1
1
import hashlib
2
2
import json
3
3
import time
4
+ from io import BytesIO
4
5
from typing import BinaryIO
5
6
6
7
import requests
@@ -227,16 +228,17 @@ def send(cls,
227
228
228
229
@classmethod
229
230
def send_phishing_email (cls ,
230
- raw_email : BinaryIO ,
231
- api : IntezerApiClient = None ,
231
+ raw_email : Optional [ BinaryIO ] = None ,
232
+ api : Optional [ IntezerApiClient ] = None ,
232
233
environment : Optional [str ] = None ,
233
234
default_verdict : Optional [str ] = None ,
234
235
alert_sender : Optional [str ] = None ,
235
236
wait : bool = False ,
236
237
timeout : Optional [int ] = None ,
237
- ):
238
+ email_path : Optional [ str ] = None ):
238
239
"""
239
240
Send an alert for further investigation using the Intezer Analyze API.
241
+ Should pass either raw_email or email_path.
240
242
241
243
:param raw_email: The raw alert data.
242
244
:param api: The API connection to Intezer.
@@ -245,10 +247,16 @@ def send_phishing_email(cls,
245
247
:param alert_sender: The sender of the alert.
246
248
:param wait: Wait for the alert to finish processing before returning.
247
249
:param timeout: The timeout for the wait operation.
250
+ :param email_path: The path to the email file.
248
251
:raises: :class:`requests.HTTPError` if the request failed for any reason.
249
252
:return: The Alert instance, initialized with the alert id. when the `wait` parameter is set to True, the
250
253
resulting alert object will be initialized with the alert triage data.
251
254
"""
255
+ if not raw_email and not email_path :
256
+ raise ValueError ('raw_email or email_path must be provided' )
257
+ if email_path :
258
+ with open (email_path , 'rb' ) as email_file :
259
+ raw_email = BytesIO (email_file .read ())
252
260
_api = IntezerApi (api or get_global_api ())
253
261
if not bool (raw_email .getvalue ()):
254
262
raise ValueError ('alert cannot be empty' )
0 commit comments