Skip to content

Commit

Permalink
#422 Update the report templates and unwrap summary exception which i…
Browse files Browse the repository at this point in the history 
…s handled by cortexutils
  • Loading branch information
@nadouani
nadouani committed Feb 12, 2019
1 parent fdc8e5b commit ee5ac43
Show file tree
Hide file tree
Showing 3 changed files with 54 additions and 56 deletions.
84 changes: 40 additions & 44 deletions analyzers/BackscatterIO/backscatter-io.py
100644 → 100755
View file
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ def __init__(self):
}
kwargs = {'api_key': self.api_key, 'headers': {'X-Integration': 'TheHive'}}
if self.proxies['https'] or self.proxies['http']:
kwargs.update({'proxies': self._proxies})
kwargs.update({'proxies': self.proxies})
self.bs = Backscatter(**kwargs)
self.service = self.get_param('config.service', None, 'Backscatter service is missing')

Expand Down Expand Up @@ -51,54 +51,50 @@ def run(self):

def summary(self, raw):
"""Use the Backscatter.io summary data to create a view."""
try:
taxonomies = list()
level = 'info'
namespace = 'Backscatter.io'
taxonomies = list()
level = 'info'
namespace = 'Backscatter.io'

if self.service == 'observations':
summary = raw.get('results', dict()).get('summary', dict())
if self.service == 'observations':
summary = raw.get('results', dict()).get('summary', dict())
taxonomies = taxonomies + [
self.build_taxonomy(level, namespace, 'Observations', summary.get('observations_count', 0)),
self.build_taxonomy(level, namespace, 'IP Addresses', summary.get('ip_address_count', 0)),
self.build_taxonomy(level, namespace, 'Networks', summary.get('network_count', 0)),
self.build_taxonomy(level, namespace, 'AS', summary.get('autonomous_system_count', 0)),
self.build_taxonomy(level, namespace, 'Ports', summary.get('port_count', 0)),
self.build_taxonomy(level, namespace, 'Protocols', summary.get('protocol_count', 0))
]
elif self.service == 'enrichment':
summary = raw.get('results', dict())
if self.data_type == 'ip':
taxonomies = taxonomies + [
self.build_taxonomy(level, namespace, 'Network', summary.get('network')),
self.build_taxonomy(level, namespace, 'Network Broadcast', summary.get('network_broadcast')),
self.build_taxonomy(level, namespace, 'Network Size', summary.get('network_size')),
self.build_taxonomy(level, namespace, 'Country', summary.get('country_name')),
self.build_taxonomy(level, namespace, 'AS Number', summary.get('as_num')),
self.build_taxonomy(level, namespace, 'AS Name', summary.get('as_name')),
]
elif self.data_type == 'network':
taxonomies = taxonomies + [
self.build_taxonomy(level, namespace, 'Observations', str(summary.get('observations_count', 0))),
self.build_taxonomy(level, namespace, 'IP Addresses', str(summary.get('ip_address_count', 0))),
self.build_taxonomy(level, namespace, 'Networks', str(summary.get('network_count', 0))),
self.build_taxonomy(level, namespace, 'AS', str(summary.get('autonomous_system_count', 0))),
self.build_taxonomy(level, namespace, 'Ports', str(summary.get('port_count', 0))),
self.build_taxonomy(level, namespace, 'Protocols', str(summary.get('protocol_count', 0)))
self.build_taxonomy(level, namespace, 'Network Size', summary.get('network_size'))
]
elif self.service == 'enrichment':
summary = raw.get('results', dict())
if self.data_type == 'ip':
taxonomies = taxonomies + [
self.build_taxonomy(level, namespace, 'Network', summary.get('network')),
self.build_taxonomy(level, namespace, 'Network Broadcast', summary.get('network_broadcast')),
self.build_taxonomy(level, namespace, 'Network Size', summary.get('network_size')),
self.build_taxonomy(level, namespace, 'Country', summary.get('country_name')),
self.build_taxonomy(level, namespace, 'AS Number', summary.get('as_num')),
self.build_taxonomy(level, namespace, 'AS Name', summary.get('as_name')),
]
elif self.data_type == 'network':
taxonomies = taxonomies + [
self.build_taxonomy(level, namespace, 'Network Size', summary.get('network_size'))
]
elif self.data_type == 'autonomous-system':
taxonomies = taxonomies + [
self.build_taxonomy(level, namespace, 'Prefix Count', summary.get('prefix_count')),
self.build_taxonomy(level, namespace, 'AS Number', summary.get('as_num')),
self.build_taxonomy(level, namespace, 'AS Name', summary.get('as_name'))
]
elif self.data_type == 'port':
for result in raw.get('results', list()):
display = "%s (%s)" % (result.get('service'), result.get('protocol'))
taxonomies.append(self.build_taxonomy(level, namespace, 'Service', display))
else:
pass
elif self.data_type == 'autonomous-system':
taxonomies = taxonomies + [
self.build_taxonomy(level, namespace, 'Prefix Count', summary.get('prefix_count')),
self.build_taxonomy(level, namespace, 'AS Number', summary.get('as_num')),
self.build_taxonomy(level, namespace, 'AS Name', summary.get('as_name'))
]
elif self.data_type == 'port':
for result in raw.get('results', list()):
display = "%s (%s)" % (result.get('service'), result.get('protocol'))
taxonomies.append(self.build_taxonomy(level, namespace, 'Service', display))
else:
pass
return {"taxonomies": taxonomies}

