New analyzer: Talos Reputation

analyzers/TalosReputation/TalosReputation.json

@@ -0,0 +1,11 @@
+{
+  "name": "TalosReputation",
+  "version": "1.0",
+  "author": "Gabriel Antonio da Silva",
+  "url": "https://github.com/TheHive-Project/Cortex-Analyzers",
+  "license": "AGPL-V3",
+  "description": "Get the Talos e-mail reputation",
+  "dataTypeList": ["ip"],
+  "command": "TalosReputation/TalosReputation.py",
+  "baseConfig": "TalosReputation"
+}

analyzers/TalosReputation/TalosReputation.py

@@ -0,0 +1,72 @@
+#!/usr/bin/env python3
+# encoding: utf-8
+
+import requests
+from cortexutils.analyzer import Analyzer
+import json
+
+class TalosReputation(Analyzer):
+
+    def __init__(self):
+        Analyzer.__init__(self)
+
+    def summary(self, raw):
+        taxonomies = []
+        level = 'info' #If there's a change of naming, will be presented as info
+        namespace = 'Talos'
+        predicate = 'Reputation'
+        value = raw.get('email_score_name')
+        if value == 'Good':
+            level = 'safe'
+        elif value == 'Poor':
+            level = 'malicious'
+        elif value == 'Neutral':
+            level = 'suspicious'
+        taxonomies.append(self.build_taxonomy(level, namespace, predicate, value))
+        return {'taxonomies': taxonomies}
+
+    def run(self):
+        Analyzer.run(self)
+        if self.data_type == 'ip':
+            try:
+                data = self.get_data()
+
+                headers={
+                    'Host':'talosintelligence.com',
+                    'Referer':'https://talosintelligence.com/reputation_center/lookup?search={}'.format(data),
+                    'User-Agent':'Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0',
+                    'Accept':'*/*'
+                }
+
+                response_details = requests.get('https://talosintelligence.com/sb_api/query_lookup',
+                    headers = headers,
+                    params = {
+                        'query':'/api/v2/details/ip/',
+                        'query_entry':data
+                        }
+                    )
+
+                response_location = requests.get('https://talosintelligence.com/sb_api/query_lookup',
+                    headers = headers,
+                    params = {
+                        'query':'/api/v2/location/ip/',
+                        'query_entry':data
+                        }
+                    ) 
+
+                if response_details.status_code == 200 | 201:
+                    if response_location.status_code == 200 | 201:
+                        result = response_details.json()
+                        result['country'] = response_location.json().get('country', None)
+                        self.report(result if len(result) > 0 else {})
+                    else:
+                        self.error('Failed to query Talos location. Status_code {}'.format(response_location.status_code))
+                else:
+                    self.error('Failed to query Talos details. Status_code {}'.format(response_details.status_code))
+            except Exception as e:
+                self.unexpectedError(e)
+        else:
+	        self.notSupported()
+
+if __name__ == '__main__':
+    TalosReputation().run()

analyzers/TalosReputation/requirements.txt

@@ -0,0 +1 @@
+requests

thehive-templates/TalosReputation_1_0/long.html

@@ -0,0 +1,76 @@
+<!-- Success case -->
+<div ng-if="success">
+    <div class="panel panel-info">
+        <div class="panel-heading">
+            <strong>Owner Details</strong>
+        </div>
+        <div class="panel-body">
+            <dl class="dl-horizontal">
+                <dt>Location</dt>
+                <dd>{{content.country}}</dd>
+            </dl>
+
+            <dl class="dl-horizontal">
+                <dt>IP Address</dt>
+                <dd>{{content.ip}}</dd>
+            </dl>
+
+            <dl class="dl-horizontal">
+                <dt>Fwd/Rev DNS Match</dt>
+                <dd>{{content.dnsmatch == 1 && 'Yes' || 'No'}}</dd>
+            </dl>
+
+            <dl class="dl-horizontal">
+                <dt>Hostname</dt>
+                <dd>{{content.hostname}}</dd>
+            </dl>
+
+            <dl class="dl-horizontal">
+                <dt>Domain</dt>
+                <dd>{{content.domain}}</dd>
+            </dl>
+
+            <dl class="dl-horizontal">
+                <dt>Network Owner</dt>
+                <dd>{{content.organization}}</dd>
+            </dl>
+        </div>
+    </div>
+    <div class="panel panel-info">
+        <div class="panel-heading">
+            <strong>Reputation Details</strong>
+        </div>
+        <div class="panel-body">
+            <dl class="dl-horizontal">
+                <dt>Email Reputation</dt>
+                <dd>{{content.email_score_name}}</dd>
+            </dl>
+
+            <dl class="dl-horizontal">
+                <dt>Web Reputation</dt>
+                <dd>{{content.web_score_name}}</dd>
+            </dl>
+        </div>
+    </div>
+    <div class="panel panel-info">
+        <div class="panel-heading">
+            <strong>Blacklists</strong>
+        </div>
+        <div class="panel-body">
+            <dl class="dl-horizontal" ng-repeat="(key,value) in content.blacklists">
+                <dt>{{key}}</dt>
+                <dd>{{value.rules.length > 0 && 'Listed' || 'Not Listed'}}</dd>
+            </dl>
+        </div>
+    </div>
+</div>
+
+<!-- Failure case -->
+<div class="panel panel-danger" ng-if="!success">
+    <div class="panel-heading">
+        <strong>{{artifact.data | fang}}</strong>
+    </div>
+    <div class="panel-body">
+        {{content.errorMessage}}
+    </div>
+</div>

thehive-templates/TalosReputation_1_0/short.html

@@ -0,0 +1,3 @@
+<span class="label" ng-repeat="t in content.taxonomies" ng-class="{'info': 'label-info', 'safe': 'label-success', 'suspicious': 'label-warning', 'malicious':'label-danger'}[t.level]">
+    {{t.namespace}}:{{t.predicate}}="{{t.value}}"
+</span>