New analyzer : Google DNS over HTTPS

analyzers/GoogleDNS/DNS_records.py

@@ -0,0 +1,88 @@
+RECORDS = {
+	1 : "A",
+	28 : "AAAA",
+	2 : "NS",
+	18 : "AFSDB",
+	252 : "AXFR",
+	5 : "CNAME",
+	6 : "SOA",
+	7 : "MB",
+	8 : "MG",
+	9 : "MR",
+	10 : "NULL",
+	11 : "WKS",
+	12 : "PTR",
+	13 : "HINFO",
+	14 : "MINFO",
+	15 : "MX",
+	16 : "TXT",
+	17 : "RP",
+	19 : "X25",
+	20 : "ISDN",
+	21 : "RT",
+	22 : "NSAP",
+	23 : "NSAP-PTR",
+	24 : "SIG",
+	25 : "KEY",
+	26 : "PX",
+	27 : "GPOS",
+	31 : "EID",
+	32 : "NIMLOC",
+	33 : "SRV",
+	34 : "ATMA",
+	35 : "NAPTR",
+	36 : "KX",
+	37 : "CERT",
+	38 : "A6",
+	39 : "DNAME",
+	40 : "SINK",
+	41 : "OPT",
+	42 : "APL",
+	43 : "DS",
+	45 : "IPSECKEY",
+	46 : "RRSIG",
+	47 : "NSEC",
+	48 : "DNSKEY",
+	49 : "DHCID",
+	50 : "NSEC3",
+	51 : "NSEC3PARAM",
+	55 : "HIP",
+	56 : "NINFO",
+	57 : "RKEY",
+	58 : "TALINK",
+	100 : "UINFO",
+	101 : "UID",
+	102 : "GID",
+	103 : "UNSPEC",
+	249 : "TKEY",
+	52 : "TLSA",
+	250 : "TSIG",
+	251 : "IXFR",
+	255 : "*",
+	257 : "CAA",
+	32768 : "TA",
+	32769 : "DLV"
+}
+
+CODE = {
+	0  : "No Error",
+	1  : "Format Error",
+	2  : "Server Failure",
+	3  : "Non-Existent Domain",
+	4  : "Not Implemented",
+	5  : "Query Refused",
+	6  : "Name Exists when it should not",
+	7  : "RR Set Exists when it should not",
+	8  : "RR Set that should exist does not",
+	9  : "Server Not Authoritative for zone",
+	9  : "Not Authorized",
+	10 : "Name not contained in zone",	
+	16 : "Bad OPT Version",
+	16 : "TSIG Signature Failure",	
+	17 : "Key not recognized", 	
+	18 : "Signature out of time window", 	
+	19 : "Bad TKEY Mode",
+	20 : "Duplicate key name",
+	21 : "Algorithm not supported",
+	22 : "Bad Truncation"
+}

analyzers/GoogleDNS/GoogleDNS_resolve.json

@@ -0,0 +1,17 @@
+{
+  "name": "GoogleDNS_resolve",
+  "version": "1.0.0",
+  "author": "CERT-LaPoste",
+  "url": "https://github.com/TheHive-Project/Cortex-Analyzers",
+  "license": "AGPL-V3",
+  "description": "Request Google DNS over HTTPS service",
+  "dataTypeList": ["domain", "ip", "fqdn"],
+  "command": "GoogleDNS/GoogleDNS_resolve.py",
+  "baseConfig": "GoogleDNS",
+  "config": {
+    "service": "get"
+  },
+  "configurationItems": [
+
+  ]
+}

