Merge pull request #1000 from pjuhas/develop

CheckPhish analyzer
TheHive-Project · Jul 22, 2022 · 51ab5a3 · 51ab5a3
2 parents 95bda7d + cb8ffcb
commit 51ab5a3
Show file tree

Hide file tree

Showing 8 changed files with 193 additions and 0 deletions.
diff --git a/analyzers/CheckPhish/CheckPhish.json b/analyzers/CheckPhish/CheckPhish.json
@@ -0,0 +1,20 @@
+{
+  "name": "CheckPhish",
+  "version": "1.0",
+  "author": "Peter Juhas",
+  "url": "https://github.com/pjuhas/Cortex-Analyzers",
+  "license": "AGPL-V3",
+  "description": "Check url address via CheckPhis using jobID returned from CheckPhish_Submit",
+  "dataTypeList": ["string"],
+  "baseConfig": "CheckPhish",
+  "configurationItems": [
+    {
+      "name": "key",
+      "description": "Api key for CheckPhish",
+      "type": "string",
+      "multi": false,
+      "required": true
+    }
+  ],
+  "command": "CheckPhish/CheckPhish.py"
+}
diff --git a/analyzers/CheckPhish/CheckPhish.py b/analyzers/CheckPhish/CheckPhish.py
@@ -0,0 +1,74 @@
+#!/usr/bin/env python
+import time
+import requests
+from cortexutils.analyzer import Analyzer
+
+
+class CheckPhish(Analyzer):
+    def __init__(self):
+        Analyzer.__init__(self)
+        self.test_key = self.get_param('config.key', None, 'Missing API key for CheckPhish')
+
+    def summary(self, raw):
+        taxonomies = []
+        level = 'info'
+        namespace = 'CheckPhish'
+        predicate = ':'
+        value = ''
+        if "jobID" in raw:
+            value = "{}".format(raw["jobID"])
+
+        if "disposition" in raw:
+            value = "{}".format(raw["disposition"])
+            if value == "clean":
+                level = "safe"
+
+        taxonomies.append(self.build_taxonomy(level, namespace, predicate, value))
+        return {'taxonomies': taxonomies}
+
+    def run(self):
+        Analyzer.run(self)
+        if self.data_type == 'url':
+            try:
+                input_data = self.get_data()
+                with requests.Session() as s:
+                    headers = {
+                        'Content-Type': 'application/json',
+                    }
+                data = '{ "apiKey": "%s", "urlInfo": { "url": "%s" } }' % (self.test_key, input_data)
+                response_details = s.post('https://developers.checkphish.ai/api/neo/scan', headers=headers,
+                                          data=data)
+                if response_details.status_code == 200:
+                    result = response_details.json()
+                    self.report(result if len(result) > 0 else {})
+                else:
+                    self.error('Failed to query CheckPhish details. Status_code {}'.format(
+                        response_details.status_code))
+            except Exception as e:
+                self.unexpectedError(e)
+
+        elif self.data_type == 'string':
+            try:
+                input_data = self.get_data()
+                headers = {
+                    'Content-Type': 'application/json',
+                }
+                data = '{"apiKey": "%s", "jobID": "%s", "insights": true}' % (self.test_key, input_data)
+                response_details = requests.post('https://developers.checkphish.ai/api/neo/scan/status',
+                                                 headers=headers,
+                                                 data=data)
+                if response_details.status_code == 200:
+                    result = response_details.json()
+                    self.report(result if len(result) > 0 else {})
+                else:
+                    self.error('Failed to query CheckPhish details. Status_code {}'.format(
+                        response_details.status_code))
+
+            except Exception as e:
+                self.unexpectedError(e)
+        else:
+            self.notSupported()
+
+
+if __name__ == '__main__':