except Exception as e:
self.error('Summary failed\n{}'.format(e.message))
else:
pass
return {"taxonomies": taxonomies}


if __name__ == '__main__':
Expand Down
9 changes: 5 additions & 4 deletions thehive-templates/BackscatterIO_Enrichment_1_0/long.html
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3,10 +3,11 @@
Backscatter.io results for <strong>{{artifact.data}}</strong>
</div>
<div class="panel-body">
<div ng-repeat="(k,v) in content.results">
<span><strong>{{k}}:</strong> {{v}}</spam>
</div>
<p ng-if="!content.results">No records found for {{artifact.data}}.</p>
<dl class="dl-horizontal" ng-repeat="(k,v) in content.results">
<dt>{{k}}</dt>
<dd>{{v || '-'}}</dd>
</dl>
<div class="empty-message" ng-if="!content.results">No records found for {{artifact.data}}</div>
</div>
</div>

Expand Down
17 changes: 9 additions & 8 deletions thehive-templates/BackscatterIO_GetObservations_1_0/long.html
View file
Original file line number Diff line number Diff line change
Expand Up @@ -7,31 +7,31 @@
<tbody>
<tr>
<th>Observation Count</th>
<td>{{content.results.summary['observations_count']}}</td>
<td>{{content.results.summary['observations_count'] || 0}}</td>
</tr>
<tr>
<th>IP Address Count</th>
<td>{{content.results.summary['ip_address_count']}}</td>
<td>{{content.results.summary['ip_address_count'] || 0}}</td>
</tr>
<tr>
<th>Network Count</th>
<td>{{content.results.summary['network_count']}}</td>
<td>{{content.results.summary['network_count'] || 0}}</td>
</tr>
<tr>
<th>AS Count</th>
<td>{{content.results.summary['autonomous_system_count']}}</td>
<td>{{content.results.summary['autonomous_system_count'] || 0}}</td>
</tr>
<tr>
<th>Port Count</th>
<td>{{content.results.summary['port_count']}}</td>
<td>{{content.results.summary['port_count'] || 0}}</td>
</tr>
<tr>
<th>Protocol Count</th>
<td>{{content.results.summary['protocol_count']}}</td>
<td>{{content.results.summary['protocol_count'] || 0}}</td>
</tr>
</tbody>
</table>
<table class="table" ng-if="content.results.observations">
<table ng-if="content.results.observations.length > 0" class="table" ng-if="content.results.observations">
<thead>
<th>Observed</th>
<th>Protocol</th>
Expand All @@ -47,7 +47,8 @@
</tr>
</tbody>
</table>
<p ng-if="!content.results.observations">No records found for {{artifact.data}}.</p>
<div class="empty-message"
ng-if="!content.results.observations || content.results.observations.length === 0">No records found for {{artifact.data}}</d>
</div>
</div>

Expand Down

0 comments on commit ee5ac43

Please sign in to comment.