OTX query does not have actionable intelligence (TheHive-Project#14)

* add IDS detection information * report alerts * return 'No alerts available' when that is the case * only add alerts if they are available * return ids_detections only if available Co-authored-by: Dan Prantl <[email protected]>
viviandsilva · Sep 2, 2021 · e4f245c · e4f245c
1 parent c41d133
commit e4f245c
Showing 1 changed file with 15 additions and 3 deletions.
diff --git a/analyzers/OTXQuery/otxquery.py b/analyzers/OTXQuery/otxquery.py
@@ -102,7 +102,7 @@ def otx_query_file(self, data):
 
             if ip_['analysis']['analysis']:
                 # file has been analyzed before
-                self.report({
+                result = {
                     'pulse_count': ip_.get('general', {}).get('pulse_info', {}).get('count', "0"),
                     'pulses': ip_.get('general', {}).get('pulse_info', {}).get('pulses', "-"),
                     'malware': ip_.get('analysis', {}).get('malware', "-"),
@@ -120,8 +120,20 @@ def otx_query_file(self, data):
                     'filesize': ip_.get('analysis', {}).get('analysis', {}).get('info', {}).get('results', {}).get(
                         'filesize', "-"),
                     'ssdeep': ip_.get('analysis', {}).get('analysis', {}).get('info', {}).get('results', {}).get(
-                        'ssdeep')
-                })
+                        'ssdeep'),
+                }
+                alert_val = ip_.get('analysis', {}).get('analysis', {}).get('plugins', {}).get('cuckoo', {}).get(
+                        'result', {}).get('signatures')
+                if alert_val is not None and len(alert_val) > 0:
+                    result['alerts'] = alert_val
+
+                ids_detections_val = ip_.get('analysis', {}).get('analysis', {}).get('plugins', {}).get('cuckoo', {}).get(
+                        'result', {}).get('suricata', {}).get('rules')
+                if ids_detections_val is not None and len(ids_detections_val) > 0:
+                    result['ids_detections'] = ids_detections_val
+
+                self.report(result)
+
             else:
                 # file has not been analyzed before
                 self.report({