HIBP_Query - Option to include Unverified Breaches (#381)

* Add configuration option to include unverified breaches * Add configuration option to include unverified breaches * Update user-agent header
TheHive-Project · Nov 29, 2018 · 3f328ab · 3f328ab
1 parent 60593ec
commit 3f328ab
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 3 deletions.
diff --git a/analyzers/HIBP_Query/HIBP_Query.json b/analyzers/HIBP_Query/HIBP_Query.json
@@ -11,5 +11,15 @@
       "service": "query",
       "url": "https://haveibeenpwned.com/api/v2/breachedaccount/"
     },
-    "command": "HIBP_Query/hibpquery_analyzer.py"
+    "command": "HIBP_Query/hibpquery_analyzer.py",
+    "configurationItems": [
+    {
+      "name": "unverified",
+      "description": "Include unverified breaches",
+      "type": "boolean",
+      "multi": false,
+      "required": true,
+      "defaultValue": true
+    }
+]
 }
diff --git a/analyzers/HIBP_Query/hibpquery_analyzer.py b/analyzers/HIBP_Query/hibpquery_analyzer.py
@@ -14,6 +14,7 @@ def __init__(self):
         self.service = self.getParam(
             'config.service', None, 'Service parameter is missing')
         self.api_url = self.getParam('config.url', None, 'Missing API URL')
+        self.unverified = self.getParam('config.unverified', None, 'Missing Unverified option')
 
     @staticmethod
     def cleanup(return_data):
@@ -35,9 +36,13 @@ def hibp_query(self, data):
         results = dict()
 
         try:
-            hibpurl = self.api_url + data
+	    if self.unverified == True:
+                unverified = '?includeUnverified=true'
+            else:
+                unverified = ''
+	    hibpurl = self.api_url + data + unverified
 	    headers = {
-                'User-Agent': 'curl/7.38.0'
+                'User-Agent': 'HIBP-Cortex-Analyzer'
 	    }
 
             _query = requests.get(hibpurl, headers=headers)