8w=*c|941y9@+4py9{qt@&EOOa5Pk|z(Mc;uK%3P&YwHi4%FwD>7*Nc%Kp&9Sy*Sr
z5n@JtA8*^~g;iY3&p#C>v3Ad7mu+Qm5ICrHUkc*4=uZ9}`B0}LN5j}2fd>*JX+O2^
z@$c`?ZvUPXl(yWtQ(Wo6NH)*BajisPNrn7UCK3?D20cFs(2nWBV?E)a3w9Q}Z+r9Z
z9U9NOaU;g<Vn8id<YXgBMq9gdmZ9+?E0P)g+~@G@$Fdi!eKz1Ik)`KNr|0f?`r_>&
z$`-Ajr3Y_s;4lL1{J)-%+Q_#GRjDiKJF$HbZ}zv{{}>iInSj)IpToEf$R7b7+3-GZ
z)E#SbuU=e1bI-y%<(65>v?ZBb-tQ64L*8Bbt9mxvzTS{LHs&+M@|C}T&(U<xt&<K}
zkB#ip`A1z{oe%>3Rgbt*S37SYWhOFf>yCA*W^jN>__=Ma!9~H$QhYK3VR};k1o#+O
zLaPVAljWB$r}LUn(>y_#U#z8$cO$cmhi6S6Zw0F~IPs@Jf^vv5L%C%Hm0&B?+X8qE
zzP%Ov_I0YG^eXVFR}WkdCc^`_+DHlI@g3{ATKDDQank2KT7WG<oQJ_X?|ENtnAdlA
zVq$`1%h{QkEQAb~vk!vCYc;#lm(V^K!QE}Mwobd9Q3;}8nUz!Kow<wD<PpbYG4U$T
zWK(Q~(4+9spkj<kUQzMo#|8(mAK>uU3TBEDpYZDLK?iKJgoUTTUZEPB$8gj=lR_-}
z`NxI~Q@Km`@3*o-EmwSZ7;8$QqI+Ws$Y+#}eVrX1I#~?XjL>0d)xkj;{QPRc%;Z>!
zwTgh=;{TZ5t^cD1Aa7`UsXIMEd^h6@#e}U`kvsMXG<}|ZMKjv}dn9D|h-SrRA=z-X
zwZz2#y)mD~#pj5yrJ3;%9O@jZyJ1D(@F|}LZ7V@}dQJx5H+<^GZ{HVM7F1%_YNyFh
zO+;L`ZEKq4>4b8@tICiN@>+W`Fj81Rb6;Mp{apN=F*VWo<8Is0XQ82%JIu_!$n85r
zYudDN<HloCe=@|V#rj}8l$5qEXyiS${&#(<n#XA@q49i@8Jy3}5+x;>S8v{&`J;(y
zR4t;x9GW|i1NQX&CyQjmPrbjoHG}Ym%W3YjNZAE}JiQ?+E9>Fh&c+R6|9Zs;pNIy#
zcaq$sB5jckXYHD4X{GezB|dEdU8I7w6pN=-3+(iDmU?3}Do1h=M?612u%k6@Ku*=3
z?(>ok&+!u;r4)}_A3l6Xunl!AS*p7M+)z~fv2ROY%$Y%(FKDgN0s0c)wn;p~uIFy{
z6iQ7IBM=Dhch?28@xVVb8EOFc{rg2~$}x#cl1=!zn;S{tqP5g(rjd!CpQmmbmFX+o
zxOp>fV&a(I{TnEtAh=MuJo^Y*g?mJQn=MgpJ2v(@V*$0e2pH$6-#Fj5uC8(=?&gPt
zF@`)s6rJ|$CAIQ1$;sGY*68!M@1r(gHzvu}-?nq7JZXtQ<M!g$TZE~_VLyKC-6i0c
z$lo|bw$rkVV@0Iv5}@z$6+|01Y|lL-!8wATbzWjekdhJk*^aO+1cnJVZa}F_(1m;P
zm0foacwv*x=9UeAcNjN+xHZ?a-r`6a%jmqO&y{hhZA^D<6uE}J@hUr=<#)N))U^Eu
zU7lWi5t;1g71ZL@yN<YU_c#*6st7y+!#d=6a=x?_l0YG9V?S7{@m^F1kgINjbxNlC
zywo(JHEt2!leA|Rchf_7s=aIQ>Pa_I?&hs3X@4(9*|~5RS8lnWb#E=XKKx{B@OC_4
z8<4`EleG0%yYR&~5ke0iNa!5%C+I#r)GuB6yqW?%K~d{Sza$dNlNjlTwGT9^BCO>S
zTBbl1slzzP4t@5w_r1~;(=;Yc*{R>GpA&itm8S()FCM*4CMQj`Vg2hsnM@v&2xis}
zy|Oe^Nkl|N`OypQUc@0nYJ^jg_M}lT&|wW^c5q4$FTP0ER7IXJiwo2udt%fhZq_Uk
zXB^)Xi$spHfa*&bi2Cq&{_>U;GOPanc>Ap4v^>49?a8u?zO=^1Fj@UXv+E4IfW1ph
zsO4nW{X7%O<m#J&1NBSdMPM5t9;i`)#@MRIG76GuDO)0J?4zij&HfU@)fD^FlvO67
z8+;5RBV)|)#7BSxQu_-Jou^1Y)*X2UT-`eGaU$S^L)7=ZTPed@WSXkow1Wc<m+;};
zna8PsIK9M<W>(EtS%LmL)YNR}&hGC%@^p6k(I2__Lt&iT>q8fe*DTW^WLY?Tw*?q(
z?=@Ua-)CE=P0!BVVIr4s1%6M|NIIyPf!O($RE3I*cL*l%+8(yL&PYo4e!5(rJV>To
zki{|H1iG&xZqb^j9rnpI?^nn)cmMkGFg(<ER9~GKTPj&^JaMR<XYmu0i1m!uz}lZm
z+-1XUw`1i{Q_EveLMJV^Z{MwhA#5V_I5uy1s9L+B4~Fn<c|0-?m)h8c`V`8%52Sq%
zxuowWl7hZeh2h4Ir{$&$^9#OB8%fXn&MtlkvtjK!r|x;qv&n?|k&p(+hgQ&x4W77c
zr%5B;x^OSdE-ro}k(W#>`bY|SVBpZw4hM&Ur{j?(7C}K342D7ap=y58q~(EYC;uwa
z^Y2e*>{xM`&Eg$JZm}R}>@OYkeF-XiTM5R&^KTm)9c9}MWV5rf^aK-RP-Z6BoOD(l
z;ragBD*Z(*4}t>WTLs#AF7HK^Fg$b)p(fAmL-1>P8-})Kb2oiJ(zxGkEEMDeysRMA
zC4n%BzrH@2g&A6f9~YnmBudRGL~)At)qwE%)Ouy|20^4GkC9?TP&^Kx(xE?+fZRxc
zOXd0Ji5H*QdU|14RFx@4*Z0SS38NW1L!uOQ<%*o%F=H@K<4ndQxUa__3Z2QDdPs;s
zsV|bjh^qj>ncw<TUr$f({?u46y6wz|!7un#y2d!<R^?RL5oVu0sJr{P4?n6x4kN#E
zr3h}hvSQ`Rzl)C6Qxq)oqB=YG;8g^B?JU$6OmHIm9kqj*`xdS9+fPy;?xyrr>&ox?
