Merge pull request #2 from Nclose-ZA/greynoise_analyzer_v3

Greynoise analyzer v3
TheHive-Project · Dec 8, 2020 · a931f79 · a931f79
2 parents ab032eb + 5cdd640
commit a931f79
Show file tree

Hide file tree

Showing 2 changed files with 40 additions and 18 deletions.
diff --git a/analyzers/GreyNoise/GreyNoise.json b/analyzers/GreyNoise/GreyNoise.json
@@ -7,7 +7,7 @@
     "description": "Determine whether an IP has known scanning activity using GreyNoise.",
     "dataTypeList": ["ip"],
     "baseConfig": "GreyNoise",
-    "command": "GreyNoise/greynoise.py",
+    "command": "GreyNoise/greynoisev3.py",
     "configurationItems": [
       {
         "name": "key",

diff --git a/analyzers/GreyNoise/greynoise.py → analyzers/GreyNoise/greynoisev3.py b/analyzers/GreyNoise/greynoise.py → analyzers/GreyNoise/greynoisev3.py
@@ -33,6 +33,7 @@ def summary(self, raw):
 
         Input
         {
+            "seen": True,
             "actor": "SCANNER1",
             "classification": "benign",
             "tags": ['a', 'b', 'c']
@@ -43,6 +44,7 @@ def summary(self, raw):
 
         Input
         {
+            "seen": True,
             "actor": "SCANNER1",
             "classification": "unknown",
             "tags": ['a', 'b', 'c']
@@ -53,6 +55,7 @@ def summary(self, raw):
 
         Input
         {
+            "seen": True,
             "actor": "SCANNER1",
             "classification": "unknown",
             "tags": ['a', 'b']
@@ -63,13 +66,21 @@ def summary(self, raw):
 
         Input
         {
+            "seen": True,
             "actor": "SCANNER1",
             "classification": "malicious",
             "tags": ['a', 'b', 'c']
         }
         Output
         GreyNoise:tags = 3 (Malicious)
         GreyNoise:classification = malicious (Malicious)
+
+        Input
+        {
+            "seen": "False"
+        }
+        Output
+        GreyNoise:Seen last 60 days = False (Info)
         """
 
 
@@ -82,23 +93,34 @@ def summary(self, raw):
         try:
             taxonomies = []
 
-            tag_count = len(raw.get('tags', []))
-            classification = raw.get('classification', 'unknown')
-            actor = raw.get('actor')
-
-            t1_level = classification_level_map.get(classification)(tag_count)
-            t1_namespace = 'GreyNoise'
-            t1_predicate = 'tags'
-            t1_value = tag_count
-            # print('{}:{} = {} ({})'.format(t1_namespace, t1_predicate, t1_value, t1_level))
-            taxonomies.append(self.build_taxonomy(t1_level, t1_namespace, t1_predicate, t1_value))
-
-            t2_level = classification_level_map.get(classification)(None)
-            t2_namespace = 'GreyNoise'
-            t2_predicate = 'actor' if classification == 'benign' else 'classification'
-            t2_value = actor if classification == 'benign' else classification
-            # print('{}:{} = {} ({})'.format(t2_namespace, t2_predicate, t2_value, t2_level))
-            taxonomies.append(self.build_taxonomy(t2_level, t2_namespace, t2_predicate, t2_value))
+            seen = raw.get('seen', False)
+            if seen:
+                tag_count = len(raw.get('tags', []))
+                classification = raw.get('classification', 'unknown')
+                actor = raw.get('actor')
+
+                t1_level = classification_level_map.get(classification)(tag_count)
+                t1_namespace = 'GreyNoise'
+                t1_predicate = 'tags'
+                t1_value = tag_count
+                # print('{}:{} = {} ({})'.format(t1_namespace, t1_predicate, t1_value, t1_level))
+                taxonomies.append(self.build_taxonomy(t1_level, t1_namespace, t1_predicate, t1_value))
+
+                t2_level = classification_level_map.get(classification)(None)
+                t2_namespace = 'GreyNoise'
+                t2_predicate = 'actor' if classification == 'benign' else 'classification'
+                t2_value = actor if classification == 'benign' else classification
+                # print('{}:{} = {} ({})'.format(t2_namespace, t2_predicate, t2_value, t2_level))
+                taxonomies.append(self.build_taxonomy(t2_level, t2_namespace, t2_predicate, t2_value))
+            else:
+                taxonomies.append(
+                    self.build_taxonomy(
+                        classification_level_map.get('unknown')(None),
+                        'GreyNoise',
+                        'Seen last 60 days',
+                        False
+                    )
+                )
 
             return {"taxonomies": taxonomies}