Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

New analyzers and templates for RiskIQ Illuminate #1013

Merged
merged 8 commits into from
Jun 20, 2022
+2,992 −0
Merged

New analyzers and templates for RiskIQ Illuminate #1013

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
87f5a9f
New RiskIQ Illuminate analyzers.
aeetos May 26, 2021
1ce1dd9
Analyzer transformations for UI hints. New RiskIQ responders to push …
aeetos May 31, 2021
c6fcde6
New templates for RiskIQ Analyzers (Reputation and Summary)
aeetos May 31, 2021
0e1d84b
Report templates for RiskIQ Illuminate analyzers.
aeetos Jun 21, 2021
422b493
Handle 404 responses from the API more gracefully.
aeetos Jun 22, 2021
679b94e
Subdomains analyzer and report template.
aeetos Jun 29, 2021
ffc2cc3
Set context headers for metrics and troubleshooting.
aeetos Jul 15, 2021
d82110f
Set responder context headers.
aeetos Jul 15, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 43 additions & 0 deletions analyzers/RiskIQ/RiskIQ_Articles.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,43 @@
{
"author": "RiskIQ",
"baseConfig": "RiskIQ",
"command": "RiskIQ/_analyzer.py",
"config": {
"auto_extract": true,
"property": "articles"
},
"configurationItems": [
{
"description": "API username of the RiskIQ Illuminate or PassiveTotal account (usually an email address)",
"multi": false,
"name": "username",
"required": true,
"type": "string"
},
{
"description": "API key of the RiskIQ Illuminate or PassiveTotal account",
"multi": false,
"name": "api_key",
"required": true,
"type": "string"
},
{
"defaultValue": 180,
"description": "Number of days back to search for date-bounded historical queries",
"multi": false,
"name": "days_back",
"required": false,
"type": "number"
}
],
"dataTypeList": [
"domain",
"fqdn",
"ip"
],
"description": "RiskIQ: OSINT articles that reference an indicator.",
"license": "AGPL-V3",
"name": "RiskIQ_Articles",
"url": "https://github.com/TheHive-Project/Cortex-Analyzers",
"version": "1.0"
}
43 changes: 43 additions & 0 deletions analyzers/RiskIQ/RiskIQ_Artifacts.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,43 @@
{
"author": "RiskIQ",
"baseConfig": "RiskIQ",
"command": "RiskIQ/_analyzer.py",
"config": {
"auto_extract": true,
"property": "artifacts"
},
"configurationItems": [
{
"description": "API username of the RiskIQ Illuminate or PassiveTotal account (usually an email address)",
"multi": false,
"name": "username",
"required": true,
"type": "string"
},
{
"description": "API key of the RiskIQ Illuminate or PassiveTotal account",
"multi": false,
"name": "api_key",
"required": true,
"type": "string"
},
{
"defaultValue": 180,
"description": "Number of days back to search for date-bounded historical queries",
"multi": false,
"name": "days_back",
"required": false,
"type": "number"
}
],
"dataTypeList": [
"domain",
"fqdn",
"ip"
],
"description": "RiskIQ: Illuminate / PassiveTotal project artifacts that match an indicator.",
"license": "AGPL-V3",
"name": "RiskIQ_Artifacts",
"url": "https://github.com/TheHive-Project/Cortex-Analyzers",
"version": "1.0"
}
43 changes: 43 additions & 0 deletions analyzers/RiskIQ/RiskIQ_Certificates.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,43 @@
{
"author": "RiskIQ",
"baseConfig": "RiskIQ",
"command": "RiskIQ/_analyzer.py",
"config": {
"auto_extract": true,
"property": "certificates"
},
"configurationItems": [
{
"description": "API username of the RiskIQ Illuminate or PassiveTotal account (usually an email address)",
"multi": false,
"name": "username",
"required": true,
"type": "string"
},
{
"description": "API key of the RiskIQ Illuminate or PassiveTotal account",
"multi": false,
"name": "api_key",
"required": true,
"type": "string"
},
{
"defaultValue": 180,
"description": "Number of days back to search for date-bounded historical queries",
"multi": false,
"name": "days_back",
"required": false,
"type": "number"
}
],
"dataTypeList": [
"domain",
"fqdn",
"ip"
],
"description": "RiskIQ: SSL/TLS certificates associated with an indicator.",
"license": "AGPL-V3",
"name": "RiskIQ_Certificates",
"url": "https://github.com/TheHive-Project/Cortex-Analyzers",
"version": "1.0"
}
43 changes: 43 additions & 0 deletions analyzers/RiskIQ/RiskIQ_Components.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,43 @@
{
"author": "RiskIQ",
"baseConfig": "RiskIQ",
"command": "RiskIQ/_analyzer.py",
"config": {
"auto_extract": true,
"property": "components"
},
"configurationItems": [
{
"description": "API username of the RiskIQ Illuminate or PassiveTotal account (usually an email address)",
"multi": false,
"name": "username",
"required": true,
"type": "string"
},
{
"description": "API key of the RiskIQ Illuminate or PassiveTotal account",
"multi": false,
"name": "api_key",
"required": true,