z{j`x`@p|iC5z^y5ui_dl$an#tYKW2z!|xKh40evnwQvt)Ll9Ri)5H9oLz<GhKA?!f
zc!7y|-uAWPSc*2vH0X~x5(5-;g-L%Ff;qTpn$UUriOWRi+Dgv3bBmn%HXvV_7<*qi
zq<*lT<;O;AnFN?{HMJ7bm{dz^?Dw~ntU6HEBd5nYnWo{Doop!^ZhAT+V<4B7&>1`!
z<4{w5Vm7eO7V$u^Ibr~ivAYgdScoU+5jWy2J)TM?pD<q8d3mOS30FE_oEQ7k)nLUK
zDl}dX{e{=(pkaO<l_;YZ3Urr*jY)F+TupB#hd)bC|8tnW%<6MXEd5#1(*BT7T7=gn
z>PgZvBhUp`h4eO%+B#O;z3qO0SBvM}fOY@4kh#R;?Q8IkWpnB&1TTV9FcmbR_8fqc
z!V63h4DET)@Fy`?XrySAr5XB+KN_`$Oixya&iRt~$Ar4j5ycVxP_;i*Jo9UQ-u;}<
zD)#=b6JdN(g5VMn4&-;GF)Hp4?~s|5?HOHj^KRQBj9i2_rw|oBqv@$hVoCX^<}D&j
z9yN#aI7X~4Zf#q)RFpcln=~XA&MWQj?-Wm{y<cI&VZ_Br>$V9CGU5bkP<arI@>?N<
zs&pI_3zp&uSN7kvWH$Z|tJnz?Mrc|AHlGLwU}ZK>QzI<(QfcW<4AJ9=@}J+}qj?mp
z@?(KZ-f0Ui&IAa}hZU2=Q<?FCAP77_I(L9nC+*7pM5(@+M3b=Qz3nBI@1evQwighm
zI#f+Hc*0)>iJ8O=!Nx*tH%ZV#g(sHJg?6$gUDIbbGC9JNBFboz`W0nyPIfl)!C>4$
zHq0t#`|>c~0_<g!ItO1I3|2)Zv^b1)t{YMZ!ZMOI$<E2CQTU#99QdWq!pcq*AZQDU
z2w^##9V<kWlap5m4)p=)ETHA^4;!K*i6CbT$#%}Xum*`5=>rr#0_;UZT=28yZrzc}
z@lWo1_X^Q+!bs^zkHfkV*_sSS08IWil)iz&xHooWgSRS6U3Vn^=AHyzouR^bLlnKS
zN6OL@SmR@)Wc=*xsy|Dw%rV1CZAwv$TQ_juT)goisV5Ocg<Fk!AwHTTwSK2y<0<5e
z3yypay1Q((>(0bd(8?XCatZSKDvRkR)0(OXVIB}LPqsMa#rd^$hu_<Y0hU(RE90Mo
z4bu}1g|5#QII;K^VSmDpX*FY~L{NU_Jb0k<VEofSbM=|8hPy!*nlOABVk|TmDy!$N
ztBX1hQ8yiEeBlTQB+({~49177oYT!9$`i*b3S5Klw~ZPQs_3!S`S%sp5oRLa(Jc(w
zt3PP=c2MeKyuO0#mgA+32r%pA<~BdX<`KQy>K((KXo%dg<I4F1(V(OSc(kfecvhq$
z8CC(iDZ`T3B$qUJTzaA^DYeMVz`$VQ3!iR*_T1-AX3S#$%)=O|5{i`-iCUXxw@Vzn
zPlu@p^A_K3s|YkgDu}4v*aotAcTE&MJXC!LR;F_7?XC53%VS_Ij~5?lrGNkay*kuy
z&l-JBCJzz>d61pRPM4;clFHnr!oqFh*7;C<f!aQLV{_xnzH21b>b(oV4(|XYP%C_%
zSX~N9jz2D(;QHBpNqX`crnk9;NKB~iOJH4I<3I1V)SfYbG_f7(u=uA>O`KTk7OJ=y
zW19%z#oBX0=^;Z89)0Gp0fB<yZHj_-Yw-9_<Zj!+7aE+LLt<gza@1K2=4rA88+qGM
zfAyajtot-O@i=g4$JUTBa{@0gnD*>zLVD{KK|+=CTu<WOcz^jPzQjimCw9ya895G{
zE>+U!RPpmIyakxLVC7Cn1@n3PVAw`d0ZXsnxN(B3Qw^-HD>5YgQ1xHX+}M0yLgZ2q
zz@R^kw;U=-1&{QH$g~7A=MtZGv7QYmU&}LpJ%i@X$6;5$cnh471-_0@#(FFT6nf&Z
zb!LZ0jr^HAbY9(4h+2FcB8=I3oGK1)n#b4b6R5+iq%oP$?L8LWx?YB+d{>WiD4Q!#
zkuKHyG!Ub7#!cvg<GLgaa0JCtCe_^)D_I!uXOG@5G4=f)1VLb7rPUp)LLsHXW(zBs
zm*)EYX)-B_(WdmlCxDkU5p1kQMtTXvF0u!A1tg?1rp!_Z1kZb^q{LEi;slBZ{-CI4
zas90F^OOx&e?tb2pbL-!&iTo%>!S+DcQ~PbDzJUHuVT?*16GT?l9CvAEw3+Q-6~i?
zBcydFC^rf7g_)i8P!Z`gN^lj7DoH+Brq5!Kw)&x#C6I@KZ4g3syJN?<%RY_s=IM+$
zetv9%%+>`GU_Y?ag4FUe#!Gi2RECF^Ts+hHJwQK6C@g8ViV-l}`RgBV!UH0JV|Kpm
z&K1&==ze`Qewiv46fGvyRe%nZ`aKsLbJ&olP*Qv4=^BL;O7lzTGMLzF@7@8)%Rq2^
z1F?Yckl543S9F5LXk3)~y^7~n(2G06o<57gu9}U8{=1S*_89Szl+e6AvicmB0v|=W
zYa6p$9=e7CL0s+P-)utNB2NhoYL_yT4YzcGq!e;ElwIzxH{XE^fDH4=Yi|J+62T!2
zU2*i7PpKD$7D6aoNN-;O^sFQd7Vq@%@PPVxqacN~rGUqPlPUVQ@1r@55_)ew8J~hM
zB@<)&!se!Yh$C_*VpLR0qqo%H^_elt)6tcskd3~+yeS1WAu%ANFw*+BH`FysN|2m0
z@phh9clKGKN1Bhf%#r0@MyFKi6bc(~zEG?olzkooQz=Ac0c6MmDkZ@jRg)8VCzYF`
z%(tECE(Ykjfcw9G{Li%|5J-mFqI@bxmE~R~NvV=F=49IKL~CaNSJPP(N+3zEU_E`e
zPM;PcudWL$`tO%c7B<l3f&w#)QixzPs7v{|C}vFZ7lksEgIR-bgOAHR!9z*qTTU<5
z9LDnAdwPm=em**na;;dn(8H+$F~OPV4*kaJ<3<X42^$E&ppKg{Ren>xYqBY!0SJ{_
zq$r^kMJVVLWC(F01c|6uHatj!g>j&T4`L+4#}e#4a9{yx*!c2x;D(v8tjAcKjZVTQ
z`6yNEjX70McqooiIqWarxG2WLC5IJe-Z#XF$^GvwLG8P*3q1_Je(RPPH*UmE#e<Fq
zQ3#B{q~am>Gz4b^QtZ$V(gf%S@8n9*0nOVgah+XI3EbS`(;*e;%;fpmaAF5WESPg=
z#|l?u2@7Z)Jk1%i$%`1q`w+Gud!{~AlojH?VbRECYiz;Ppg<T5?{*fvpOw?yJa(w2
zpb5J+H#e8gUA)>VZS@AmBoW-fjQFWN&$Q{{(vI^YguYU_hd4i1^u;C9l=<{Ihq$@q
zqKZ=k_hdSMXu3%(A&ISWHhD$2ICi2w0tL6;SdmcJYVMvobTFL9Y}YOYs=IT(+U;eQ
z*Z+Iw5CsDg;dhS|;;N<Pq`-ubOnhO%574-p{lkIdK7q9F)Rm_%?13Hxy^|UL^zl3r
zbeYi6`6dxbG#I6(0^M=yxKN_k%C0c-x_dc=g|Fh^f6r;;tledSl2ipukYp*G(7&Bm
z_72th$te%(aq2ZnRP|cClNUNup9h&Si(bOlL{Q|S#Fr$f68$P{cA3!sw6OnEnFY;+
z%C{FTXlVa&erB}Xw>jm?XJ|HhkXc+6fsL-_)^x_N7`gl0616aXW-Tps82d8O;9P;l
zEW9MpjG1m4O0K(H!$B96(uEL4_7&vu&AfEBt%e2D-SGU{gA2G*8BKbv!d#u}$;c6C
zMQ|nCUH@H6k!uX%Yq7VoUX3`HO+PZ?8Bg)?o{t+@G4AHjWLhlU7#4%BrLEfBsBY_8
zD-L;>Z1u)jsf^vRp`-I)7%Ry0Vf(GDtrvm`4M&$ZAILvhg4#|5#2X%t1m5AIC-_b=
z?qaUBFHpfcN}PK*_99o>L*iF+A_@G{<7D0;ZXKc`MrN}0%p`vaCqDRNfzxrYn&cAY
zkK`HJ+{H65C9>x33p-7yi?mW1r?vAe^;%j`SQ~(vtYrN|iZEMbbG^FXE_l7H_YNU;
zG{^9$Y<_Duq7p)n6p+^rN648ml{c`^aMecMnYn9umv5&)7Hpx*yj>Q`8#0|?gO5Q%
zBL{Ch3j^n8{(NRaO>N0!yR2Vph4rh21_yp8>0j@ABOjmJ==)Ai)yzaOdy(}XJ*z@y
zi}jAElSxMN2=%)Y|5?W%c4;0wNO6jlLy!fn(WLK4op{)(KV!YOTCUt=H`-%!_Il0O
zm4_MAyP9NXNJGOhwpcoGU+!tJV5JMkEqC7#fKEViS8+0}Ic?cOIQxVrh?LHlezGQ8
z&rVl;6J#Xaw7y+CT!4%tu;+401cKVnnv%83DKKFHSPKb}H12tacH<-x^`R8@IRqqC
zPm>kko*U`VAIm~G>&|C+GxPA8wQI|BZO9rupOm@6E_g3}HXy+M<gA-8@59@$KM@5^
zIV#CWiYw6jp6%qaiJzTiLS5XAvj6+`uapnj`Z2*fJHIcdH$JtcSund<@GgYk_n&9Y
z$&@`qbGIXQr}Y8a#0bjx6U3&kJ*JIikX6p0T$0frg(8Rirv2Xw>QFQx{d{E~^v`10
zFcfxkd+#im7u(Wf?_O^op}u9q>_%`M)l2NNL}!o2C_Rv;$#Ta@sidr0A+FH)0QoPG
z{SutRx)eF-93!x5%&CWd%kgEnP+}ZJrFRIlq4q6lNpoK=%ME88l{fLVGlwc{5G!iz
zh5=k$kqex5F|c1#rb-8r7tCG*wCsK9WT~oZ1WyRN-$ROvpvw5P|MLTFym1!Sc$GH2
zIKt?@elMis92iJb;#=B>wU$g}%gi8hE~58VC5h<1#ZZ)^-2%f|Xt%D&_1Uqm74)1N
z$f1@a^`FJH$|VLiQ0#z3VQeOb=esCXe0LtJ`GRhLB-nGGt-6!Ng6M|xtfpGbYj#o5
zb~4yLsG155d2H&ZY-2^;Gw$&NnI7nRd0`NRx7pk_tgp2@!%FT#yoc!OK9Qikf7?S`
zAmU(uXgW#Q95fh004vGOg!{+SbULvmAZ7!>0<n^7jZH<l?5e54bs+U05e!W$5R*HJ
z8TTtW@ae}YxYx8!f^E1{#hXm>Y#vU%Fx<b;f?2QJ`|f58HWjLJWQu&#DdYX1GDYAx
zlEjMQ;hjX?C3cnU=Ku}QM&5*Ez&#Cop9#Ec+S9XgA5>d*U=BS?6R;{@7bx1wQ<XJq
zG{XFD6PSVgl%VP-E0<MYTy_$IN<m7elsx@dBTkI$MzJY8R9l1}+y5WPr6uqe^}O*q
zW7h;7*CrV#(B*|1kJ<y*6F&x1R3~ulzC6F5>S{GjmxBoSUfipS9UpRI##~T5j|Q_Y
zM&&9`W9V-ZSXSVMnyggFgcq_ymn1NYrZh+IsMXw_oq(ZHWD8=V&aa24b7mhY>rvf>
