diff --git a/analyzers/CyberCrime-Tracker/README.md b/analyzers/CyberCrime-Tracker/README.md index 5fbce2195..094c2f54b 100644 --- a/analyzers/CyberCrime-Tracker/README.md +++ b/analyzers/CyberCrime-Tracker/README.md @@ -1,4 +1,5 @@ -### cyberprotect -[cyberprotect](https://threatscore.cyberprotect.cloud/) collect more than 500 millions of network events per day and value those data by analyzed them with analysis engines (behavioral analysis, sandboxes, threat feeds, etc.). +### cybercrime-tracker +[cybercrime-tracker](https://cybercrime-tracker.net/) site is dedicated to tracking the C&C servers of botnets. This site is used as a source for many IP and domain blacklists. + #### Requirements No configuration is required. \ No newline at end of file diff --git a/analyzers/Cyberprotect/CyberprotectAnalyzer.py b/analyzers/Cyberprotect/CyberprotectAnalyzer.py index 8e819114b..4bbfaa36f 100755 --- a/analyzers/Cyberprotect/CyberprotectAnalyzer.py +++ b/analyzers/Cyberprotect/CyberprotectAnalyzer.py @@ -6,7 +6,7 @@ class CyberprotectAnalyzer(Analyzer): - URI = "https://threatscore.cyberprotect.fr/api/score/" + URL = "https://api.threatscore.cyberprotect.cloud/api/v3/observables/search/by-value" def __init__(self): Analyzer.__init__(self) @@ -18,25 +18,21 @@ def summary(self, raw): if self.service == 'ThreatScore': level = 'info' value = 'not in database' - if raw.get('data') and raw.get('scores') and len(raw.get('scores')) > 0: + if 'threatscore' in raw: value = 'not analyzed yet' - if raw['scores'][0].get('score'): - level = 'safe' - value = raw['scores'][0]['score'] - if value >= 0.5: - level = 'malicious' - elif value >= 0.25 and value < 0.5: - level = 'suspicious' + if 'value' in raw['threatscore'] and 'level' in raw['threatscore']: + value = raw['threatscore']['value'] + level = raw['threatscore']['level'] taxonomies.append(self.build_taxonomy(level, namespace, self.service, value)) return {"taxonomies": taxonomies} def run(self): Analyzer.run(self) - if self.service == 'ThreatScore' and (self.data_type == 'domain' or self.data_type == 'ip'): + if self.service == 'ThreatScore' and (self.data_type == 'domain' or self.data_type == 'hash' or self.data_type == 'ip' or self.data_type == 'url' or self.data_type == 'user-agent'): try: - response = requests.get("{}{}".format(self.URI, self.get_data())) + response = requests.post(self.URL, json = { 'data' : self.get_data() }) result = response.json() - self.report(result if len(result) > 0 else {}) + self.report(result) except Exception as e: self.unexpectedError(e) else: diff --git a/analyzers/Cyberprotect/Cyberprotect_ThreatScore.json b/analyzers/Cyberprotect/Cyberprotect_ThreatScore.json index 14fa3d29f..70aa0221b 100755 --- a/analyzers/Cyberprotect/Cyberprotect_ThreatScore.json +++ b/analyzers/Cyberprotect/Cyberprotect_ThreatScore.json @@ -3,9 +3,9 @@ "author": "Rémi Allain, Cyberprotect", "license": "AGPL-V3", "url": "https://github.com/Cyberprotect/Cortex-Analyzers", - "version": "1.0", + "version": "3.0", "description": "ThreatScore is a cyber threat scoring system provided by Cyberprotect", - "dataTypeList": ["domain", "ip"], + "dataTypeList": ["domain", "hash", "ip", "url", "user-agent"], "command": "Cyberprotect/CyberprotectAnalyzer.py", "baseConfig": "Cyberprotect", "config": { @@ -15,7 +15,7 @@ "registration_required": false, "subscription_required": false, "free_subscription": false, - "service_homepage": "https://threatscore.cyberprotect.cloud/", + "service_homepage": "https://console.threatscore.cyberprotect.cloud/", "service_logo": { "path": "assets/threatscore.jpg", "caption": "logo" diff --git a/analyzers/Cyberprotect/README.md b/analyzers/Cyberprotect/README.md index 094c2f54b..3cf592e11 100644 --- a/analyzers/Cyberprotect/README.md +++ b/analyzers/Cyberprotect/README.md @@ -1,5 +1,4 @@ -### cybercrime-tracker -[cybercrime-tracker](https://cybercrime-tracker.net/) site is dedicated to tracking the C&C servers of botnets. This site is used as a source for many IP and domain blacklists. - +### cyberprotect +[cyberprotect](https://console.threatscore.cyberprotect.cloud/) collect more than 500 millions of network events per day and value those data by analyzed them with analysis engines (behavioral analysis, sandboxes, threat feeds, etc.). #### Requirements No configuration is required. \ No newline at end of file diff --git a/analyzers/Cyberprotect/assets/long_report.png b/analyzers/Cyberprotect/assets/long_report.png index d3b7a6a2a..438016336 100644 Binary files a/analyzers/Cyberprotect/assets/long_report.png and b/analyzers/Cyberprotect/assets/long_report.png differ diff --git a/thehive-templates/Cyberprotect_ThreatScore_1_0/long.html b/thehive-templates/Cyberprotect_ThreatScore_1_0/long.html deleted file mode 100755 index ceab3b796..000000000 --- a/thehive-templates/Cyberprotect_ThreatScore_1_0/long.html +++ /dev/null @@ -1,31 +0,0 @@ -
-
- Cyberprotect threat scoring system -
Report for - {{artifact.data}} -
-
-

