diff --git a/responders/UmbrellaBlacklister/UmbrellaBlacklister.json b/responders/UmbrellaBlacklister/UmbrellaBlacklister.json index 2d030b428..0c2e0046e 100644 --- a/responders/UmbrellaBlacklister/UmbrellaBlacklister.json +++ b/responders/UmbrellaBlacklister/UmbrellaBlacklister.json @@ -1,6 +1,6 @@ { "name": "Umbrella Blacklister", - "version": "1.0", + "version": "1.1", "author": "Kyle Parrish", "url": "https://github.com/TheHive-Project/Cortex-Analyzers", "license": "AGPL-V3", diff --git a/responders/UmbrellaBlacklister/UmbrellaBlacklister.py b/responders/UmbrellaBlacklister/UmbrellaBlacklister.py index 31a4cd11b..72e6794e6 100644 --- a/responders/UmbrellaBlacklister/UmbrellaBlacklister.py +++ b/responders/UmbrellaBlacklister/UmbrellaBlacklister.py @@ -5,19 +5,32 @@ import requests from datetime import datetime + class UmbrellaBlacklister(Responder): def __init__(self): Responder.__init__(self) - self.integration_url = self.get_param('config.integration_url', None, "Integration URL Missing") + self.integration_url = self.get_param( + 'config.integration_url', None, "Integration URL Missing") def run(self): Responder.run(self) - if self.get_param('data.dataType') == 'domain': + data_type = self.get_param('data.dataType') + ioc_types = ["domain", "url", "fqdn"] + if data_type in ioc_types: + + if data_type == "domain" or data_type == "fqdn": + domain = self.get_param( + 'data.data', None, 'No artifacts available') + + dstUrl = "http://" + domain - domain = self.get_param('data.data', None, 'No artifacts available') + elif data_type == "url": + dstUrl = self.get_param( + 'data.data', None, 'No artifacts available') + + domain = dstUrl.split('/')[2] - dstUrl = "http://" + domain date = datetime.now().strftime("%Y-%m-%dT%XZ") headers = { @@ -36,16 +49,18 @@ def run(self): "providerName": "Security Platform" } - r = requests.post(self.integration_url, json=payload, headers=headers) + r = requests.post(self.integration_url, + json=payload, headers=headers) if r.status_code == 200 | 202: self.report({'message': 'Blacklisted in Umbrella.'}) else: self.error('Failed to add to blacklist.') - else: - self.error('Incorrect dataType. "Domain" expexted.') + else: + self.error('Incorrect dataType. "Domain", "FQDN", or "URL" expected.') def operations(self, raw): return [self.build_operation('AddTagToArtifact', tag='Umbrella:blocked')] + if __name__ == '__main__': - UmbrellaBlacklister().run() + UmbrellaBlacklister().run()