Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

GreyNoise - Update API to new version 3 #911

Merged
merged 10 commits into from
Feb 3, 2021
4 changes: 2 additions & 2 deletions analyzers/GreyNoise/GreyNoise.json
Original file line number Diff line number Diff line change
@@ -1,13 +1,13 @@
{
"name": "GreyNoise",
"version": "2.3",
"version": "3.0",
"author": "Nclose",
"url": "https://github.com/TheHive-Project/Cortex-Analyzers",
"license": "APLv2",
"description": "Determine whether an IP has known scanning activity using GreyNoise.",
"dataTypeList": ["ip"],
"baseConfig": "GreyNoise",
"command": "GreyNoise/greynoise.py",
"command": "GreyNoise/greynoisev3.py",
"configurationItems": [
{
"name": "key",
Expand Down
142 changes: 0 additions & 142 deletions analyzers/GreyNoise/greynoise.py

This file was deleted.

132 changes: 132 additions & 0 deletions analyzers/GreyNoise/greynoisev3.py
Original file line number Diff line number Diff line change
@@ -0,0 +1,132 @@
#!/usr/bin/env python
# -*- coding: utf-8 -*-

from collections import defaultdict, OrderedDict

from cortexutils.analyzer import Analyzer
from greynoise import GreyNoise
import requests


class GreyNoiseAnalyzer(Analyzer):
"""
GreyNoise API docs: https://developer.greynoise.io/reference#noisecontextip-1
"""

def run(self):

if self.data_type == "ip":
api_key = self.get_param('config.key', None)
api_client = GreyNoise(api_key=api_key, timeout=30, integration_name="greynoise-cortex-analyzer-v3.0")
try:
self.report(api_client.ip(self.get_data()))
except Exception as e:
self.error('Unable to query GreyNoise API\n{}'.format(e))
else:
self.notSupported()

def summary(self, raw):
"""
Return two taxonomies

Examples:

Input
{
"seen": True,
"actor": "SCANNER1",
"classification": "benign",
"tags": ['a', 'b', 'c']
}
Output
GreyNoise:tags = 3 (Safe)
GreyNoise:actor = SCANNER1 (Safe)

Input
{
"seen": True,
"actor": "SCANNER1",
"classification": "unknown",
"tags": ['a', 'b', 'c']
}
Output
GreyNoise:tags = 3 (Suspicious)
GreyNoise:classification = unknown (Info)

Input
{
"seen": True,
"actor": "SCANNER1",
"classification": "unknown",
"tags": ['a', 'b']
}
Output
GreyNoise:tags = 2 (Info)
GreyNoise:classification = unknown (Info)

Input
{
"seen": True,
"actor": "SCANNER1",
"classification": "malicious",
"tags": ['a', 'b', 'c']
}
Output
GreyNoise:tags = 3 (Malicious)
GreyNoise:classification = malicious (Malicious)

Input
{
"seen": "False"
}
Output
GreyNoise:Seen last 60 days = False (Info)
"""


classification_level_map = {
'benign': lambda x: 'safe',
'unknown': lambda tag_count: 'info' if (not tag_count) or (tag_count <= 2) else 'suspicious',
'malicious': lambda x: 'malicious'
}

try:
taxonomies = []

seen = raw.get('seen', False)
if seen:
tag_count = len(raw.get('tags', []))
classification = raw.get('classification', 'unknown')
actor = raw.get('actor')

t1_level = classification_level_map.get(classification)(tag_count)
t1_namespace = 'GreyNoise'
t1_predicate = 'tags'
t1_value = tag_count
# print('{}:{} = {} ({})'.format(t1_namespace, t1_predicate, t1_value, t1_level))
taxonomies.append(self.build_taxonomy(t1_level, t1_namespace, t1_predicate, t1_value))

t2_level = classification_level_map.get(classification)(None)
t2_namespace = 'GreyNoise'
t2_predicate = 'actor' if classification == 'benign' else 'classification'
t2_value = actor if classification == 'benign' else classification
# print('{}:{} = {} ({})'.format(t2_namespace, t2_predicate, t2_value, t2_level))
taxonomies.append(self.build_taxonomy(t2_level, t2_namespace, t2_predicate, t2_value))
else:
taxonomies.append(
self.build_taxonomy(
classification_level_map.get('unknown')(None),
'GreyNoise',
'Seen last 60 days',
False
)
)

return {"taxonomies": taxonomies}

except Exception as e:
self.error('Summary failed\n{}'.format(e.message))


if __name__ == '__main__':
GreyNoiseAnalyzer().run()
1 change: 1 addition & 0 deletions analyzers/GreyNoise/requirements.txt
Original file line number Diff line number Diff line change
@@ -1,2 +1,3 @@
cortexutils
requests
greynoise