Simple analyzer for GRR (#568)

* #565 JoeSandbox: accept TAC

* Simple analyzer for GRR

Simple analyzer for GRR that checks and map the GRR client_id of an IP / FQDN

Co-authored-by: To-om <[email protected]>

analyzers/GRR/GRR.json

@@ -0,0 +1,37 @@
+{
+    "name": "GRR",
+    "version": "0.1",
+    "author": "[email protected], SUNET",
+    "url": "https://github.com/TheHive-Project/Cortex-Analyzers",
+    "license": "AGPL-V3",
+    "description": "Search GRR for the host agent.",
+    "dataTypeList": ["ip", "fqdn"],
+    "baseConfig": "GRR",
+    "config": {
+       "service": "query"
+    },
+    "command": "GRR/grrclient.py",
+    "configurationItems": [
+      {
+        "name": "url",
+        "description": "URL of the GRR API.",
+        "type": "string",
+        "required": true,
+        "multi": false
+      },
+      {
+        "name": "username",
+        "description": "API user to use",
+        "type": "string",
+        "required": true,
+        "multi": false
+      },
+      {
+        "name": "password",
+        "description": "API password to the API user",
+        "type": "string",
+        "required": true,
+        "multi": false
+      }
+    ]
+}

analyzers/GRR/grrclient.py

@@ -0,0 +1,39 @@
+#!/usr/bin/env python3
+# encoding: utf-8
+
+from cortexutils.analyzer import Analyzer
+from grr_api_client import api
+
+
+class GRRAnalyzer(Analyzer):
+    def __init__(self):
+        Analyzer.__init__(self)
+        self.grr_url = self.get_param('config.url', None, 'Missing GRR API endpoint')
+        self.grr_user = self.get_param('config.username', None, 'Missing GRR username')
+        self.grr_passwd = self.get_param('config.password', None, 'Missing GRR password')
+        self.proxies = self.get_param('config.proxy', None)
+        self.grrapi = api.InitHttp(api_endpoint=self.grr_url, auth=(self.grr_user, self.grr_passwd))
+
+    def summary(self, raw):
+        taxonomies = []
+        level = 'info'
+        namespace = 'GRR'
+        predicate = 'Client id'
+
+        for client_id in raw['results']:
+            taxonomies.append(self.build_taxonomy(level, namespace, predicate, client_id))
+
+        return {"taxonomies": taxonomies}
+
+    def run(self):
+        if self.data_type == 'ip' or self.data_type == 'fqdn':
+            search_result = self.grrapi.SearchClients(self.get_data())
+            result = []
+            for client in search_result:
+                result.append(client.client_id)
+            self.report({'results': result})
+        else:
+            self.error('Invalid data type')
+
+if __name__ == '__main__':
+    GRRAnalyzer().run()

analyzers/GRR/requirements.txt

@@ -0,0 +1,2 @@
+cortexutils
+grr-api-client