zOH`KAU9w0f4J1hA5}>kfkXnFY%mRMgEb$^k*8wtl$8^?>Kwz1l{)7!AMAlphbs9G-
zG1T(kuSfF{g&F4qxaQ1Q#l9855s>9r!vsFsGZ8(hTwh&%ierb_RTl$tZwl$n^9SA{
zg;<o6$y7K_qfq?uJL)+K>3xpj#?P!dp`S4S)+ETH7h+i35B&25sH@JH%AKH;4?=~o
z4Qp{PJ2!W^l>ZklF!rU(!WST0EH6QM(I2udvILtt8!`rXQ2@d|64uDP7xBk{!>EJA
zbP18A>p6yZ^DzP;>YTE1c6MHm6FYEd^@b&CSu8S;swv3nm+gkV&Riyg#wiT`@bvEj
zsshwLX)z}F-d3DDI1&0p21d7=C?Bls0}L_ldwq#UQXJGb^eBB<EdOY+i3}VjAlvi(
z+jsA5;uu$#MLOoOo}uugEfv_e8VmNTOF=+tIGQ6v3G|ts96qm_$^PYrND@yB52Uzb
zUey6STMMBuDWpt6;@i4}itNv?m%Qux^%a<fUm@fy%?-<&LR7g($Mh-(oDcLGs2CPN
zj#%0Gj7!*n;`be=3t~2(S0_b*$|11(W1#ve9n`6(&|0B(z%JMaGa|<e^eFN|zaD^H
zs)N#F1zzfR5D2sIaIdAF<8B&@&29yUp^rL20~WbGWU4C!6$-9eff~f24wOwv2|REu
zQPt<=iBPRk(n^)gW>-ml=!_N8o5A-W_mpU+^B!u*L?)-Ckkc?THI7e!tDq2<(M;!X
zdB4Fxg^|@_4vJgBzX%fs0WE7PK`cpNm!>P2O>**tj56p5CI+li9Hah+kdt>*HGjxY
z$oq-~Q0JJ+g)$Ied#hlo<nDCwW#0%nT<aXKP0Hj$8E<D^_ss6dCs$Fl#A9w@A&L_l
zw;1&%czt5#W9M1kq*^%xvss)kRfOBvyKmpDFpiAo@??{R3g2SO2OhNe8*wrZlQSRW
zWXSCBybFwQ^deZPW=Z^dCf;O2mQEO0AsjB#P`Ky~q+<I%$6$E*&CSh(Hkzep3Gw~{
zZh>X&nrBLtl3TU^onatA2F(ZR#MxP>w&q%;ZqxYM5DdKuKNr#x6fH$6M_(MI>b*O3
zc;N|QrafH4jCTMqX&HT;F(m@~Bvrav0hf(>4{#QS)T3Lb8Fv<;|F{@QO6@qqwF+Hq
zZX*YiJ{Gx#GdezYof6Vh+_!&!tOL}^q-;3ZdbIau@U`8$F}n-<9*p<Lto?k<oUBg<
zcF5yL^L1BZDxdHl$dhX!^FZth#@RRpE&Zu$$l$4RCtb8}Sh}45JlTI_o1NXvD;-eG
zo~WE2o~HiSp9C-({$IlQh(*+mW=xM}fR>MB)EiqO=G7ZkPW`*(*~R8$IuoL(A!N!2
zMj2Jez3>aprNsT8P2+q2#B8xz5OlNjYQ1Dnoh{mHsE&H5@7MXV;eUTa3_jzY@IGrK
z0w2F1z;dvtq>lKv5G9AywFfUUlvmg63{(5tdH&$h90f$R9#D%H&gVUmpXrC_-A{hI
zK!ZZ068_hG*DeXdCjXyjigrJa_Qzo+GSOp4ag1q(4kUvY#o(_)qdIaoWPGi&I37Ln
zY}H+&hQ=}@v>gA0ops;}bQ7xNG+jT~P>jy_-67EwQ&R0Oh5D7uOJ^y}8C85+!Bp|=
zL;8F{m7lzyt&*z5itRye5{=UikC)CBHYf@g6F%)B1tG-F!rdqEj{5b48lE+K0WG}v
z@;B~}Nc2}6sGRh}G9}!b`lCCoN{-a&*#I0B>Z^~9HiY!MDIxmZgcM<>1c2UbxV_i#
zivN$?_jC5&rcf3alkWmtZHMBISXmm;VGTlYwDG^LNuXR2O|;T5AVwf0vJ;V)EllUE
zw#=M6+2^JkbN6%bE?AIDJOEbnJ9cv+d2tE!Cy9}1=+lJ-O7@Zs>;J?uj3x3Fo%0gr
zg6M5`(;ZJEgRzJG`49lbEo`6?4QBKs?BNfNXx^Cl^&kc|0k!G^YUUw*1>)7)!C@{y
zFF(%o68dF+JQ*vhK_LzoM-Z*im2amq(6brhYR0g}Wx#sjoL2`))}Ro%M`T^We=kXo
zJ~WLaa2v(Rg&yRf+WwC!WF7;N*Z$`~$eKDz-yiKfKlsdHig>bb`Q(U@eZY57y+#>Z
zyDOLBK_ghrv5!MWQ$l7cGH9U1;Ur;qgBCX7mJMH*zHarZTU@y3#Uiv`g~CP$rZ;!S
zU>xU@`5A8YiN}9_(Vo3vWz@{t`hEYQQY(-~j^hz^b-<vE3H8{A%IWdSI-DsXj;mJS
znES*ha`<MtrF^*i+S5m$IvUzk@6q-3cT}0NHd43m_*TRUIhrSS{o*^Dcu$Xbsa2Dg
zZrJ_Edh=sNc&XX8r}JF{q6?$%TuBx%&e}9bjBBGBZSFmNnv4vKMoXhS`KDs3lJ;?Y
zVq2Ddsj0rAYTAI?%{+WHfWM*bd7oR`<b#%<engdB^**4&zGCdh4O2%d-$|Ng`pby6
zzgVWCbOro)qOaxdR;;7C9<bk#C~G@V;j??;LR{1(3JRMvH8rVR^X5E!5FQ1Qa3=P=
ziV#*vFpr=!qf?SHv_p=xAyIap&M?$l*Rrz0a2kOU{{7$4JBPmN16|U2%jVul2S7Hv
z<Ne(PNm>j8H)#Dp$<bDqTT&#vi4%nqS|0R%f>adA-8?@Qo#-{n+(qT)N|W1qJky_9
z47q0STPp|G5a`cJcfd}h3FZ{+{w?Gr&a1~L6*GP9;;m3-w`<pVlE}Y(|9)oJmw%5>
z+LRv3f?B{33hYcP@spqd?mnxpZ+v*1j~{3t^9KA&H&VEShOQ+LTmw{QB%w;#Qx2~1
z(^n9fM}OXVPvf?$9vC)f3Qo+v;_-A~SeRO7=;4t&HPNLjOuBsJ$;+4TP&%b?r#vrO
zX+jOJHKvwr0@G<9JnA~6WX25bF98lnK6_S(s>r{D-tEqDT*__tqU#T_Y115DS?=!K
z<CUX-x_U7y5n)@LN7)4pnRkb;!qVJP=OV)PM)NHhIyWH|);n<bymDiY%2Q)%_+z}N
z8IoKp92%XOy{$g?Y@tF;dDGUmMZ8<t(oNrOXkn%T4)tz>%t!`=Nod=4d;6Eso4ZBY
