New analyzer : Cyberprotect ThreatScore

analyzers/Cyberprotect/CyberprotectAnalyzer.py

@@ -0,0 +1,45 @@
+#!/usr/bin/env python
+# encoding: utf-8
+
+import requests
+from cortexutils.analyzer import Analyzer
+
+class CyberprotectAnalyzer(Analyzer):
+
+    URI = "https://threatscore.cyberprotect.fr/api/score/"
+
+    def __init__(self):
+        Analyzer.__init__(self)
+        self.service = self.get_param('config.service', None, 'Service parameter is missing')
+
+    def summary(self, raw):
+        taxonomies = []
+        namespace = "Cyberprotect"
+        if self.service == 'ThreatScore':
+            level = 'info';
+            value = 'not in database'
+            if(raw.get('data') and raw.get('scores') and len(raw.get('scores')) > 0):
+                value = 'not analyzed yet'
+                if(raw['scores'][0].get('score')):
+                    level = 'safe';
+                    value = raw['scores'][0]['score']
+                    if value >= 0.5:
+                        level = 'malicious'
+                    elif value >= 0.25 and value < 0.5:
+                        level = 'suspicious'
+            taxonomies.append(self.build_taxonomy(level, namespace, self.service, value))
+        return {"taxonomies": taxonomies}
+
+    def run(self):
+        Analyzer.run(self)
+        if self.service == 'ThreatScore' and (self.data_type == 'domain' or self.data_type == 'ip'):
+            try:
+                response = requests.get("{}{}".format(self.URI, self.get_data()))
+                self.report(response.json())
+            except Exception as e:
+                self.unexpectedError(e)
+        else:
+            self.notSupported()
+
+if __name__ == '__main__':
+    CyberprotectAnalyzer().run()

analyzers/Cyberprotect/Cyberprotect_ThreatScore.json

@@ -0,0 +1,15 @@
+{
+    "name": "Cyberprotect_ThreatScore",
+    "author": "Rémi Allain, Cyberprotect",
+    "license": "AGPL-V3",
+    "url": "https://github.com/Cyberprotect/Cortex-Analyzers",
+    "version": "1.0",
+    "description": "ThreatScore is a cyber threat scoring system provided by Cyberprotect",
+    "dataTypeList": ["domain", "ip"],
+    "command": "Cyberprotect/CyberprotectAnalyzer.py",
+    "baseConfig": "Cyberprotect",
+    "config": {
+        "service": "ThreatScore",
+        "check_tlp": true
+    }
+}

analyzers/Cyberprotect/requirements.txt

@@ -0,0 +1,2 @@
+cortexutils
+requests

thehive-templates/Cyberprotect_ThreatScore/long.html

@@ -0,0 +1,31 @@
+<div class="panel panel-info" ng-if="success">
+    <div class="panel-heading">
+        <a href="https://threatscore.cyberprotect.fr" target="_blank">threatscore.cyberprotect.fr</a> Cyberprotect threat scoring system
+        <br/> Report for
+        <strong>{{artifact.data}}</strong>
+    </div>
+    <div class="panel-body" ng-if="content.scores.length > 0">
+        <h4 class="dl-horizontal">{{content.scores.length}} scores found.</h4>
+        <table class="table table-bordered">
+            <tr>
+                <th>Date</th>
+                <th>Score</th>
+            </tr>
+            <tr ng-repeat="score in ::content.scores">
+                <td>{{score.date}}</td>
+                <td>{{score.score}}</td>
+            </tr>
+        </table>
+    </div>
+    <div class="panel-body" ng-if="content.scores.length < 1">
+        No results found
+    </div>
+</div>
+<div class="panel panel-danger" ng-if="!success">
+    <div class="panel-heading">
+        <strong>{{(artifact.data || artifact.attachment.name) | fang}}</strong>
+    </div>
+    <div class="panel-body">
+        {{content.errorMessage}}
+    </div>
+</div>

thehive-templates/Cyberprotect_ThreatScore/short.html

@@ -0,0 +1,3 @@
+<span class="label" ng-repeat="t in content.taxonomies" ng-class="{'info': 'label-info', 'safe': 'label-success', 'suspicious': 'label-warning', 'malicious':'label-danger'}[t.level]">
+    {{t.namespace}}:{{t.predicate}}={{t.value}}
+</span>