You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Describe the bug
Crowdstrike endpoint changed,so responder responders/FalconCustomIOC/FalconCustomIOCv2.py isn't working properly.I tested code. Passing the json value not happening. Authorization works fine.
import requests
import re
import json
import traceback
from cortexutils.responder import Responder
from requests.auth import HTTPBasicAuth
from FalconAuth import FalconAuth
def cortexinputbug():
import sys
if len(sys.argv) > 1:
try:
sys.stdin = open(sys.argv[1]+"/input/input.json")
except:
with open("/tmp/responder_error", "w+") as e:
e.write(traceback.format_exc())
class FalconCustomIOC(Responder):
def __init__(self):
Responder.__init__(self)
self.falconapi_url = "https://api.eu-1.crowdstrike.com/iocs/entities/indicators/v1"
self.clientid = self.get_param(
'config.clientid', None, "Crowdstrike API oauth2 client id missing")
self.clientsecret = self.get_param(
'config.clientsecret', None, "Crowdstrike API oauth2 client secret missing")
self.auth = FalconAuth(self.clientid, self.clientsecret)
def run(self):
try:
Responder.run(self)
ioctypes = {"hash": u"sha256", "sha256": u"sha256", "md5": u"md5", "sha1": u"sha1",
"ip": u"ipv4", "ip6": u"ipv6", "ipv6": u"ipv6", "domain": u"domain", "url": u"domain"}
data_type = self.get_param('data.dataType')
if not data_type in ioctypes:
self.error("Unsupported IOC type")
raise
ioc = self.get_param('data.data', None, 'No IOC provided')
if data_type == "url":
match = re.match(
r"(http:\/\/|https:\/\/)?([\w\d\-\.]{0,256}).*", ioc)
if match is None or match.group(2) is None:
self.error("Could not parse domain from URL")
raise
else:
ioc = match.group(2)
description = self.get_param(
'data.case.title', None, "Can't get case title")
description = u"{}".format(description.encode('utf-8')[:128])
postdata = json.dumps([{"type": u"ipv4", "value": u"192.168.1.2", "action": u"no_action", "platforms": u"windows","expiration": u"2022-01-12T12:25:11.823Z"}])
response = requests.post(self.falconapi_url, data=postdata, headers={
"Content-Type": "application/json", "Authorization": "Bearer {}".format(self.auth.getToken())})
json_response = json.loads(response.text)
if json_response["errors"]:
self.error(str(json_response["errors"]))
raise
else:
self.report(
{'message': ioc+" Submitted to Crowdstrike Falcon custom IOC api", "api_response": json_response})
except Exception as ex:
self.error(traceback.format_exc())
def operations(self, raw):
return [self.build_operation('AddTagToArtifact', tag='CrowdStrike:Custom IOC Uploaded')]
f __name__ == '__main__':
cortexinputbug()
FalconCustomIOC().run()
Error:
when value is passed in json says 'code': 400, 'message': 'Provided data does not match expected format'}]
Describe the bug
Crowdstrike endpoint changed,so responder responders/FalconCustomIOC/FalconCustomIOCv2.py isn't working properly.I tested code. Passing the json value not happening. Authorization works fine.
Error:
when value is passed in json says 'code': 400, 'message': 'Provided data does not match expected format'}]
The text was updated successfully, but these errors were encountered: