valitydev/Cortex-Analyzers
14
0
Fork 0
mirror of https://github.com/valitydev/Cortex-Analyzers.git synced 2024-11-08 01:48:53 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

#56 fixed format of summary() output and short reports

Browse Source
This commit is contained in:
Jerome Leonard 2017-06-16 00:22:33 +02:00
parent aa70b8fc23
commit ee2bf0c973
9 changed files with 32 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
analyzers/CERTatPassiveDNS/certat_passivedns.py
View File

@ -22,16 +22,19 @@ class CERTatPassiveDNSAnalyzer(Analyzer):
return {'hits': len(results)}
def summary(self, raw):
result = {"level":"info", "taxonomy":{"namespace": "CERT.at", "predicate": "PassiveDNS", "value":0}}
taxonomy = {"level":"info", "namespace": "CERT.at", "predicate": "PassiveDNS", "value":0}
taxonomies = []
results = raw.get('results')
r = len(results)
if r == 0 or r == 1:
result["taxonomy"]["value"] = "\"{} hit\"".format(r)
taxonomy["value"] = "\"{} hit\"".format(r)
else:
result["taxonomy"]["value"] = "\"{} hits\"".format(r)
taxonomy["value"] = "\"{} hits\"".format(r)
taxonomies.append(taxonomy)
result = {"taxonomies": taxonomies}
return result

10
analyzers/CIRCLPassiveDNS/circl_passivedns.py
View File

@ -38,17 +38,19 @@ class CIRCLPassiveDNSAnalyzer(Analyzer):
def summary(self, raw):
result = {"level": "info", "taxonomy": {"namespace": "CIRCL", "predicate": "PassiveDNS", "value": 0}}
taxonomy = {"level": "info", "namespace": "CIRCL", "predicate": "PassiveDNS", "value": 0}
taxonomies = []
if ("results" in raw):
r = len(raw.get('results'))
if r == 0 or r == 1:
result["taxonomy"]["value"] = "\"{} hit\"".format(r)
taxonomy["value"] = "\"{} hit\"".format(r)
else:
result["taxonomy"]["value"] = "\"{} hits\"".format(r)
taxonomy["value"] = "\"{} hits\"".format(r)
taxonomies.append(taxonomy)
result = {"taxonomies": taxonomies}
return result

9
analyzers/CIRCLPassiveSSL/circl_passivessl.py
View File

@ -68,7 +68,8 @@ class CIRCLPassiveSSLAnalyzer(Analyzer):
def summary(self, raw):
result = {"level": "info", "taxonomy": {"namespace": "CIRCL", "predicate": "PassiveSSL", "value": 0}}
taxonomy = {"level": "info", "namespace": "CIRCL", "predicate": "PassiveSSL", "value": 0}
taxonomies = []
if (self.data_type == 'hash') and ("query" in raw):
r = raw.get('query', 0).get('hits', 0)
@ -76,10 +77,12 @@ class CIRCLPassiveSSLAnalyzer(Analyzer):
r = len(raw['certificates'])
if r == 0 or r == 1:
result["taxonomy"]["value"] = "\"{} hit\"".format(r)
taxonomy["value"] = "\"{} hit\"".format(r)
else:
result["taxonomy"]["value"] = "\"{} hits\"".format(r)
taxonomy["value"] = "\"{} hits\"".format(r)
taxonomies.append(taxonomy)
result = {"taxonomies": taxonomies}
return result

10
analyzers/DNSDB/dnsdb.py
View File

@ -40,15 +40,19 @@ class DnsDbAnalyzer(Analyzer):
return row
def summary(self, raw):
result = {"level": "info", "taxonomy": {"namespace": "Farsight", "predicate": "DNSDB", "value": 0}}
taxonomy = {"level": "info", "namespace": "Farsight", "predicate": "DNSDB", "value": 0}
taxonomies = []
if ("records" in raw):
r = len(raw["records"])
if r == 0 or r == 1:
result["taxonomy"]["value"] = "\"{} record\"".format(r)
taxonomy["value"] = "\"{} record\"".format(r)
else:
result["taxonomy"]["value"] = "\"{} records\"".format(r)
taxonomy["value"] = "\"{} records\"".format(r)
taxonomies.append(taxonomy)
result = {'taxonomies': taxonomies}
return result

4
thehive-templates/CERTatPassiveDNS_1_0/short.html
View File

@ -1,3 +1,3 @@
<span class="label" ng-init="t = content.taxonomy" ng-class="{'info': 'label-info', 'safe': 'label-success', 'suspicious': 'label-warning', 'malicious':'label-danger'}[content.level]">
<span class="label" ng-repeat="t in content.taxonomies" ng-class="{'info': 'label-info', 'safe': 'label-success', 'suspicious': 'label-warning', 'malicious':'label-danger'}[t.level]">
{{t.namespace}}:{{t.predicate}}={{t.value}}
</span>
</span>&nbsp;

2
thehive-templates/CIRCLPassiveDNS_1_0/short.html
View File

@ -1,3 +1,3 @@
<span class="label" ng-init="t = content.taxonomy" ng-class="{'info': 'label-info', 'safe': 'label-success', 'suspicious': 'label-warning', 'malicious':'label-danger'}[content.level]">
<span class="label" ng-repeat="t in content.taxonomies" ng-class="{'info': 'label-info', 'safe': 'label-success', 'suspicious': 'label-warning', 'malicious':'label-danger'}[t.level]">
{{t.namespace}}:{{t.predicate}}={{t.value}}
</span>&nbsp;

2
thehive-templates/CIRCLPassiveSSL_1_0/short.html
View File

@ -1,3 +1,3 @@
<span class="label" ng-init="t = content.taxonomy" ng-class="{'info': 'label-info', 'safe': 'label-success', 'suspicious': 'label-warning', 'malicious':'label-danger'}[content.level]">
<span class="label" ng-repeat="t in content.taxonomies" ng-class="{'info': 'label-info', 'safe': 'label-success', 'suspicious': 'label-warning', 'malicious':'label-danger'}[t.level]">
{{t.namespace}}:{{t.predicate}}={{t.value}}
</span>&nbsp;

2
thehive-templates/DNSDB_IPHistory_1_0/short.html
View File

@ -1,3 +1,3 @@
<span class="label" ng-init="t = content.taxonomy" ng-class="{'info': 'label-info', 'safe': 'label-success', 'suspicious': 'label-warning', 'malicious':'label-danger'}[content.level]">
<span class="label" ng-repeat="t in content.taxonomies" ng-class="{'info': 'label-info', 'safe': 'label-success', 'suspicious': 'label-warning', 'malicious':'label-danger'}[t.level]">
{{t.namespace}}:{{t.predicate}}={{t.value}}
</span>&nbsp;

2
thehive-templates/DNSDB_NameHistory_1_0/short.html
View File

@ -1,3 +1,3 @@
<span class="label" ng-init="t = content.taxonomy" ng-class="{'info': 'label-info', 'safe': 'label-success', 'suspicious': 'label-warning', 'malicious':'label-danger'}[content.level]">
<span class="label" ng-repeat="t in content.taxonomies" ng-class="{'info': 'label-info', 'safe': 'label-success', 'suspicious': 'label-warning', 'malicious':'label-danger'}[t.level]">
{{t.namespace}}:{{t.predicate}}={{t.value}}
</span>&nbsp;