"type": "string"
},
{
"defaultValue": 180,
"description": "Number of days back to search for date-bounded historical queries",
"multi": false,
"name": "days_back",
"required": false,
"type": "number"
}
],
"dataTypeList": [
"domain",
"fqdn",
"ip"
],
"description": "RiskIQ: web components observed during crawls on a hostname.",
"license": "AGPL-V3",
"name": "RiskIQ_Components",
"url": "https://github.com/TheHive-Project/Cortex-Analyzers",
"version": "1.0"
}
43 changes: 43 additions & 0 deletions analyzers/RiskIQ/RiskIQ_Cookies.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,43 @@
{
"author": "RiskIQ",
"baseConfig": "RiskIQ",
"command": "RiskIQ/_analyzer.py",
"config": {
"auto_extract": true,
"property": "cookies"
},
"configurationItems": [
{
"description": "API username of the RiskIQ Illuminate or PassiveTotal account (usually an email address)",
"multi": false,
"name": "username",
"required": true,
"type": "string"
},
{
"description": "API key of the RiskIQ Illuminate or PassiveTotal account",
"multi": false,
"name": "api_key",
"required": true,
"type": "string"
},
{
"defaultValue": 180,
"description": "Number of days back to search for date-bounded historical queries",
"multi": false,
"name": "days_back",
"required": false,
"type": "number"
}
],
"dataTypeList": [
"domain",
"fqdn",
"ip"
],
"description": "RiskIQ: cookies observed during crawls on a hostname.",
"license": "AGPL-V3",
"name": "RiskIQ_Cookies",
"url": "https://github.com/TheHive-Project/Cortex-Analyzers",
"version": "1.0"
}
43 changes: 43 additions & 0 deletions analyzers/RiskIQ/RiskIQ_HostpairChildren.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,43 @@
{
"author": "RiskIQ",
"baseConfig": "RiskIQ",
"command": "RiskIQ/_analyzer.py",
"config": {
"auto_extract": true,
"property": "hostpair_children"
},
"configurationItems": [
{
"description": "API username of the RiskIQ Illuminate or PassiveTotal account (usually an email address)",
"multi": false,
"name": "username",
"required": true,
"type": "string"
},
{
"description": "API key of the RiskIQ Illuminate or PassiveTotal account",
"multi": false,
"name": "api_key",
"required": true,
"type": "string"
},
{
"defaultValue": 180,
"description": "Number of days back to search for date-bounded historical queries",
"multi": false,
"name": "days_back",
"required": false,
"type": "number"
}
],
"dataTypeList": [
"domain",
"fqdn",
"ip"
],
"description": "RiskIQ: hosts with a child web component relationship to an IOC.",
"license": "AGPL-V3",
"name": "RiskIQ_HostpairChildren",
"url": "https://github.com/TheHive-Project/Cortex-Analyzers",
"version": "1.0"
}
43 changes: 43 additions & 0 deletions analyzers/RiskIQ/RiskIQ_HostpairParents.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,43 @@
{
"author": "RiskIQ",
"baseConfig": "RiskIQ",
"command": "RiskIQ/_analyzer.py",
"config": {
"auto_extract": true,
"property": "hostpair_parents"
},
"configurationItems": [
{
"description": "API username of the RiskIQ Illuminate or PassiveTotal account (usually an email address)",
"multi": false,
"name": "username",
"required": true,
"type": "string"
},
{
"description": "API key of the RiskIQ Illuminate or PassiveTotal account",
"multi": false,
"name": "api_key",
"required": true,
"type": "string"
},
{
"defaultValue": 180,
"description": "Number of days back to search for date-bounded historical queries",
"multi": false,
"name": "days_back",
"required": false,
"type": "number"
}
],
"dataTypeList": [
"domain",
"fqdn",
"ip"
],
"description": "RiskIQ: hosts with a parent web component relationship to an IOC.",
"license": "AGPL-V3",
"name": "RiskIQ_HostpairParents",
"url": "https://github.com/TheHive-Project/Cortex-Analyzers",
"version": "1.0"
}
43 changes: 43 additions & 0 deletions analyzers/RiskIQ/RiskIQ_Malware.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,43 @@
{
"author": "RiskIQ",
"baseConfig": "RiskIQ",
"command": "RiskIQ/_analyzer.py",
"config": {
"auto_extract": true,
"property": "malware"
},
"configurationItems": [
{
"description": "API username of the RiskIQ Illuminate or PassiveTotal account (usually an email address)",
"multi": false,
"name": "username",
"required": true,
"type": "string"
},
{
"description": "API key of the RiskIQ Illuminate or PassiveTotal account",
"multi": false,
"name": "api_key",
"required": true,
"type": "string"
},
{
"defaultValue": 180,
"description": "Number of days back to search for date-bounded historical queries",
"multi": false,
"name": "days_back",
"required": false,
"type": "number"
}
],
"dataTypeList": [
"domain",
"fqdn",
"ip"
],
"description": "RiskIQ: malware hashes from various sources associated with an IOC.",
"license": "AGPL-V3",
"name": "RiskIQ_Malware",
"url": "https://github.com/TheHive-Project/Cortex-Analyzers",
"version": "1.0"
}
Loading