Update GreyNoise Analyzer

analyzers/GreyNoise/GreyNoise.json

@@ -1,6 +1,6 @@
 {
   "name": "GreyNoise",
-  "version": "3.0",
+  "version": "3.1",
   "author": "Nclose",
   "url": "https://github.com/TheHive-Project/Cortex-Analyzers",
   "license": "APLv2",
@@ -15,6 +15,13 @@
       "type": "string",
       "multi": false,
       "required": false
+    },
+    {
+      "name": "api_type",
+      "description": "API Type to Match Key, either 'enterprise' or 'community'",
+      "type": "string",
+      "multi": false,
+      "required": false
     }
   ],
   "config": {
@@ -33,7 +40,7 @@
   "screenshots": [
     {
       "path": "assets/long_report.png",
-      "caption": "Greynoise: long report"
+      "caption": "GreyNoise: long report"
     }
   ]
 }

analyzers/GreyNoise/README.md

@@ -1,9 +1,14 @@
 ### GreyNoise 
-[GreyNoise](https://viz.greynoise.io/) collect and analyze untargeted, widespread, and opportunistic scan and attack activity that reaches every server directly connected to the Internet. Mass scanners (such as Shodan and Censys), search engines, bots, worms, and crawlers generate logs and events omnidirectionally on every IP address in the IPv4 space. GreyNoise gives you the ability to filter this useless noise out.
+[GreyNoise](https://viz.greynoise.io/) collect and analyze untargeted, widespread, and opportunistic scan and attack 
+activity that reaches every server directly connected to the Internet. Mass scanners (such as Shodan and Censys), 
+search engines, bots, worms, and crawlers generate logs and events omnidirectionally on every IP address in the IPv4 
+space. GreyNoise gives you the ability to filter this useless noise out.
 
-The analyzer comes in a single flavour that will return greynoise additional information categorization for provided ip.
+The analyzer comes in a single flavour, but supports both the GreyNoise Paid and Community APIs, that will return 
+GreyNoise additional information categorization for provided ip.
 
 #### Requirements
-You need a valid GreyNoise API integration subscription to use the analyzer.
+You need a valid GreyNoise API integration subscription or Community account to use the analyzer.
 
-- Provide your API key as values for the `key` parameter.
+- Provide your API key as values for the `key` parameter.
+- Provide your API key type as "enterprise" (the default) or "community" for the `api_type` parameter

analyzers/GreyNoise/greynoisev3.py

@@ -1,26 +1,34 @@
 #!/usr/bin/env python3
 # -*- coding: utf-8 -*-
 
-from collections import defaultdict, OrderedDict
-
 from cortexutils.analyzer import Analyzer
 from greynoise import GreyNoise
 
 
 class GreyNoiseAnalyzer(Analyzer):
     """
     GreyNoise API docs: https://developer.greynoise.io/reference#noisecontextip-1
+    GreyNoise Community API Reference: https://developer.greynoise.io/reference/community-api
     """
 
     def run(self):
 
         if self.data_type == "ip":
             api_key = self.get_param("config.key", None)
-            api_client = GreyNoise(
-                api_key=api_key,
-                timeout=30,
-                integration_name="greynoise-cortex-analyzer-v3.0",
-            )
+            api_type = self.get_param("config.api_type", None)
+            if api_type and api_type.lower() == "community":
+                api_client = GreyNoise(
+                    api_key=api_key,
+                    timeout=30,
+                    integration_name="greynoise-cortex-analyzer-v3.1",
+                    offering="community",
+                )
+            else:
+                api_client = GreyNoise(
+                    api_key=api_key,
+                    timeout=30,
+                    integration_name="greynoise-cortex-analyzer-v3.1",
+                )
             try:
                 self.report(api_client.ip(self.get_data()))
             except Exception as e:
@@ -98,6 +106,8 @@ def summary(self, raw):
             taxonomies = []
 
             seen = raw.get("seen", False)
+            noise = raw.get("noise", False)
+            riot = raw.get("riot", False)
             if seen:
                 tag_count = len(raw.get("tags", []))
                 classification = raw.get("classification", "unknown")
@@ -107,7 +117,8 @@ def summary(self, raw):
                 t1_namespace = "GreyNoise"
                 t1_predicate = "tags"
                 t1_value = tag_count
-                # print('{}:{} = {} ({})'.format(t1_namespace, t1_predicate, t1_value, t1_level))
+                # print('{}:{} = {} ({})'.format(t1_namespace, t1_predicate,
+                #                               t1_value, t1_level))
                 taxonomies.append(
                     self.build_taxonomy(t1_level, t1_namespace, t1_predicate, t1_value)
                 )
@@ -118,16 +129,46 @@ def summary(self, raw):
                     "actor" if classification == "benign" else "classification"
                 )
                 t2_value = actor if classification == "benign" else classification
-                # print('{}:{} = {} ({})'.format(t2_namespace, t2_predicate, t2_value, t2_level))
+                # print('{}:{} = {} ({})'.format(t2_namespace, t2_predicate,
+                #                               t2_value, t2_level))
+                taxonomies.append(
+                    self.build_taxonomy(t2_level, t2_namespace, t2_predicate, t2_value)
+                )
+            elif noise or riot:
+                classification = raw.get("classification", "unknown")
+                name = raw.get("name")
+                t1_level = classification_level_map.get(classification)(None)
+                t1_namespace = "GreyNoise Community"
+                t1_predicate = "classification"
+                t1_value = classification
+                # print('{}:{} = {} ({})'.format(t1_namespace, t1_predicate, t1_value))
+                taxonomies.append(
+                    self.build_taxonomy(t1_level, t1_namespace, t1_predicate, t1_value)
+                )
+                t2_level = classification_level_map.get(classification)(None)
+                t2_namespace = "GreyNoise Community"
+                t2_predicate = "Name"
+                t2_value = name
+                # print('{}:{} = {} ({})'.format(t2_namespace, t2_predicate,
+                #                               t2_value, t2_level))
                 taxonomies.append(
                     self.build_taxonomy(t2_level, t2_namespace, t2_predicate, t2_value)
                 )
+                t3_level = classification_level_map.get(classification)(None)
+                t3_namespace = "GreyNoise Community"
+                t3_predicate = "Type"
+                t3_value = "Benign Service" if riot else "Internet Noise"
+                # print('{}:{} = {} ({})'.format(t3_namespace, t3_predicate,
+                #                                  t3_value, t3_level))
+                taxonomies.append(
+                    self.build_taxonomy(t3_level, t3_namespace, t3_predicate, t3_value)
+                )
             else:
                 taxonomies.append(
                     self.build_taxonomy(
                         classification_level_map.get("unknown")(None),
                         "GreyNoise",
-                        "Seen last 60 days",
+                        "IP observed scanning the internet in the last 90 days",
                         False,
                     )
                 )

analyzers/GreyNoise/requirements.txt

@@ -1,2 +1,2 @@
 cortexutils
-greynoise
+greynoise>=0.8.0

thehive-templates/GreyNoise_3_1/long.html

@@ -0,0 +1,86 @@
+<div class="panel panel-info" ng-if="success">
+    <div class="panel-heading">
+        GreyNoise results for <strong>{{artifact.data}}</strong>
+    </div>
+    <div class="panel-body">
+        <table class="table" ng-if="content.seen">
+            <thead>
+                <th>Classification</th>
+                <th>Last Seen</th>
+                <th>Actor</th>
+                <th>CVE(s)</th>
+                <th>Tag(s)</th>
+            </thead>
+            <tbody>
+                <tr>
+                    <td>{{content.classification}}</td>
+                    <td>{{content.last_seen}}</td>
+                    <td>{{content.actor}}</td>
+                    <td>{{content.cve.join(', ')}}</td>
+                    <td>{{content.tags.join(' ,')}}</td>
+                </tr>
+                <tr>
+                    <td colspan="5">
+                        Metadata:
+                        <pre>{{content.metadata | json}}</pre>
+                    </td>
+                </tr>
+                <tr>
+                    <td colspan="5">
+                        <a target="_blank" href="https://viz.greynoise.io/ip/{{content.ip}}">Click here for more details on the GreyNoise Visualizer.</a>
+                    </td>
+                </tr>
+            </tbody>
+        </table>
+
+        <table class="table" ng-if="content.noise">
+            <thead>
+                <th>Classification</th>
+                <th>Last Updated</th>
+                <th>Name</th>
+            </thead>
+            <tbody>
+                <tr>
+                    <td>{{content.classification}}</td>
+                    <td>{{content.last_seen}}</td>
+                    <td>{{content.name}}</td>
+                </tr>
+                <tr ng-if="content.noise">
+                    <td colspan="5">
+                        <a target="_blank" href="https://viz.greynoise.io/ip/{{content.ip}}">Click here for more details on the GreyNoise Visualizer (Noise Info).</a>
+                    </td>
+                </tr>
+            </tbody>
+        </table>
+        <table class="table" ng-if="content.riot">
+            <thead>
+                <th>Classification</th>
+                <th>Last Updated</th>
+                <th>Name</th>
+            </thead>
+            <tbody>
+                <tr>
+                    <td>{{content.classification}}</td>
+                    <td>{{content.last_seen}}</td>
+                    <td>{{content.name}}</td>
+                </tr>
+                <tr>
+                    <td colspan="5">
+                        <a target="_blank" href="https://viz.greynoise.io/riot/{{content.ip}}">Click here for more details on the GreyNoise Visualizer (RIOT Info).</a>
+                    </td>
+                </tr>
+            </tbody>
+        </table>
+    <p ng-if="!content">No records found for {{artifact.data}}.</p>
+    </div>
+</div>
+
+<!-- General error -->
+<div class="panel panel-danger" ng-if="!success">
+    <div class="panel-heading">
+        <strong>{{(artifact.data || artifact.attachment.name) | fang}}</strong>
+    </div>
+    <div class="panel-body">
+        {{content.errorMessage}}
+    </div>
+</div>