Feature/nsrl

analyzers/NSRL/NSRL.json

@@ -0,0 +1,37 @@
+{
+  "name": "NSRL",
+  "author": "Andrea Garavaglia, Davide Arcuri - LDO-CERT",
+  "license": "AGPL-V3",
+  "url": "https://github.com/TheHive-Project/Cortex-Analyzers",
+  "version": "1.0",
+  "description": "Query NSRL",
+  "dataTypeList": [
+    "hash",
+    "filename"
+  ],
+  "baseConfig": "NSRL",
+  "command": "NSRL/nsrl.py",
+  "configurationItems": [
+    {
+      "name": "conn",
+      "description": "sqlalchemy connection string",
+      "multi": false,
+      "required": false,
+      "type": "string"
+    },
+    {
+      "name": "grep_path",
+      "description": "path of grep",
+      "type": "string",
+      "multi": false,
+      "required": false
+    },
+    {
+      "name": "nsrl_folder",
+      "description": "path of NSRL folder",
+      "type": "string",
+      "multi": false,
+      "required": false
+    }
+  ]
+}

analyzers/NSRL/create_db.py

@@ -0,0 +1,43 @@
+import os
+import sqlalchemy as db
+from glob import glob
+
+conn_string = "<insert postgres connection string >"
+NSRL_folder_path = "/path/to/NSRLFolder/*"
+
+engine = db.create_engine(conn_string)
+metadata = db.MetaData()
+
+nsrl = db.Table(
+    "nsrl",
+    metadata,
+    db.Column("id", db.Integer, primary_key=True, autoincrement=True),
+    db.Column("sha1", db.String),
+    db.Column("md5", db.String),
+    db.Column("crc32", db.String),
+    db.Column("filename", db.String),
+    db.Column("filesize", db.String),
+    db.Column("productcode", db.String),
+    db.Column("opsystemcode", db.String),
+    db.Column("specialcode", db.String),
+    db.Column("dbname", db.String),
+    db.Column("release", db.String),
+    db.Index("idx_sha1", "sha1"),
+    db.Index("idx_md5", "md5"),
+)
+metadata.create_all(engine)
+
+conn = engine.raw_connection()
+cursor = conn.cursor()
+for NSRL_file_path in glob(NSRL_folder_path):
+    dbname, release = NSRL_file_path.split("/")[-1].replace(".txt","").split("_")
+    print(dbname, release)
+    with open(NSRL_file_path, "r", encoding="latin-1") as f:
+        cmd = 'COPY nsrl("sha1", "md5", "crc32", "filename", "filesize", "productcode", "opsystemcode", "specialcode") FROM STDIN WITH (FORMAT CSV, DELIMITER ",", HEADER TRUE)'
+        cursor.copy_expert(cmd, f)
+        conn.commit()
+        engine.execute("update nsrl set dbname='%s', release='%s' where dbname is null" % (dbname, release))
+        conn.commit()
+cursor.close()
+conn.close()
+engine.dispose()