{{content.scores.length}} scores found.

- - - - - - - - - -
DateScore
{{score.date}}{{score.score}}
-
-
- No results found -
-
-
-
- {{(artifact.data || artifact.attachment.name) | fang}} -
-
- {{content.errorMessage}} -
-
diff --git a/thehive-templates/Cyberprotect_ThreatScore_3_0/long.html b/thehive-templates/Cyberprotect_ThreatScore_3_0/long.html new file mode 100644 index 000000000..56e42016d --- /dev/null +++ b/thehive-templates/Cyberprotect_ThreatScore_3_0/long.html @@ -0,0 +1,119 @@ + +
+
+ Error while running the service +
+
+ 
{{content.errorMessage}}
+
+
+ + +
+
+ Cyberprotect Threatscore +
+ Report for {{artifact.data | fang}} +
+
+

{{content.error.message}}

+
+
+

+ + Categories:  + + + {{category.replace("_"," ") | uppercase}} +   + +
+ + Indicators:  + + + Blocklist + + + Blocklist + +   + + + Attack + + + Attack + +   + + + Scan + + + Scan + +   + + + Compromission + + + Compromission + + +
+ + Location:  + {{content.observable.geo.city_name}}, + {{content.observable.geo.country_name}} +
+ + + AS: {{content.observable.as.asn}} +  ({{content.observable.as.organization_name}}) +
+ + + First seen: {{content.observable.first_seen | date: 'medium'}} +
+ Last seen: {{content.observable.last_seen | date: 'medium'}} + +

+
+
+ + +
+
+ Analysis +
+
+

+ Threat score of {{content.threatscore.value * 100 | number:1.0-0}}% +

+
+ + + + + + + + + + + + + + +
IDDateThreat Level
{{a.id}}{{a.date | date : 'medium'}}Info + Safe + Suspicious + Malicious +
+
+
+

Not analyzed yet

+
+
diff --git a/thehive-templates/Cyberprotect_ThreatScore_1_0/short.html b/thehive-templates/Cyberprotect_ThreatScore_3_0/short.html old mode 100755 new mode 100644 similarity index 100% rename from thehive-templates/Cyberprotect_ThreatScore_1_0/short.html rename to thehive-templates/Cyberprotect_ThreatScore_3_0/short.html