New analyzer: DShield

analyzers/DShield/DShield_lookup.json

@@ -0,0 +1,14 @@
+{
+  "name": "DShield_lookup",
+  "version": "1.0",
+  "author": "Xavier Xavier, SANS ISC",
+  "url": "https://github.com/xme/thehive/Cortex-Analyzers",
+  "license": "AGPL-V3",
+  "description": "Query the SANS ISC DShield API to check for an IP address reputation.",
+  "dataTypeList": ["ip"],
+  "command": "DShield/DShield_lookup.py",
+  "baseConfig": "DShield",
+  "config": {
+      "service": "query"
+  }
+}

analyzers/DShield/DShield_lookup.py

@@ -0,0 +1,95 @@
+#!/usr/bin/env python3
+# encoding: utf-8
+import json
+import requests
+import datetime
+import math
+from cortexutils.analyzer import Analyzer
+
+class DShieldAnalyzer(Analyzer):
+    def __init__(self):
+        Analyzer.__init__(self)
+
+    def dshield_checkip(self, data):
+        url = 'https://isc.sans.edu/api/ip/%s?json' % data
+        r = requests.get(url)
+        return json.loads(r.text)
+
+    def summary(self, raw):
+        taxonomies = []
+        value = "-"
+        level = 'safe'
+
+        categories = raw.get("Categories", None)
+        blacklists = raw.get("Blacklists", None)
+        num_categories = raw.get("Categories Identifier", None)
+
+        if 'maxrisk' in raw:
+            if 'threatfeedscount' in raw:
+                r = int(raw['maxrisk']) + raw['threatfeedscount']
+            else:
+                r = int(raw['maxrisk'])
+            if r <= 1:
+                level = 'safe'
+            elif r <= 6:
+                level = 'suspicious'
+            else:
+                level = 'malicious'
+
+        value = "\"{} count(s) / {} attack(s) / {} threatfeed(s)\"".format(raw['count'], raw['attacks'], raw['threatfeedscount'])
+
+        taxonomies.append(self.build_taxonomy(level, "DShield", "Score", value))
+        return {"taxonomies": taxonomies}
+
+    def get_reputation(self, risk):
+        if risk <= 1:
+            return("Safe")
+        elif risk <= 6:
+            return("Suspicious")
+        else:
+            return("Malicious")
+
+    def run(self):
+        if self.data_type == 'ip':
+            data = self.get_param('data', None, 'Data is missing')
+            r = self.dshield_checkip(data)
+            # Do we get valid results
+            if self.data_type in r.keys():
+                info = r[self.data_type]
+                results = {}
+                results['ip'] = info['number']
+                results['count'] = info['count'] if isinstance(info['count'], int) else 0
+                results['attacks'] = info['attacks'] if isinstance(info['attacks'], int) else 0
+                results['lastseen'] = info['maxdate'] if isinstance(info['maxdate'], str) else 'None'
+                results['firstseen'] = info['mindate'] if isinstance(info['mindate'], str) else 'None'
+                results['updated'] = info['updated'] if isinstance(info['updated'], str) else 'None'
+                results['comment'] = info['comment'] if isinstance(info['comment'], str) else 'None'
+                results['asabusecontact'] = info['asabusecontact'] if isinstance(info['asabusecontact'], str) else 'Unknown'
+                results['as'] = info['as']
+                results['asname'] = info['asname']
+                results['ascountry'] = info['ascountry']
+                results['assize'] = info['assize']
+                results['network'] = info['network']
+                results['threatfeedscount'] = 0
+                if 'threatfeeds' not in info:
+                    results['threatfeeds'] = ''
+                else:
+                    results['threatfeedscount'] = len(json.loads(json.dumps(info['threatfeeds'])))
+                    results['threatfeeds'] = info['threatfeeds'] 
+                # Compute a risk level based on collected information
+                results['maxrisk'] = 0
+                maxrisk = 10
+                if results['attacks'] > 0:
+                    results['maxrisk'] = round(min(math.log10(results['attacks']) * 2, maxrisk))
+
+                # We add the number of threat feeds to the maxrisk to increase the detection rate
+                results['reputation'] = self.get_reputation(int(results['maxrisk']) + results['threatfeedscount'])
+                self.report(results)
+            else:
+                self.error('No data found')
+        else:
+            self.error('Invalid data type')
+
+
+if __name__ == '__main__':
+    DShieldAnalyzer().run()