+    CheckPhish().run()
diff --git a/analyzers/CheckPhish/CheckPhish_Submit.json b/analyzers/CheckPhish/CheckPhish_Submit.json
@@ -0,0 +1,20 @@
+{
+  "name": "CheckPhish_Submit",
+  "version": "1.0",
+  "author": "Peter Juhas",
+  "url": "https://github.com/pjuhas/Cortex-Analyzers",
+  "license": "AGPL-V3",
+  "description": "Submit url address to CheckPhish",
+  "dataTypeList": ["url"],
+  "baseConfig": "CheckPhish",
+  "configurationItems": [
+    {
+      "name": "key",
+      "description": "Api key for CheckPhish",
+      "type": "string",
+      "multi": false,
+      "required": true
+    }
+  ],
+  "command": "CheckPhish/CheckPhish.py"
+}
diff --git a/analyzers/CheckPhish/requirements.txt b/analyzers/CheckPhish/requirements.txt
@@ -0,0 +1,2 @@
+cortexutils
+requests
diff --git a/thehive-templates/CheckPhish_1_0/long.html b/thehive-templates/CheckPhish_1_0/long.html
@@ -0,0 +1,42 @@
+<div class="panel panel-info" ng-if="::content">
+    <div class="panel-heading">
+        <strong>Summary</strong>
+    </div>
+    <div class="panel-body">
+        <table class="table table-hover">
+            <tr>
+                <th>Description</th>
+                <th>Data</th>
+            </tr>
+            <tr>
+                <td>Status</td>
+                <td>{{content.disposition | ellipsis:130}}</td>
+            </tr>
+            <tr>
+                <td>URL</td>
+                <td>
+                    <span>
+                        <i class="fa fa-search"></i>
+                        <a ng-href={{content.insights}} target="_blank">View Full Report</a>
+                    </span>
+                </td>
+            </tr>
+        </table>
+    </div>
+</div>
+
+<!-- General error  -->
+<div class="panel panel-danger" ng-if="!success">
+    <div class="panel-heading">
+        <strong>{{artifact.data | fang}}</strong>
+    </div>
+    <div class="panel-body">
+        <dl class="dl-horizontal" ng-if="content.errorMessage">
+            <dt>
+                <i class="fa fa-warning"></i> urlscan.io:
+            </dt>
+            <dd class="wrap">{{content.errorMessage}}</dd>
+        </dl>
+    </div>
+</div>
+
diff --git a/thehive-templates/CheckPhish_1_0/short.html b/thehive-templates/CheckPhish_1_0/short.html
@@ -0,0 +1,3 @@
+<span class="label" ng-repeat="t in content.taxonomies" ng-class="{'info': 'label-info', 'safe': 'label-success', 'suspicious': 'label-warning', 'malicious':'label-danger'}[t.level]">
+    {{t.namespace}}:{{t.predicate}}="{{t.value}}"
+</span>
diff --git a/thehive-templates/CheckPhish_Submit_1_0/long.html b/thehive-templates/CheckPhish_Submit_1_0/long.html
@@ -0,0 +1,29 @@
+<div class="panel panel-info" ng-if="::content">
+    <div class="panel-heading">
+        <strong>Summary</strong>
+    </div>
+    <div class="panel-body">
+        <table class="table table-hover">
+            <tr>
+                <th>JobID</th>
+                <td>{{content.jobID | ellipsis:130}}</td>
+            </tr>
+        </table>
+    </div>
+</div>
+
+<!-- General error  -->
+<div class="panel panel-danger" ng-if="!success">
+    <div class="panel-heading">
+        <strong>{{artifact.data | fang}}</strong>
+    </div>
+    <div class="panel-body">
+        <dl class="dl-horizontal" ng-if="content.errorMessage">
+            <dt>
+                <i class="fa fa-warning"></i> urlscan.io:
+            </dt>
+            <dd class="wrap">{{content.errorMessage}}</dd>
+        </dl>
+    </div>
+</div>
+
diff --git a/thehive-templates/CheckPhish_Submit_1_0/short.html b/thehive-templates/CheckPhish_Submit_1_0/short.html
@@ -0,0 +1,3 @@
+<span class="label" ng-repeat="t in content.taxonomies" ng-class="{'info': 'label-info', 'safe': 'label-success', 'suspicious': 'label-warning', 'malicious':'label-danger'}[t.level]">
+    {{t.namespace}}:{{t.predicate}}="{{t.value}}"
+</span>