Analyzer for DNS Lookingglass

analyzers/DNSLookingglass/DNSLookingglass.json

@@ -0,0 +1,32 @@
+{
+  "name": "DNS_Lookingglass",
+  "version": "1.0",
+  "author": "Dennis Perto, Conscia",
+  "url": "https://github.com/xme/thehive/Cortex-Analyzers",
+  "license": "AGPL-V3",
+  "description": "Query the SANS ISC Global DNS Lookingglass API to check a domain name for resolved IP addresses.",
+  "dataTypeList": ["domain", "fqdn"],
+  "command": "DNSLookingglass/DNSLookingglass_lookup.py",
+  "baseConfig": "DNSLookingglass.json",
+  "config": {
+    "service": "query"
+  },
+  "registration_required": false,
+  "subscription_required": false,
+  "free_subscription": false,
+  "service_homepage": "https://isc.sans.edu/",
+  "service_logo": {
+    "path": "assets/dshield.png",
+    "caption": "logo"
+  },
+  "screenshots": [
+    {
+      "path": "assets/DNS_Lookingglass_long.png",
+      "caption": "DNS Lookingglass: Long report template"
+    },
+    {
+      "path": "assets/DNS_Lookingglass_artifacts.png",
+      "caption": "DNS Lookingglass: artifacts"
+    }
+  ]
+}

analyzers/DNSLookingglass/DNSLookingglass_lookup.py

@@ -0,0 +1,86 @@
+#!/usr/bin/env python3
+# encoding: utf-8
+import json
+import requests
+import iocextract
+from cortexutils.analyzer import Analyzer
+
+class DNSLookingglassAnalyzer(Analyzer):
+    def __init__(self):
+        Analyzer.__init__(self)
+
+    def lookingglass_checkdomain(self, data):
+        url = 'https://isc.sans.edu/api/dnslookup/%s?json' % data
+        r = requests.get(url)
+
+        return json.loads(r.text)
+
+    def artifacts(self, raw):
+        artifacts = []
+        ipv4s = list(iocextract.extract_ipv4s(str(raw)))
+        ipv6s = list(iocextract.extract_ipv6s(str(raw)))
+
+        if ipv4s:
+            ipv4s = list(dict.fromkeys(ipv4s))
+            for i in ipv4s:
+                artifacts.append(self.build_artifact('ip',str(i)))
+
+        if ipv6s:
+            ipv6s = list(dict.fromkeys(ipv6s))
+            for j in ipv6s:
+                artifacts.append(self.build_artifact('ip',str(j)))
+
+        return artifacts
+
+    def summary(self, raw):
+        taxonomies = []
+        level = "info"
+        namespace = "Lookingglass"
+        predicate = "ERR"
+        value = "-"
+
+        value = "{} hit(s)".format(raw['count'])
+        predicate = raw['hits']
+
+        taxonomies.append(self.build_taxonomy(level, namespace, predicate, value))
+
+        return {"taxonomies": taxonomies}
+
+    def get_hits(self, hits):
+        if hits == 0:
+            return("NXDOMAIN")
+        elif hits >= 1:
+            return("DomainExist")
+        else:
+            return("Error")
+
+    def run(self):
+        if self.data_type in ['domain', 'fqdn']:
+            data = self.get_param('data', None, 'Domain is missing')
+            r = self.lookingglass_checkdomain(data)
+
+            results = dict()
+            results['results'] = list()
+
+            if len(r) != 0:
+                for hit in r:
+                    result = dict()
+                    try:
+                        result['answer'] = hit['answer']
+                        result['status'] = hit['status']
+                        result['country'] = hit['country']
+                        results['results'].append(result)
+                    except KeyError:
+                        pass
+
+                results['hits'] = self.get_hits(int(len(results['results'])))
+                results['count'] = int(len(results['results']))
+
+                self.report(results)
+            else:
+                self.error('No domain found')
+        else:
+            self.error('Invalid data type')
+
+if __name__ == '__main__':
+    DNSLookingglassAnalyzer().run()

analyzers/DNSLookingglass/README.md

@@ -0,0 +1,6 @@
+#### DNS Lookingglass Analyzer
+Lookup domain names from different locations using the ISC SANS [DNS Lookingglass](https://www.dshield.org/tools/dnslookup.html) API service.
+
+
+##### Requirements
+There is no requirements to use this analyzer. 

analyzers/DNSLookingglass/requirements.txt

@@ -0,0 +1,3 @@
+cortexutils
+requests
+iocextract

analyzers/Splunk/requirements.txt

@@ -1 +1,2 @@
 splunk-sdk
+cortexutils

thehive-templates/DNS_Lookingglass_1_0/long.html

@@ -0,0 +1,39 @@
+<div class="panel panel-info" ng-if="success">
+    <div class="panel panel-info" ng-if="content.results">
+        <div class="panel-heading">
+            <strong>Results</strong> (from {{content.count}} locations)
+        </div>
+        <div class="panel-body" style="display:block;height:750px;overflow:auto;">
+            <table class="table table-hover table-striped">
+                <thead>
+                    <th>Lookup from country</th>
+                    <th>Lookup status</th>
+                    <th>Lookup answer</th>
+                </thead>
+                <tbody>
+                    <tr ng-repeat="hit in content.results track by $index">
+                        <td>
+                            {{hit.country.toString()}}
+                        </td>
+                        <td style="overflow:auto">
+                            {{hit.status.toString()}}
+                        </td>
+                        <td style="overflow:auto">
+                            {{hit.answer.toString()}}
+                        </td>
+                    </tr>
+                </tbody>
+            </table>
+        </div>
+    </div>
+</div>
+
+<!-- General error  -->
+<div class="panel panel-danger" ng-if="!success">
+    <div class="panel-heading">
+        <strong>{{(artifact.data || artifact.attachment.name) | fang}}</strong>
+    </div>
+    <div class="panel-body">
+        {{content.errorMessage}}
+    </div>
+</div>

thehive-templates/DNS_Lookingglass_1_0/short.html

@@ -0,0 +1,3 @@
+<span class="label" ng-repeat="t in content.taxonomies" ng-class="{'info': 'label-info', 'safe': 'label-success', 'suspicious': 'label-warning', 'malicious':'label-danger'}[t.level]">
+    {{t.namespace}}:{{t.predicate}}="{{t.value}}"
+</span>