analyzers/DShield/DShield_lookup.report_template

@@ -0,0 +1,104 @@
+<div class="report-FILEInfo" ng-if="success">
+    <style>
+        .report-FILEInfo dl {
+            margin-bottom: 2px;
+        }
+
+    </style>
+
+  <div class="panel panel-info">
+      <div class="panel-heading">
+          <strong>DShield IP Reputation Summary</strong>
+      </div>
+      <div class="panel-body">
+          <div ng-if="content[artifact.data].length === 0">
+              No records found
+          </div>
+          <div>
+              <dl class="dl-horizontal">
+                <dt>IP: </dt>
+                <dd class="wrap">{{content.ip|| "-"}}</dd>
+              </dl>
+               <dl class="dl-horizontal">
+                <dt>Reputation: </dt>
+                <dd class="wrap">{{content.reputation || "-"}}</dd>
+              </dl>
+              <dl class="dl-horizontal">
+                <dt>Network: </dt>
+                <dd class="wrap">{{content.network || "-"}}</dd>
+              </dl>
+              <dl class="dl-horizontal">
+                <dt>AS: </dt>
+                <dd class="wrap">{{content.as || "-"}}</dd>
+              </dl>
+              <dl class="dl-horizontal">
+                <dt>AS Name: </dt>
+                <dd class="wrap">{{content.asname || "-"}}</dd>
+              </dl>
+              <dl class="dl-horizontal">
+                <dt>AS Country: </dt>
+                <dd class="wrap">{{content.ascountry || "-"}}</dd>
+              </dl>
+              <dl class="dl-horizontal">
+                <dt>AS Abuse Contact: </dt>
+                <dd class="wrap">{{content.asabusecontact || "-"}}</dd>
+              </dl>
+              <dl class="dl-horizontal">
+                <dt>Number of Attacks: </dt>
+                <dd class="wrap">{{content.count || "-"}}</dd>
+              </dl>
+              <dl class="dl-horizontal">
+                <dt>Unique Attacked Hosts: </dt>
+                <dd class="wrap">{{content.attacks || "-"}}</dd>
+              </dl>
+               <dl class="dl-horizontal">
+                <dt>First Reported Attack: </dt>
+                <dd class="wrap">{{content.firstseen || "-"}}</dd>
+              </dl>
+               <dl class="dl-horizontal">
+                <dt>Last Reported Attacks: </dt>
+                <dd class="wrap">{{content.lastseen || "-"}}</dd>
+              </dl>
+               <dl class="dl-horizontal">
+                <dt>Risk Level: </dt>
+                <dd class="wrap">{{content.maxrisk || "-"}}</dd>
+              </dl>
+               <dl class="dl-horizontal">
+                <dt>Comment: </dt>
+                <dd class="wrap">{{content.comment || "-"}}</dd>
+              </dl>
+               <dl class="dl-horizontal">
+                <dt>Threat Feeds: </dt>
+                <dd class="wrap">{{content.threatfeedscount || "-"}}</dd>
+              </dl>
+            </div>
+        </div>
+  </div>
+
+  <div class="panel panel-info" ng-if="success">
+      <div class="panel-heading">
+          <strong>Threat Feeds</strong>
+      </div>
+      <div class="panel-body">
+          <div ng-if="content[artifact.threatfeeds].length === 0">
+              No threat feed found
+          </div>
+          <div>
+            <dl class="dl-horizontal" ng-repeat="(key, value) in content.threatfeeds">
+              <dt>{{key}}</dt>
+              <dd class="wrap">First Seen: {{value.firstseen || "-"}}</dd>
+              <dd class="wrap">Last Seen: {{value.lastseen || "-"}}</dd>
+            </dl>
+          </div>
+      </div>
+  </div>
+
+<!-- General error -->
+<div class="panel panel-danger" ng-if="!success">
+    <div class="panel-heading">
+        <strong>{{(artifact.data || artifact.attachment.name) | fang}}</strong>
+    </div>
+    <div class="panel-body">
+        {{content.errorMessage}}
+    </div>
+</div>

analyzers/DShield/requirements.txt

@@ -0,0 +1,2 @@
+cortexutils
+urllib2