Stopforumspam analyzer

[srilumpa]

Hi,
Here is an analyzer to cross data from the StopForumSpam API (http://stopforumspam.com/). This relates to the issue #205.

I have tested it in CLI but I was not able to test its execution through Cortex nor to test the report in TheHive. Hopefully everything should work. Also, I started working on it based on Cortex 1.1.4 but I should have adapted it to Cortex2 requirements.

Don't hesitate to notify me if you see something that is not to your liking.

[srilumpa]

Also, some tests that I have done:

$ ./stopforumspam_analyzer.py <<< '{"data":"[email protected]", "dataType":"mail"}'

{
  "success": true,
  "summary": {
    "taxonomies": [
      {
        "level": "info",
        "namespace": "SFS",
        "predicate": "mail",
        "value": "Not found"
      }
    ]
  },
  "artifacts": [],
  "full": {
    "frequency": 0,
    "appears": false
  }
}

$ ./stopforumspam_analyzer.py <<< '{"data":"<some_spammer_email>", "dataType":"mail"}'

{
  "success": true,
  "summary": {
    "taxonomies": [
      {
        "level": "malicious",
        "namespace": "SFS",
        "predicate": "mail",
        "value": 99.96
      }
    ]
  },
  "artifacts": [],
  "full": {
    "lastseen": 1527238999,
    "frequency": 12474,
    "appears": true,
    "confidence": 99.96
  }
}

./stopforumspam_analyzer.py <<< '{"data":"<some_spammer_ip>", "dataType":"ip"}'

{
  "success": true,
  "summary": {
    "taxonomies": [
      {
        "level": "malicious",
        "namespace": "SFS",
        "predicate": "ip",
        "value": 99.99
      }
    ]
  },
  "artifacts": [],
  "full": {
    "lastseen": 1527239119,
    "frequency": 65535,
    "appears": true,
    "confidence": 99.99,
    "delegated": "ua",
    "country": "ua",
    "asn": 15895
  }
}

./stopforumspam_analyzer.py <<< '{"data":"1.1.1.1", "dataType":"ip"}'

{
  "success": true,
  "summary": {
    "taxonomies": [
      {
        "level": "info",
        "namespace": "SFS",
        "predicate": "ip",
        "value": "Not found"
      }
    ]
  },
  "artifacts": [],
  "full": {
    "frequency": 0,
    "appears": false,
    "country": "au",
    "asn": 13335
  }
}

[3c7]

This is merged in release/1.10.0 and gets closed automatically when merged into develop. Thanks for your contribution!