analyzers/GoogleDNS/GoogleDNS_resolve.py

@@ -0,0 +1,78 @@
+#!/usr/bin/python3
+#encoding: utf-8
+
+from requests import get
+from cortexutils.analyzer import Analyzer
+from DNS_records import RECORDS, CODE
+from json import loads
+from traceback import format_exc
+
+class GoogleDNS_resolve(Analyzer):
+
+	def __init__(self):
+		Analyzer.__init__(self)
+		self.url = "https://dns.google.com/resolve?"
+		self.proxies = None
+		self.answer = None
+
+	def resolve(self, query):
+
+		query = {
+			"name" : query,
+			"type" : "ANY"
+		}
+
+		try:
+			data = loads(get(self.url, params=query, proxies=self.proxies).text)
+		except Exception as e:
+			self.report(format_exc())
+		else:
+
+			if data['Status'] == 0: # DNS response code
+				if 'Answer' in data: # Maybe nothing is found
+
+					for records in data['Answer']: # for each records found by Google
+						try:
+							records["type"] = RECORDS[records["type"]]  # replace IANA code by record name
+						except KeyError:
+							data["Error"] = "Invalid IANA code : {0}".format(int(records["type"]))	# Maybe using a special code
+				else:
+					data['Answer'] = [] 
+
+			else: # If the DNS response match an error code
+				try:
+					# known DNS error code
+					data["Error"] = "Error for {0} : {1}".format(data['Question'][0]['name'], CODE[int(data["Status"])])
+				except KeyError:
+					# DNS error code is unknow
+					data["Error"] = "Unknow error : {0}".format(int(data["Status"]))
+
+			self.answer = data
+			self.answer['Question'][0]['type'] = RECORDS[data['Question'][0]['type']] # eplace IANA code by record name 
+			self.answer["Status"] = CODE[int(data["Status"])] # replace DNS response code by name
+
+	def run(self):
+		if self.data_type not in ["ip", "domain", "fqdn"]:
+			self.error("Wrong data type")
+
+		target = self.getData()
+
+		self.proxies = {
+			"https" : self.getParam("config.proxy_https"),
+			"http" : self.getParam("config.proxy_http")
+		}
+
+		target = ".".join(target.split('.')[::-1]) + '.in-addr.arpa' if self.data_type == "ip" else target
+
+		self.resolve(target)
+		if self.answer != None:
+			self.report(self.answer)
+		else:
+			self.error("Something went wrong")
+
+	def summary(self, raw):
+		count = self.build_taxonomy("info", "GoogleDNS", "RecordsCount", len(self.answer["Answer"]))
+		return { "taxonomies" : [count]}
+
+if __name__ == "__main__":
+	GoogleDNS_resolve().run()

analyzers/GoogleDNS/requirements.txt

@@ -0,0 +1,2 @@
+cortexutils
+requests

thehive-templates/GoogleDNS_resolve_1_0_0/long.html

@@ -0,0 +1,54 @@
+<!-- Success !--> <div class="panel panel-info" ng-if="content.Status == 'No Error'" >
+    <div class="panel-heading" >
+        <strong> Answer </strong>
+     </div>
+    <div class="panel-body">
+        <p><strong>Question : </strong>{{content.Question[0].name}} IN {{content.Question[0].type}}</p>
+        <p><strong>Comment : </strong>{{content.Comment}}</p>
+        <table class="table table-hover">
+            <tr>
+                <th>Name</th>
+                <th>Type</th>
+                <th>Data</th>
+                <th>TTL</th>
+            </tr>
+            <tr ng-repeat="row in content.Answer">
+                <td>
+                    {{row.name}}
+                </td>
+                <td>
+                    <strong>{{row.type}}</strong>
+                </td>
+                 <td>
+                    {{row.data}}
+                </td>
+                 <td>
+                    {{row.TTL}}
+                </td>
+            </tr>
+        </table>
+    </div>
+</div> 
+
+<!-- Success but bad answer !--> 
+<div class="panel panel-danger" ng-if="content.Error" >
+    <div class="panel-heading" >
+        <strong> Answer with error </strong>
+     </div>
+     <div class="panel-body">
+        <p><strong>Question : </strong>{{content.Question[0].name}} IN {{content.Question[0].type}}</p>
+        <p> <strong> Google DNS service indicate the following error : </strong> {{ content.Error }} </p>
+     </div>
+</div>
+
+<!-- Error !-->
+<div class="panel panel-danger" ng-if="!success" >
+    <div class="panel-heading" >
+        <strong> Error while running the service </strong>
+     </div>
+     <div class="panel-body">
+        <pre>
+        {{content.errorMessage}}
+        </pre>
+     </div>
+</div>

thehive-templates/GoogleDNS_resolve_1_0_0/short.html

@@ -0,0 +1,3 @@
+<span class="label" ng-repeat="t in content.taxonomies" ng-class="{'info': 'label-info', 'safe': 'label-success', 'suspicious': 'label-warning', 'malicious':'label-danger'}[t.level]">
+    {{t.namespace}}:{{t.predicate}}="{{t.value}}"
+</span>