zEH)S^7cR1Mg<$U}P6o|P$X!oR9T3>)@^de)=8}=W*zJKuv?+F{j|*X_*ZjLK94SUI
zB^>F|r<0twr6Rz#N0H#BKI4N~nCx${+_2#!(r0q!!FP6>_69c?A1Rf3-?Js-5R6v(
zMGi;${`#Uv3R`xk5^26e_x6C@h96^M5kk#iJ^!HN8$2*yp5DE^#8Xu$Y|E4SdNU^{
z8DgXnWn*JUN%|}mAE|ukp^#IHx*kJ5?`6cxop<&oqlRWGh~@j5T~=n(pfjF#-(Jb-
z%YDo-Z3DBBE`97*7>+Ad(#gt|=H}(S0jR8h+zmEC_O|EwAYQ#^FJ8RGSu8O!M4DB(
z-_IsQ>{LO{LHC0P-6~m;Ce$T#8ab8=$MF2mY|=~%!e^U*$K3F$wI);_rr^qFMe_90
zYrlVcui9A<8Z--*b_*qi<82|+L8RFWoqtAYTwRCzKCH&Uv`xr#i1md&a6w*RbN9ev
zJyug?7yD2d7g=G&9B}fe3Vz-D2Ez(U^lUkbvu4F`R@I>s!Md{Ci&xN1^J?!&>IU21
z-t(df)mw68B2($v^XKr~3-s6;84Yzkrrl;7$IEMv*`dr0>Gn+=qou<+upHc4N}%Js
z4%8;Rf$F@4sx@~1VUOvEO3Jg#A8)&<a+5{#;G-UVFnYz?$A^E3{_2ej7C(-#PXFpx
zzUE-t`U@If;bhY@<6NzeLO&`mgwx4FVVT&5`-b{HLdPsm&IGZqvly8GKVEx<v5Vz9
z*;U`Ydm!*>!jW%cER3cL)^|8h-bo5__o-@R;EaAR)R~rcc8i@D?V23Q$kxQ2Wxlyf
zd)fjAWD{sr#?%jPjW~?9bnh2kaSr8y<<hpJy{n+_Hi~%2CG%@;ESoKdA>ho=b_Ph3
zL&0ZVmoHgz-26O~^6W71Xv`=ChdAH7@}8|?HMp0m6Bn$f)~Ko`DQhs$H1iGgf`5_2
zt8jB+X--*J9K8ehc-Z=^q4-P}={Y$$Y}5=aHf@^iMCq!k+53fwA`BzG?h-i<=dCrW
z^g88`mN2;H6x4otaiVEYAdeXOEf@h*zXRv_1^6zUp%pX;>QhCcFf-d2p)p@PEf~h&
z5zRMkiXp26ojrFC4|f<vCNzlG4Q0n3kbdnVmJC`fo3hw!`}S;zyS6XelFo?L3FVpP
zd&aXRqS5HtSA495<W;}#Q_%VTZRX~e$bFIX7BlBiXg>HPgiV2C7?>G0`658KJ+$aY
zA@jQ9)*w|)bH0Bg_Efvwj|Y!``jHg`<*{TAR`Bl}j16GR1Hdgpk3$jMW2>0b`8@3s
zih5)QSq(7c*MM#RutZ)g6Aop3PBj~z5~ufaA%&=>XmQ@Ag(_-XLyi63DJkvi(7mtF
z(mH2W9pNM%L1CxH>rU;&HxCv)`^TLUl}O8s`PSLF7j;?h@=p<TIh^e?q;)5}d9y>G
zW`1^NCYk`BOv1>!-9O$vm_c5I;<4ZcapO&!l01H^MSanboCk^iIYu=I=<^^HuHk&L
z5HHMC|20$?YHlwj0T<{SqGDoVl3qWtzCb(my62mIl2bj#j)HdcgP?UzAo&@^7p(6s
zhjqxx80^GBV{s1ams0ALjU1XP&Q~1;fXAutE#fS(j#V0&=RcI(1i{f;pSXlny00Rw
zq?<%>Vqz|_8SW>Yeobq{BKO=F0@+{cG{slgUOVhS3C^-jP7PODd3vsLib#dR!JOHc
zB}C+y;WV${N{59D7eWKfKZ~3AHk|IUA<zZFV%n03rOTH2lr0S3V}15?QW8Hi0z_Xg
zK;nBOBK+jr4ME3Se!hdKd1hU{EMns5uY5*>ksvL)q3bn*96yr{jMxi8$I8oVwG%}<
zRFlq{U$k-)J_3O+eI#G>Z|C0<*X?S0+R!NVO74dbJHu(KOFZ|zIJf5L@TVi9G%AhS
zo!iA`QjXdO2S31R*DM_4s_u3b(JZ(Xp#-bJLE~*{X=x&G3|#D!kmYoPz}n{Lr|$GO
z8!#+gQ1A>+deQZ1ntpw$(BWRj(exRUa`Eu=e2Y){+`;MJJ0&GT#!5JAxKxHA5At=5
zOhi;)-+oB!%mGv)$TqFNgHIV~;|#a0V6Irs<;%<E<W4dU>8)P98Yj49qwL=`HD!~a
ziVXVq(F!Uzib*(|&;v)a=ie2nvllPEyu&;+D7NYKj-yAl^!{d}<lnQlax@MV0W2=f
z@vs~t0*T2ghX=OUi${^~`hIjxp_{CQ;IOp4z1`nRSWHAr>?+PF(Ai1_D>s4LXvCTD
zhHoB>2#xLAw|CNc1Z}WwyuH2Ea9HwkPL81QT9r8l=pjxRe5cIn5|NO&foe4Sy{*q&
zr@zW~TW%7@M>^<l;{FynL5A-Rb7rXE+veu$_{Ibq8Q812Yg;qByWRDB<WMIBw%G3M
zyu^^(fxdY0&EjIU$sbmgr=7&9O~=&_v|dAwp&GCVCea;>4f(yZ6JPa7mX#~#IEj~`
zfDRkZ$MLVx$zc7k-OkQy{Q7ok<GUE%TAJf`uYyVPz`WUj5^rv4;ir;TR$^_j1b2#y
z-64E6rS|h~xoQr;Q4YoKRR9`I$$1-OnLA8PV{xY9FHoU=<-~WT<$~H^;kJTpcnv$}
z=b;S>IpK>}iAi(9lvVaT7k`nu`uN6+pRQfLY=}>#SXx@1MOpy>n8gl-Km1s7QyNl;
zqX4j_`iJLZ9iKjb{s#G1>Nq7LazCQgNy&MU{gu<f_*#qsQW0jtfu=Waa_|k5y`VFS
zJkOgejLBbpz5KP>zlwpNt)Sb@_4T>4{*vz@xVpH^B(aDXp%<00Lg<SDPT|VM9)P6i
z78sj-pg7NPbaqOS<LlbcRxQ#v#K6PQpH)D<)?DH#K^z99!i(`2+NN$GsfCw>KIK8Z
zg&hE2n&fJ2S~bsnUZes3Z+^w}6_h&G1({-f&3888a|nsgzB7rp&0Gs2(3B9E&=%QL
zcZaDIB7y$??OVOtX0j7Z#G~Tkl093>Aly>(Y*u?}pafM;6KI@EaHFaB=EJeG<kKKp
zlM4E~E#L2x0UsNZJhLrZPQggN9nv6@g@@asG<;+pA~K^M-3x)nduY;X(j)C1t<R!<
za<y`La^ScB`k9Rqkv%fvPo{JXZmPk%Ks)Eo9gFfK1D0N1g^;27PK<axuB}}mNK@Ya
