diff --git a/analyzers/URLhaus/URLhaus.json b/analyzers/URLhaus/URLhaus.json index fbb18578e..c40a336a8 100644 --- a/analyzers/URLhaus/URLhaus.json +++ b/analyzers/URLhaus/URLhaus.json @@ -14,7 +14,7 @@ "type": "number", "multi": false, "required": true, - "defaultValue": 3600 + "defaultValue": 300 }, { "name": "cache.root", diff --git a/analyzers/URLhaus/URLhaus.py b/analyzers/URLhaus/URLhaus.py index 938eb7106..cd8d7771e 100644 --- a/analyzers/URLhaus/URLhaus.py +++ b/analyzers/URLhaus/URLhaus.py @@ -1,5 +1,5 @@ +from bs4 import BeautifulSoup from diskcache import Cache -from requests_html import HTML import requests @@ -16,7 +16,7 @@ class URLhaus: def __init__(self, query, - cache_duration=3600, + cache_duration=300, cache_root="/tmp/cortex/URLhaus"): self.URL = "https://urlhaus.abuse.ch/browse.php" self.query = query @@ -47,15 +47,15 @@ def fetch(self): def parse(self, doc): results = [] - html = HTML(html=doc) - table = html.find("table.table", first=True) - rows = table.find("tr")[1:] + soup = BeautifulSoup(doc, "html.parser") + table = soup.find("table", class_="table") + rows = table.find_all("tr")[1:] for row in rows: - cols = row.find("td") + cols = row.find_all("td") results.append({ "dateadded": cols[0].text, "malware_url": cols[1].text, - "link": cols[1].find("a", first=True).attrs.get("href"), + "link": cols[1].find("a").attrs.get("href"), "status": cols[2].text, "tags": cols[3].text.split(), "gsb": cols[4].text, diff --git a/analyzers/URLhaus/requirements.txt b/analyzers/URLhaus/requirements.txt index cb7532131..442450a28 100644 --- a/analyzers/URLhaus/requirements.txt +++ b/analyzers/URLhaus/requirements.txt @@ -1,4 +1,4 @@ +beautifulsoup4 cortexutils diskcache requests -requests-html diff --git a/thehive-templates/URLhaus_0_1_0/long.html b/thehive-templates/URLhaus_0_1_0/long.html new file mode 100644 index 000000000..d8fa06a14 --- /dev/null +++ b/thehive-templates/URLhaus_0_1_0/long.html @@ -0,0 +1,51 @@ +
+ No result found. +
+Dateadded (UTC) | +Malware URL | +Status | +Tags | +GSB | +Reporter | + + +
---|---|---|---|---|---|
{{r.dateadded}} | ++ + {{r.malware_url}} + + | +{{r.status}} | ++ {{tag}} + | +{{r.gsb}} | +{{r.reporter}} | +