3
@6^$                 @   sP   d dl Z d dlmZ d dlZd dlmZ d dlmZmZmZ G dd deZ	dS )    N)datetime)	IPNetwork)
SpiderFootSpiderFootPluginSpiderFootEventc            	   @   sr   e Zd ZdZdddddddddZdd	d
ddddddZdZdZe fddZ	dd Z
dd Zdd Zdd ZdS )sfp_alienvaultzzAlienVault OTX:Investigate,Passive:Reputation Systems:apikey:Obtain information from AlienVault Open Threat Exchange (OTX)       T   )api_keyage_limit_daysthreat_score_minnetblocklookupmaxnetblocksubnetlookup	maxsubnetcheckaffiliateszAlienVault OTX API Key.z<Ignore any records older than this many days. 0 = unlimited.z Minimum AlienVault threat score.zLook up all IPs on netblocks deemed to be owned by your target for possible blacklisted hosts on the same target subdomain/domain?zyIf looking up owned netblocks, the maximum netblock size to look up all IPs within (CIDR value, 24 = /24, 16 = /16, etc.)zKLook up all IPs on subnets which your target is a part of for blacklisting?zsIf looking up subnets, the maximum subnet size to look up all the IPs within (CIDR value, 24 = /24, 16 = /16, etc.)zApply checks to affiliates?NFc             C   s8   || _ | j | _x"t|j D ]}|| | j|< qW d S )N)sftempStorageresultslistkeysopts)selfsfcuserOptsopt r   9/var/www/spiderfoot.crq.systems/modules/sfp_alienvault.pysetup4   s    
zsfp_alienvault.setupc             C   s   ddddgS )N
IP_ADDRESSAFFILIATE_IPADDRNETBLOCK_OWNERNETBLOCK_MEMBERr   )r   r   r   r   watchedEvents?   s    zsfp_alienvault.watchedEventsc             C   s
   dddgS )NMALICIOUS_IPADDRMALICIOUS_AFFILIATE_IPADDRZMALICIOUS_NETBLOCKr   )r   r   r   r   producedEventsD   s    zsfp_alienvault.producedEventsc       
      C   s
  d }d}d|krd}| j j|r$d}|dkr0d}d| d | d | }d	| jd
 d}| j j|| jd d|d}|d dkr| j jdd d| _d S |d d ks|d dkr| j jd|  d S ytj|d }W n0 t	k
r }	 z| j jdd d S d }	~	X nX |S )Nhostname:IPv6IPv4passive_dns
reputationz1https://otx.alienvault.com:443/api/v1/indicators//zapplication/jsonr   )AcceptzX-OTX-API-KEY_fetchtimeoutr   )timeout	useragentheaderscodeZ403zcAlienVault OTX API key seems to have been rejected or you have exceeded usage limits for the month.FTcontentZ404z!No AlienVault OTX info found for z3Error processing JSON response from AlienVault OTX.)r-   r.   )
r   validIPr   fetchUrlerror
errorStateinfojsonloads	Exception)
r   qryZ	querytyperetZ
targettypeurlr4   resr;   er   r   r   queryG   s4    
zsfp_alienvault.queryc             C   s  |j }|j}|j}| jrd S | jjd| d |  | jd dkrZ| jjdd d| _d S || jkr|| jjd| d	  d S d| j|< |d
kr| jd sd S t	|j
| jd k r| jjdtt	|j
 d t| jd   d S |dko| jjdd  rd S |dkr^| jd sd S t	|j
| jd k r^| jjdtt	|j
 d t| jd   d S t }|jdrx:t	|D ]"}|jt| d| jt|< qzW n
|j| |dkrd}| j|d}|d kr| jjd|  nd|kr| jjd |d }	x|	D ]}
d|
kr|
d }yr|
jdd}tj|d}ttj|j }ttj d| jd   }| jd d kr||k r| jjd! wW n0 tk
r } z| jjd" W Y d d }~X nX t||| j|}| j| qW x|D ]}| j rd S |dks|jdrd#}|dkr$d$}| j|d%}
|
d k	r|
jd%d r| jjd& |
d% jd't }|
d% d( | jd) k rqd*t|
d% d(  d+ }x|D ]}|jd,d }|d ks||krȐq|d-| 7 }|jd.d}yftj|d/}ttj|j }ttj d| jd   }| jd d krD||k rD| jjd! wW n0 tk
rv } z| jjd" W Y d d }~X nX qW t||| j|}| j| qW d S )0NzReceived event, z, from r   r   z?You enabled sfp_alienvault but did not set an API key/password!FTz	Skipping z as already mapped.r#   r   r   z$Network size bigger than permitted: z > r"   r   r$   r   r   Z	NETBLOCK_r!   CO_HOSTED_SITEZ
passve_dnszNo Passive DNS info for z+Found passive DNS results in AlienVault OTXr-   r)   lastz%Y-%m-%d %H:%M:%SiQ r   r   z#Record found but too old, skipping.z8Couldn't parse date from AlienVault so assuming it's OK.r&   r'   r.   z'Found reputation info in AlienVault OTXZ
activitiesZthreat_scorer   zAlienVault Threat Score: r*   namez
 - Z	last_datez%Y-%m-%dT%H:%M:%S)	eventTypemoduledatar:   r   debugr   r9   r   r   	prefixlenstrgetr   
startswithappendrD   r;   r   strptimeinttimemktime	timetupleBaseExceptionr   __name__notifyListenerscheckForStop)r   event	eventNamesrcModuleName	eventDataZqrylistipaddrevtTyper@   rB   rechostrF   Zlast_dtZlast_tsZage_limit_tsrC   addrZrec_historydescrresultnmcreatedZ
created_dtZ
created_tsr   r   r   handleEventp   s    













$zsfp_alienvault.handleEvent)rW   
__module____qualname____doc__r   optdescsr   r:   dictr    r%   r(   rD   rg   r   r   r   r   r      s0   )r   )
r<   r   rS   netaddrr   sflibr   r   r   r   r   r   r   r   <module>   s
   