Add HTTP requests to EmergingThreats_MalwareInfo

TheHive-Project · May 30, 2018 · fc9aa7f · fc9aa7f
1 parent 9bf2fcd
commit fc9aa7f
Show file tree

Hide file tree

Showing 2 changed files with 36 additions and 2 deletions.
diff --git a/analyzers/EmergingThreats/emergingthreats_analyzer.py b/analyzers/EmergingThreats/emergingthreats_analyzer.py
@@ -73,11 +73,11 @@ def run(self):
 
             elif self.data_type == 'hash':
                 url = "https://api.emergingthreats.net/v1/samples/"
-                features = {'', 'connections', 'dns', 'events'}
+                features = {'', 'connections', 'dns', 'http', 'events'}
 
             elif self.data_type == 'file':
                 url = "https://api.emergingthreats.net/v1/samples/"
-                features = {'', 'connections', 'dns', 'events'}
+                features = {'', 'connections', 'dns', 'http', 'events'}
                 hashes = self.get_param('attachment.hashes', None)
                 if hashes is None:
                     filepath = self.get_param('file', None, 'File is missing')

diff --git a/thehive-templates/EmergingThreats_MalwareInfo_1_0/long.html b/thehive-templates/EmergingThreats_MalwareInfo_1_0/long.html
@@ -88,6 +88,40 @@
         </div>
     </div>
 
+    <div class="panel panel-info" ng-if="content.http && content.http != '-' && content.http != 'Error'">
+        <div class="panel-heading">
+            <strong>Http</strong>
+        </div>
+        <div class="panel-body">
+            <table class="table table-hover">
+                <tr>
+                    <th>Source</th>
+                    <th>Date</th>
+                    <th>Domain</th>
+                    <th>Source ip</th>
+                    <th>Destination ip</th>
+                    <th>Source port</th>
+                    <th>Destination port</th>
+                    <th>Method</th>
+                    <th>Url</th>
+                    <th>User agent</th>
+                </tr>
+                <tr ng-repeat="http in content.http track by $index">
+                    <td>{{ http.source }}</td>
+                    <td>{{ http.date }}</td>
+                    <td>{{ http.domain }}</td>
+                    <td>{{ http.source_ip }}</td>
+                    <td>{{ http.destination_ip }}</td>
+                    <td>{{ http.source_port }}</td>
+                    <td>{{ http.destination_port }}</td>
+                    <td>{{ http.method }}</td>
+                    <td>{{ http.url }}</td>
+                    <td>{{ http.user_agent }}</td>
+                </tr>
+            </table>
+        </div>
+    </div>
+
     <div class="panel panel-info" ng-if="content.connections && content.connections != '-' && content.connections != 'Error'">
         <div class="panel-heading">
             <strong>Connections</strong>