z$^h2$9j}0yo;f4(>CmIOWjIl-cA!<`aZQb&nbOC~kV+L572hvaTx6S5sviQCUnRV%
zLF7EySbKS*Ow#iIl{rsRBNG4`^xV@P--{Kzvo0-Id}NRBSJRVWEEa^vmNqu$nwpx_
zAeeztG`dNU`<PA!`RWQm3D2eRnGZ^J+@r6JU>5AOp=MvC>_`dw%Y0Vk+g`(u$PdSX
zLzR~J7xGht8KBLxkG`7Wz|5RS39i-xRPMb852m<U2Wd&XRzswajeI2YTCE{J98T{{
zLP93=pL22aYRQJ!#snDyHK-xxLa=0I>ox0=r%Y{$C)P_|Rn;8v^}jj14TJB6%<h}W
zRl)ZFRLH_|A+(W-H-elCGfleS?rsLU0-BY#@K!@ZL$_x=>iYAf#8dOamW3x}A|H7T
zeVKUfUYFM3@IdJ9=Yjc0)oRpU+#U|Rl4&w6wOHfNsOd+3DtD3RE<}x!PV!n>WBa#7
zMMrN3l1N6EYiihYB{j?-+>efre~*K<BGS^gaM3P!^gGsZ_f^^w<Oxlnc4pE6vOHs_
z5p*Y^VSI;EAGAyJ(NRPPbQ+6bf6MCU&!4|XkL~sJv<M6=x7mdgKlbhajy6b*tX;F_
z$-wZlpMIN8<A2|LwHi)2rd`R!Cf+!0Z=<2EZu#oft7r~qo3C#%90WY)vdBkSFf-hQ
zf2x~MiAm#wKR46U({*(B@{;he^0nGwM4g#gykJkcfUu`CHR23iW~_M%*|)}YVc|=G
z0~J=fqffT_*NL+l_qV)*%I^vUWLCiIO9asjLr8Y%(r)rSgZ}aXo&2M7zl0;zxpbs0
zzzC*Cf(gFKhZB)%L1Vs~;hU5x#|-f)7U<Bf!0|=|%qR2mz~jxeZDT!KL#`v~7UmWF
z3aEJ*NY)*$&B6NPY>F&!^q2Ie*RTIUtlizb@0RQwMm03Ldy(ij7rD+Bi{U{k(g+Pq
z+-tZ2K*SB=Ea@(wXYBQx4wd%yw^CS0;V8ZrJ<bsijYD;6@C&i5P@O9k6?P;nfLOel
zv}~&ojf_2i4ffb1@Y{Q64GqLusek;}lka2|ANZsNc@TZ(rhX;i`MMJY8{(xl<BqeD
z__7vK2H~0CE;@^!#3$JD$oDlMmz#skGauikK`Gb@ez^6(+A!!RDBX5Tj7|{&>8$}A
zoK)GI#0nMMjwF+0J+HUwy55l`E-;IH7^7_9!MHEhO96=<E7ZOidCpC{a!WXlvz~uW
z&nHV!gVQ(0gb&8SaK*=Ub;7hpgO$&KQ!k>hdjp~w!I`f8>hRS%4CwPCQg=e;k6h@1
zH}LA{yC={sP$-p~v^BBtWEQG#_IP6kz9v$0pFcCE)K)PF9AWeQfZG7kn;A1EeFYo<
zxW4`-=+KkX(@hyHKE%DBt@q5K&)N>3w(=QMgp4Bbq1t9J*N4kMA0GxzR;5dnM!`*a
z;IlJNU%W`J>yQzgx$kGuGsV|vZO!2yJKz)|SfNVAckXyVL5QV}fnvrQA0UJd=%wq(
zudih|x9<xuO^!LU1idDL3F{iNeBHWTkf_7wESq^Ztv2oT1$@azittF@S{EY1b$%jY
zYX<*@^DS3^gSok2K%tuw)6?@nNgCpO&JE<rvX7K$vx1<St^j09K7alO^0EK!>|ZHD
zw1*JA8)UI|E{H_*{{Q;8`f#YTJ^mx@&bE_KHhJ0RVm!3uWh<>DVr3Xvbg>PIsODji
zwQDu(*u9fmt0=jn+=z@JOExbfEXssjB`G&{vbK=7Y^f0AWk1LMz0Tt~kNKVRJHPYt
zeLvstm#F-Jjivpgc5=z&21T40ShYrqe!8ZwCM<?bKsE*@JYS?qg3_5wfWSV|jm>^^
z`_x*pD`9Zwy_;)a`cqL+C!(7tVJfzK2In0m>ggB81fWd3CBwKQ_l3K3ZjSs*Q9iT=
zm@SAPK%_Tvc+^wywllh)c@cC#Fb$DEoJ~4H305J51~KnpuvLK0FqbxGI1J+M)}Tfe
z`1Kw@YS1jmwJyfA{S37ZP}xfUbOgpP#PzT!RGkjwpq%z!B{^J5fNoqkch}6lZu?;6
z5u7?O9z@9x{*bUiq`?-XMGo|41IQ2v-x<9fJ|iO|t{xso#QMr^j*y7KK`UZk9vJT_
zCv;n71?f)v4ICgnJNp_~X&A1;v>_6*9~xe;y8;3a)`81A-?+Hysh55CT~-jB&IyBf
zv|7(*ALKSbhxhU0HO?uztn0KD5mg*a33KU$qZxb|n5iv}78E(?><mzFgf%<ET}Rt8
zSO~F40%6kx@p@6mzvs!}Kj4ikniSp7uHcSLZ+nzI^6Q0aY$4xc#9%%Da7?;nrU`!a
zg{$k25J=(Kw@Z0c8LVP+hTCPq!jfJF<Q|483aWb{tS3rJ1Zrnf!0Qkf+~<WC;nz$U
zJHcD<x)T~28nj_INQM8z)e@9$<VnDtC>x*df{QR*Qwr=E_AW~cxbqR@TgduZW}4(p
zoFD>K#RCH&Oe3RBmX@BX|IYJRCj`J{*~WQcZ^004;$DlPSq?^54@6f(3Nx2KA6!N4
z&UcEc_MvDFB_$<ASFd`yyWfk8Jfzj!V|DJrg+ifF1@!$W@&u0dH7xor=t3HX-U1d1
z^lE(?Wo&16ASo!O_2uZBnV8wPTu4+!B_-|{%O+vA!uI3)J*gs*s5CwzJba&{<BIc{
zN({OuwvgQ;HLH^2uXjXYL3f;(m{^SSjIz<x(c%9l=i6qN8z@6F1t|}w5fq{HOHNi)
zRH&&?IgWlEx=0jBwsM&oOa*268gPKJd`-X|<?m`h1IqF>K}aN<T(%}~kFtCX+uAF2
zB>SWi88d8_*#LQi;o>e4AC4yf{<V;fLAvbdw$(DSX%t2Kkte?=5o=!|Kh#1_Z4drc
z8o*jde*Ivot|{TkHJ!-p7+Me@{`$JZS3`q?)$E5`rrpZmeusRcpYL-``_j*^+n8$&
zZ$FB<angg?nr<kUR;3};D3$o3CEY*~e(G$xyCG@boYOltxp2g=(c-iRbEb7A9^I_&
zmSzR|`20Uw>J)EjuAh38biC9e`BY%h@V1E^P391#3Q~Nr&scqL!J7nDK`R;iX2yo3
za~yyF_;)%?1Vxs%O2;dm$cg;k7B2s8x=mo+Fg4$>mK=7X`NV8|eb<ngI&SI4Zl4&!
zGb;X;ble&=L8qOgZ`hL*WXjk?9;fZsQ*99l=92@>)oWnT_hl6sn&Ua+S?Kejp~v6N
zC#RGOf{+Mg3JEtxKBf1+A3_pSJDE1{<ZJX0pT02GXL0}QF)+?5=6}xWpiS-iLLeN2
zyQ=GtwQF2QV0$7rGnG}=iu}IR$?cb0nw#xn>mzO2r_Uh$q230Ym|+^LzZK4r)Jff>
zpg9{X?p1uBwfS3_lz0E!BbU=?vA=!C%-GoPSgwx$&rb03{<w;#2s*ZZE&1FBdov|7
z9Ze~Vdh2U5VC3_ah{g2u7=w!hEfPdLt>y}(xoJ%9?V!I_y<EoQ@2FmCsc`6?x`LL;
zTTiwXY9QvZJ3_13AZ_#%l1fv<U#$%0b2#!R2O~GWa1p}2d5xdw>nia_!DRWfrvtFU
z#q#3fyX#-9(b7v0PV~3*aWkJEXFV8LjSj*}nJ9D~wvUPHDRXD@@>0Dx9R4uwGi*b&
znioge@I1xLHMC9JYRYficz1A*pyR>CJv$J&!G*w_CFVc+-g^mBg~Ib`^?~rM=)AbG
zUVKi7K%0ce(($e|jc&4^_I`yl73FE<Q{5LkrMj8BE;lFVU^zE4*45^g6z$aR|MKMW
zyu7@{F|Sp(nHe<J|B%7On%*yP`Biq9Oag`}txx)&J^P~vbd?z>&22MsF38VsGBh$;
zs1k1o*GC^l$hUOaw-q@#zefi6xYW#AUqWW%7@38Y;p8Dc8KiDBhbMms#duZi>%Fz{
zq4^NK*(|P<*YHW};abvTXS)GcBDM?&V2C5?+ht<b`G|6!Vk_%VPYPP?Q}0;0zp+M~
z-}|*=N;UJr$E<r}y#4un#bPB-QI(eTvpWV!jPMMXPt9TMt-bU1JHKffLFOLk4M`J#
z#cZZY77tmTDSs<Yrw!{vl&Z-`|I*$$U-}Ew*-N1NyR7K_>a18+blEr=OqE-~<5zMs
z1t!ME?}`gHJ{i6zm_dHd_Z0IBmocayT%O%6Z&-sd)f(f|w)IHsOpS~VkHbCgm%7Ph
z;avv>?zk1xV~<}tx0Oj;GdFRS^9f+77vGbP`^zk(-O{>Hu!~w)X6ABVC7*cVFpKf)
zq33ln&xp1(mlZ!q3Oao@{Z-Q*TZJaxZ1m3)KR37A6fVEE#l0L<BLR94-_6zaN$xwh
aML}Jc;jZ-$_LQP0#rk}&)3x0PfA|yUeQxCd

literal 0
HcmV?d00001

diff --git a/analyzers/IVRE/ivre_analyzer.py b/analyzers/IVRE/ivre_analyzer.py
new file mode 100755
index 000000000..b08bd7d48
--- /dev/null
+++ b/analyzers/IVRE/ivre_analyzer.py
@@ -0,0 +1,367 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+
+# Copyright 2021 Pierre LALET <pierre@droids-corp.org>
+
+
+"""Cortex Analyzer that queries an IVRE instance.
+
+"""
+
+
+from datetime import datetime
+
+
+from cortexutils.analyzer import Analyzer
+from ivre.db import db
+from ivre import utils
+
+
+# TODO: extracted data should depend on the data type!
+
+
+DATABASES = {
+    "data": db.data,
+    "passive": db.passive,
+    "scans": db.nmap,
+}
+
+
+class Processor:
+
+    databases = []
+
+    def __init__(self, analyzer):
+        self.analyzer = analyzer
+        self.data = analyzer.get_data()
+
+    def flt(self, dbase):
+        raise NotImplementedError()
+
+    def run(self):
+        result = {}
+        for dbname in self.databases:
+            if not self.analyzer.get_param("config.use_%s" % dbname, True):
+                continue
+            res = self.get(dbname)
+            if res:
+                result[dbname] = res
+        return result
+
+    def get(self, dbase):
+        # By default, report all IP addresses
+        result = sorted(
+            DATABASES[dbase].distinct("addr", flt=self.flt(dbase)), key=utils.ip2int
+        )
+        self.analyzer._artifacts.update(("ip", addr) for addr in result)
+        return result
+
+    @staticmethod
+    def from_analyzer(analyzer):
+        return {
+            "autonomous-system": ProcessorAsnum,
+            "certificate_hash": ProcessorCert,
+            "domain": ProcessorDomain,
+            "fqdn": ProcessorFqdn,
+            "ip": ProcessorIp,
+            "network": ProcessorNet,
+            "port": ProcessorPort,
+            "user-agent": ProcessorUserAgent,
+        }[analyzer.data_type](analyzer)
+
+
+class ProcessorIp(Processor):
+    """IP addresses processor
+
+    output contains intelligence about the IP address; the format is
+    different from one database to another.
+
+    """
+
+    databases = ["data", "passive", "scans"]
+    keep_addresses = False
+
+    def flt(self, dbase):
+        return DATABASES[dbase].searchhost(self.data)
+
+    def get_scans(self, dbase):
+        if self.keep_addresses:
+            all_results = {}
+        else:
+            result = {}
+        for rec in DATABASES[dbase].get(self.flt(dbase)):
+            if self.keep_addresses:
+                result = all_results.setdefault(rec["addr"], {})
+                self.analyzer._artifacts.add(("ip", rec["addr"]))
+            firstseen = rec.get('starttime', rec.get('endtime'))
+            lastseen = rec.get('endtime', rec.get('starttime'))
+            if firstseen:
+                if "firstseen" in result:
+                    result["firstseen"] = min(result["firstseen"], firstseen)
+                else:
+                    result["firstseen"] = firstseen
+            if lastseen:
+                if "lastseen" in result:
+                    result["lastseen"] = min(result["lastseen"], firstseen)
+                else:
+                    result["lastseen"] = firstseen
+            if rec.get("categories"):
+                result.setdefault("categories", set()).update(
+                    c for c in rec["categories"] if not c.startswith("_")
+                )
+            if rec.get("source"):
+                result.setdefault("source", set()).add(rec["source"])
+            if rec.get("hostnames"):
+                result.setdefault("hostnames", set()).update(
+                    hn["name"] for hn in rec["hostnames"]
+                )
+            for port in rec.get("ports", []):
+                if port.get("state_state") == "open":
+                    result.setdefault("openports", set()).add(
+                        "%(protocol)s/%(port)d" % port
+                    )
+                if port.get("service_name"):
+                    result.setdefault("services", set()).add(port["service_name"])
+                if port.get("service_product"):
+                    result.setdefault("products", set()).add(port["service_product"])
+                for script in port.get("scripts", []):
+                    if script["id"] == "ssl-cert":
+                        for cert in script.get("ssl-cert", []):
+                            result.setdefault("certs", set()).add(
+                                (
+                                    cert["subject_text"],
+                                    cert["issuer_text"],
+                                    cert["md5"],
+                                    cert["sha1"],
+                                    cert["sha256"],
+                                )
+                            )
+        for subr in (all_results.values() if self.keep_addresses else [result]):
+            self.clean_results(subr)
+        if self.keep_addresses:
+            return [{"addr": addr, "data": data} for addr, data in all_results.items()]
+        return result
+
+    def get_passive(self, dbase):
+        if self.keep_addresses:
+            all_results = {}
+        else:
+            result = {}
+        for rec in DATABASES[dbase].get(self.flt(dbase)):
+            if self.keep_addresses:
+                result = all_results.setdefault(rec["addr"], {})
+            firstseen = rec.get('firstseen', rec.get('lastseen'))
+            lastseen = rec.get('lastseen', rec.get('firstseen'))
+            if firstseen:
+                if "firstseen" in result:
+                    result["firstseen"] = min(result["firstseen"], firstseen)
+                else:
+                    result["firstseen"] = firstseen
+            if lastseen:
+                if "lastseen" in result:
+                    result["lastseen"] = min(result["lastseen"], firstseen)
+                else:
+                    result["lastseen"] = firstseen
+            recontype = rec["recontype"]
+            result.setdefault("categories", set()).add(recontype)
+            if rec.get("sensor"):
+                result.setdefault("source", set()).add(rec["sensor"])
+            if recontype == 'DNS_ANSWER':
+                result.setdefault("hostnames", set()).add(rec["value"])
+                self.analyzer._artifacts.add(("fqdn", rec["value"]))
+                continue
+            if recontype == 'OPEN_PORT':
+                port = rec["value"]
+                try:
+                    protocol, port = port.split('/', 1)
+                except ValueError:
+                    protocol = "tcp"
+                port = int(port)
+                result.setdefault("openports", set()).add(
+                    "%s/%d" % (protocol, port)
+                )
+                continue
+            if recontype in {"TCP_SERVER_BANNER", "SSH_SERVER", "HTTP_SERVER_HEADER"}:
+                result.setdefault("openports", set()).add("tcp/%(port)d" % rec)
+                if "infos" not in rec:
+                    continue
+                info = rec["infos"]
+                if info.get("service_name"):
+                    result.setdefault("services", set()).add(info["service_name"])
+                if info.get("service_product"):
+                    result.setdefault("products", set()).add(info["service_product"])
+                continue
+            if recontype == "SSL_SERVER":
+                if recontype != "cert":
+                    # not handled yet
+                    continue
+                if "infos" not in rec:
+                    continue
+                cert = rec["infos"]
+                result.setdefault("certs", set()).add(
+                    (
+                        cert["subject_text"],
+                        cert["issuer_text"],
+                        cert["md5"],
+                        cert["sha1"],
+                        cert["sha256"],
+                    )
+                )
+                self.analyzer._artifacts.add(("certificate_hash", cert["sha1"]))
+                continue
+        for subr in (all_results.values() if self.keep_addresses else [result]):
+            self.clean_results(subr)
+        if self.keep_addresses:
+            return [{"addr": addr, "data": data} for addr, data in all_results.items()]
+        return result
+
+    @staticmethod
+    def clean_results(result):
+        for key, value in result.items():
+            if isinstance(value, datetime):
+                result[key] = str(value)
+            if isinstance(value, set):
+                if key == "ports":
+                    result[key] = sorted(
+                        value,
+                        key=lambda x: [
+                            [str, int][i](y) for i, y in enumerate(x.split("/", 1))
+                        ],
+                    )
+                elif key == "certs":
+                    result[key] = [
+                        dict(
+                            zip(
+                                ["subject", "issuer", "md5", "sha1", "sha256"], cert
+                            )
+                        )
+                        for cert in sorted(value)
+                    ]
+                else:
+                    result[key] = sorted(value)
+
+    def get(self, dbase):
+        if dbase == "data":
+            result = DATABASES[dbase].infos_byip(self.data)
+            if "as_num" in result:
+                self.analyzer._artifacts.add(("autonomous-system", result["as_num"]))
+            return result
+        if dbase == "scans":
+            return self.get_scans(dbase)
+        if dbase == "passive":
+            return self.get_passive(dbase)
+        raise ValueError()
+
+
+class ProcessorNet(ProcessorIp):
+    """Network processor
+
+    data is a network, output is similar to ProcessorIp.
+
+    """
+
+    databases = ["passive", "scans"]
+    keep_addresses = True
+
+    def flt(self, dbase):
+        return DATABASES[dbase].searchnet(self.data)
+
+
+class ProcessorAsnum(ProcessorNet):
+    """AS number processor
+
+    data is an AS number, output is similar to ProcessorIp.
+
+    """
+
+    def flt(self, dbase):
+        return DATABASES[dbase].searchasnum(int(self.data))
+
+
+class ProcessorPort(Processor):
+
+    databases = ["passive", "scans"]
+
+    def flt(self, dbase):
+        if "/" in self.data:
+            proto, port = self.data.split("/", 1)
+            port = int(port)
+        else:
+            proto = "tcp"
+            port = int(self.data)
+        if proto != "udp" and dbase == "passive":
+            return DATABASES[dbase].searchnonexistent()
+        return DATABASES[dbase].searchport(port, protocol=proto)
+
+
+class ProcessorCert(Processor):
+
+    databases = ["passive", "scans"]
+
+    def flt(self, dbase):
+        return DATABASES[dbase].searchcert(
+            **{{32: "md5", 40: "sha1", 64: "sha256"}[len(self.data)]: self.data}
+        )
+
+
+class ProcessorFqdn(Processor):
+
+    databases = ["passive", "scans"]
+
+    def flt(self, dbase):
+        if dbase == "passive":
+            return DATABASES[dbase].searchdns(name=self.data)
+        return DATABASES[dbase].searchhostname(self.data)
+
+    def rev_flt(self, dbase):
+        return DATABASES[dbase].searchdns(name=self.data, reverse=True)
+
+    def get(self, dbase):
+        if dbase == "passive":
+            # specific case: two filters (w/ & w/o reverse=True)
+            result = sorted(
+                DATABASES[dbase].distinct("value", flt=self.rev_flt(dbase)),
+                key=lambda v: v.strip().split(".")[::-1],
+            )
+            self.analyzer._artifacts.update(("fqdn", value) for value in result)
+            return super().get(dbase) + result
+        return super().get(dbase)
+
+
+class ProcessorDomain(ProcessorFqdn):
+    def flt(self, dbase):
+        if dbase == "passive":
+            return DATABASES[dbase].searchdns(name=self.data, subdomains=True)
+        return DATABASES[dbase].searchdomain(self.data)
+
+    def rev_flt(self, dbase):
+        return DATABASES[dbase].searchdns(name=self.data, subdomains=True, reverse=True)
+
+
+class ProcessorUserAgent(Processor):
+
+    databases = ["passive"]
+
+    def flt(self, dbase):
+        return dbase.searchuseragent(self.data)
+
+
+class IVREAnalyzer(Analyzer):
+    def __init__(self):
+        Analyzer.__init__(self)
+        self._artifacts = set()
+
+    @staticmethod
+    def summary(raw):
+        return {"results": sorted(raw) or None}
+
+    def artifacts(self, raw):
+        return [{"type": atype, "value": value}
+                for atype, value in sorted(self._artifacts)]
+
+    def run(self):
+        self.report(Processor.from_analyzer(self).run())
+
+
+if __name__ == "__main__":
+    IVREAnalyzer().run()
diff --git a/analyzers/IVRE/requirements.txt b/analyzers/IVRE/requirements.txt
new file mode 100644
index 000000000..0c29adb96
--- /dev/null
+++ b/analyzers/IVRE/requirements.txt
@@ -0,0 +1,2 @@
+cortexutils
+ivre