valitydev/Cortex-Analyzers
14
0
Fork 0
mirror of https://github.com/valitydev/Cortex-Analyzers.git synced 2024-11-08 01:48:53 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

#56 fixed format of summary() output and short reports

Browse Source
This commit is contained in:
Jerome Leonard 2017-06-16 00:25:10 +02:00
parent ee2bf0c973
commit ee94e1ef92
2 changed files with 9 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
analyzers/GoogleSafebrowsing/safebrowsing_analyzer.py
View File

@ -21,20 +21,23 @@ class SafebrowsingAnalyzer(Analyzer):
def summary(self, raw): def summary(self, raw):
result = {"level":"info", "taxonomy":{"namespace": "Google", "predicate": "Safebrowsing", "value":0}} taxonomy = {"level":"info", "namespace": "Google", "predicate": "Safebrowsing", "value":0}
taxonomies = []
if ("results" in raw): if ("results" in raw):
r = len(raw['results']) r = len(raw['results'])
if r == 0 or r == 1: if r == 0 or r == 1:
result["taxonomy"]["value"] = "\"{} match\"".format(r) taxonomy["value"] = "\"{} match\"".format(r)
else: else:
result["taxonomy"]["value"] = "\"{} matches\"".format(r) taxonomy["value"] = "\"{} matches\"".format(r)
if r > 0: if r > 0:
result["level"] = "malicious" taxonomy["level"] = "malicious"
# level : info, safe, suspicious, malicious # level : info, safe, suspicious, malicious
taxonomies.append(taxonomy)
result = {"taxonomies": taxonomies}
return result return result
def run(self): def run(self):

4
thehive-templates/GoogleSafebrowsing_1_0/short.html
View File

@ -1,3 +1,3 @@
<span class="label" ng-init="t = content.taxonomy" ng-class="{'info': 'label-info', 'safe': 'label-success', 'suspicious': 'label-warning', 'malicious':'label-danger'}[content.level]"> <span class="label" ng-repeat="t in content.taxonomies" ng-class="{'info': 'label-info', 'safe': 'label-success', 'suspicious': 'label-warning', 'malicious':'label-danger'}[t.level]">
{{t.namespace}}:{{t.predicate}}={{t.value}} {{t.namespace}}:{{t.predicate}}={{t.value}}
</span> </span>&nbsp;