analyzers/NSRL/nsrl.py

@@ -0,0 +1,138 @@
+#!/usr/bin/env python3
+# encoding: utf-8
+import re
+import os
+import subprocess
+from cortexutils.analyzer import Analyzer
+
+try:
+    import sqlalchemy as db
+
+    USE_DB = True
+except ImportError:
+    USE_DB = False
+
+FIELDS = [
+    "sha1",
+    "md5",
+    "crc32",
+    "filename",
+    "filesize",
+    "productcode",
+    "opsystemcode",
+    "specialcode",
+]
+
+
+class NsrlAnalyzer(Analyzer):
+    def __init__(self):
+        Analyzer.__init__(self)
+        conn = self.get_param("config.conn", None)
+        self.engine = None
+        self.grep_path = self.get_param("config.grep_path", None)
+        self.nsrl_folder = self.get_param("config.nsrl_folder", None)
+
+        if conn and USE_DB:
+            self.engine = db.create_engine(conn)
+        elif self.grep_path and self.nsrl_folder:
+            pass
+        else:
+            self.error("No valid configuration found")
+
+    def summary(self, raw):
+        taxonomies = []
+        if raw["found"]:
+            taxonomies.append(self.build_taxonomy("safe", "NSRL", "lookup", "found"))
+        else:
+            taxonomies.append(
+                self.build_taxonomy("info", "NSRL", "lookup", "not found")
+            )
+        return {"taxonomies": taxonomies}
+
+    def run(self):
+        Analyzer.run(self)
+
+        data = self.get_param("data", None, "Data is missing")
+        data = data.upper()
+
+        if self.data_type not in ['filename', "hash"]:
+            self.error("Invalid data type")
+
+        if self.data_type == 'hash':
+
+            md5_re = re.compile(r"^[a-f0-9]{32}(:.+)?$", re.IGNORECASE)
+            sha1_re = re.compile(r"^[a-f0-9]{40}(:.+)?$", re.IGNORECASE)
+
+            if md5_re.match(data):
+                variable = "md5"
+            elif sha1_re.match(data):
+                variable = "sha1"
+            else:
+                self.error("Invalid hash type")
+
+        else:
+            variable = "filename"
+
+        results = {}
+        results["records"] = []
+        if not self.engine:
+            if not os.path.exists(self.nsrl_folder) and not os.path.isdir(
+                self.nsrl_folder
+            ):
+                self.error("NSRL folder not found or not valid")
+            try:
+                output = subprocess.Popen(
+                    [self.grep_path, "-r", "-i", data, self.nsrl_folder],
+                    stdout=subprocess.PIPE,
+                    universal_newlines=True,
+                )
+                for line in output.stdout.readlines():
+                    tmp = {}
+                    file_path, values = line.strip().split(":")
+                    values = [
+                        x.replace('"', "") for x in values.split(",")
+                    ]
+                    for key, value in zip(FIELDS, values):
+                        tmp[key] = value
+                    tmp["dbname"], tmp["release"] = (
+                        file_path.split("/")[-1].replace(".txt", "").split("_")
+                    )
+                    results["records"].append(tmp)
+                results["found"] = True
+            except subprocess.CalledProcessError as e:
+                results["found"] = False
+            results["mode"] = "file"
+
+        else:
+            if variable != 'filename':
+                sql = "SELECT %s FROM nsrl WHERE %s='%s'" % (
+                    ", ".join(FIELDS + ["dbname", "release"]),
+                    variable,
+                    data
+                )
+            else:
+                sql = "SELECT %s FROM nsrl WHERE %s ilike '%s'" % (
+                    ", ".join(FIELDS + ["dbname", "release"]),
+                    variable,
+                    "%%{}%%".format(data)
+                )
+            values = self.engine.execute(sql)
+            self.engine.dispose()
+            if values.rowcount > 0:
+                for row in values:
+                    results["records"].append(
+                        {
+                            key: value
+                            for (key, value) in zip(FIELDS + ["dbname", "release"], row)
+                        }
+                    )
+                results["found"] = True
+            else:
+                results["found"] = False
+            results["mode"] = "db"
+
+        self.report(results)
+
+
+if __name__ == "__main__":
+    NsrlAnalyzer().run()

analyzers/NSRL/requirements.txt

@@ -0,0 +1,3 @@
+cortexutils
+sqlalchemy
+psycopg2-binary

thehive-templates/NSRL_Lookup_1_0/long.html

@@ -0,0 +1,53 @@
+<div class="panel panel-success" ng-if="content.found">
+
+    <div class="panel-heading">
+		NSRL lookup
+	</div>
+	<div class="panel-body">
+        <table class="table table-hover">
+            <tr>
+                <th>Sha1</th>
+                <th>md5</th>
+                <th>crc32</th>
+                <th>File Name</th>
+                <th>File Size</th>
+                <th>Product Code</th>
+                <th>Operating System Code</th>
+                <th>Special Code</th>
+                <th>Mode</th>
+                <th>NSRL File Name</th>
+            </tr>
+            <tr ng-repeat="result in content.records">
+                <td><strong>{{result.sha1}}</strong></td>
+                <td><strong>{{result.md5}}</strong></td>
+                <td><strong>{{result.crc32}}</strong></td>
+                <td><strong>{{result.filename}}</strong></td>
+                <td><strong>{{result.filesize}}</strong></td>
+                <td><strong>{{result.productcode}}</strong></td>
+                <td><strong>{{result.opsystemcode}}</strong></td>
+                <td><strong>{{result.specialcode}}</strong></td>
+                <td><strong>{{content.mode}}</strong></td>
+                <td><strong>{{result.dbname}} {{result.release}}</strong></td>
+            </tr>
+        </table>                                           
+	</div>
+</div>
+
+<div class="panel panel-info" ng-if="content.count == 0">
+	<div class="panel-heading">
+		NSRL lookup: <b>No match found</b>
+	</div>
+</div>
+
+<!-- on error  -->
+<div class="panel panel-danger" ng-if="!success">
+	<div class="panel-heading">
+		FNSRL lookup <b>Error</b>
+	</div>
+	<div class="panel-body">
+		<dl class="dl-horizontal">
+			<dt>Error: </dt>
+			<dd>{{content.errorMessage}}</dd>
+		</dl>
+	</div>
+</div>

thehive-templates/NSRL_Lookup_1_0/short.html

@@ -0,0 +1,3 @@
+<span class="label" ng-repeat="t in content.taxonomies" ng-class="{'info': 'label-info', 'safe': 'label-success', 'suspicious': 'label-warning', 'malicious':'label-danger'}[t.level]">
+    {{t.namespace}}:{{t.predicate}}="{{t.value}}"
+</span>