diff --git a/analyzers/WOT/WOT_lookup.json b/analyzers/WOT/WOT_lookup.json index 0d2dfec12..972703873 100644 --- a/analyzers/WOT/WOT_lookup.json +++ b/analyzers/WOT/WOT_lookup.json @@ -1,8 +1,8 @@ { "name": "WOT_Lookup", - "version": "1.0", - "author": "Andrea Garavaglia, LDO-CERT", - "url": "https://github.com/garanews/Cortex-Analyzers", + "version": "2.0", + "author": "Andrea Garavaglia, Davide Arcuri, LDO-CERT", + "url": "https://github.com/TheHive-Project/Cortex-Analyzers", "license": "AGPL-V3", "description": "Use Web of Trust to check a domain's reputation.", "dataTypeList": ["domain", "fqdn"], @@ -12,6 +12,13 @@ "service": "query" }, "configurationItems": [ + { + "name": "user", + "description": "Define the API user", + "type": "string", + "multi": false, + "required": true + }, { "name": "key", "description": "Define the API key", diff --git a/analyzers/WOT/WOT_lookup.py b/analyzers/WOT/WOT_lookup.py index 08a312643..0cfd495a6 100755 --- a/analyzers/WOT/WOT_lookup.py +++ b/analyzers/WOT/WOT_lookup.py @@ -9,67 +9,34 @@ class WOTAnalyzer(Analyzer): def __init__(self): Analyzer.__init__(self) + self.WOT_id = self.get_param('config.user', None, + 'Missing WOT API user') self.WOT_key = self.get_param('config.key', None, 'Missing WOT API key') - self.categories = { - "101": "Malware or viruses", - "102": "Poor customer experience", - "103": "Phishing", - "104": "Scam", - "105": "Potentially illegal", - "201": "Misleading claims or unethical", - "202": "Privacy risks", - "203": "Suspicious", - "204": "Hate, discrimination", - "205": "Spam", - "206": "Potentially unwanted programs", - "207": "Ads / pop-ups", - "301": "Online tracking", - "302": "Alternative or controversial medicine", - "303": "Opinions, religion, politics", - "304": "Other", - "401": "Adult content", - "402": "Incidental nudity", - "403": "Gruesome or shocking", - "404": "Site for kids", - "501": "Good site" - } - - def points_to_verbose(self, points): - if points >= 80: - return "Excellent" - elif points >= 60: - return "Good" - elif points >= 40: - return "Unsatisfactory" - elif points >= 20: - return "Poor" - else: - return "Very poor" def wot_checkurl(self, data): - url = 'http://api.mywot.com/0.4/public_link_json2?hosts=' + data + '/&callback=process&key=' + self.WOT_key - r = requests.get(url) - return json.loads(r.text.replace("process(", "").replace(")", "")) + url = 'http://scorecard.api.mywot.com/v3/targets?t={}'.format(data) + headers = { + 'x-user-id': self.WOT_id, + 'x-api-key': self.WOT_key + } + r = requests.get(url, headers=headers) + if r.status_code == 200: + return r.json()[0] + else: + self.error("{}{}".format(r.status_code, r.text)) def summary(self, raw): taxonomies = [] value = "-" + level = "info" - categories = raw.get("Categories", None) - blacklists = raw.get("Blacklists", None) - num_categories = raw.get("Categories Identifier", None) + categories = [x.get('name', None) for x in raw.get("categories", [])] + blacklists = raw.get("blackList", []) + min_categories = min([x.get('id', 501) for x in raw.get("categories", [])]) if categories: - value = "|".join(categories) - if blacklists: - value = "|".join([x[0] for x in blacklists]) - level = "malicious" - else: - if num_categories: - min_cat = min([int(x) for x in num_categories]) - else: - min_cat = 501 + value = "|".join(categories) if min_cat > 300: level = "safe" elif min_cat > 200: @@ -77,6 +44,11 @@ def summary(self, raw): else: level = "malicious" + if blacklists: + value = "|".join(blacklists) + level = "malicious" + + taxonomies.append(self.build_taxonomy(level, "WOT", "Category", "{}".format(value))) return {"taxonomies": taxonomies} @@ -84,24 +56,8 @@ def run(self): if self.data_type in ['domain', 'fqdn']: data = self.get_param('data', None, 'Data is missing') r = self.wot_checkurl(data) - if data in r.keys(): - info = r[data] - r_dict = {} - if '0' in info.keys(): - r_dict['Trustworthiness'] = {} - r_dict['Trustworthiness']['Reputation'] = self.points_to_verbose(info['0'][0]) - r_dict['Trustworthiness']['Confidence'] = self.points_to_verbose(info['0'][1]) - if '4' in info.keys(): - r_dict['Child_Safety'] = {} - r_dict['Child_Safety']['Reputation'] = self.points_to_verbose(info['4'][0]) - r_dict['Child_Safety']['Confidence'] = self.points_to_verbose(info['4'][1]) - if 'blacklists' in info.keys(): - r_dict['Blacklists'] = [(k, datetime.datetime.fromtimestamp(v).strftime('%Y-%m-%d %H:%M:%S')) - for k, v in info['blacklists'].items()] - if 'categories' in info.keys(): - r_dict['Categories'] = [self.categories[x] for x in list(info['categories'].keys())] - r_dict['Categories Identifier'] = list(info['categories'].keys()) - self.report(r_dict) + if r: + self.report(r) else: self.error('Invalid data type') diff --git a/analyzers/WOT/requirements.txt b/analyzers/WOT/requirements.txt index 8ad52a568..4a21dbf63 100644 --- a/analyzers/WOT/requirements.txt +++ b/analyzers/WOT/requirements.txt @@ -1 +1,2 @@ cortexutils +requests \ No newline at end of file diff --git a/thehive-templates/WOT_Lookup_1_0/long.html b/thehive-templates/WOT_Lookup_2_0/long.html similarity index 56% rename from thehive-templates/WOT_Lookup_1_0/long.html rename to thehive-templates/WOT_Lookup_2_0/long.html index ce4abe93e..0d3e3d918 100644 --- a/thehive-templates/WOT_Lookup_1_0/long.html +++ b/thehive-templates/WOT_Lookup_2_0/long.html @@ -7,48 +7,49 @@
- General Information + General Information for {{content.target}}
-
-

Trustworthiness

+
+

Safety

-
Reputation
-
{{content.Trustworthiness.Reputation}}
+
Status
+
{{content.safety.status}}
-
Confidence
-
{{content.Trustworthiness.Confidence}}
+
Reputations
+
{{content.safety.reputations}}
+
+
Confidence
+
{{content.safety.confidence}}
+
-
+

Child Safety

Reputation
-
{{content.Child_Safety.Reputation}}
+
{{content.childSafety.reputations}}
Confidence
-
{{content.Child_Safety.Confidence}}
+
{{content.childSafety.confidence}}
-
+

Blacklists

-
-
-
{{ blk[0] }}
-
{{ blk[1] }}
-
+

{{blk}}

-
+

Categories


-
-
{{ ctg }}
+
+
{{ctg.name}}
+
Confidence: {{ctg.confidence}}
@@ -66,4 +67,4 @@

Categories

{{content.errorMessage}}
-
\ No newline at end of file +
diff --git a/thehive-templates/WOT_Lookup_1_0/short.html b/thehive-templates/WOT_Lookup_2_0/short.html similarity index 100% rename from thehive-templates/WOT_Lookup_1_0/short.html rename to thehive-templates/WOT_Lookup_2_0/short.html