U
    @6^$                     @   sP   d dl Z d dlmZ d dlZd dlmZ d dlmZmZmZ G dd deZ	dS )    N)datetime)	IPNetwork)
SpiderFootSpiderFootPluginSpiderFootEventc                	   @   sr   e Zd ZdZdddddddddZdd	d
ddddddZdZdZe fddZ	dd Z
dd Zdd Zdd ZdS )sfp_alienvaultzzAlienVault OTX:Investigate,Passive:Reputation Systems:apikey:Obtain information from AlienVault Open Threat Exchange (OTX)       T   )api_keyage_limit_daysthreat_score_minnetblocklookupmaxnetblocksubnetlookup	maxsubnetcheckaffiliateszAlienVault OTX API Key.z<Ignore any records older than this many days. 0 = unlimited.z Minimum AlienVault threat score.zLook up all IPs on netblocks deemed to be owned by your target for possible blacklisted hosts on the same target subdomain/domain?zyIf looking up owned netblocks, the maximum netblock size to look up all IPs within (CIDR value, 24 = /24, 16 = /16, etc.)zKLook up all IPs on subnets which your target is a part of for blacklisting?zsIf looking up subnets, the maximum subnet size to look up all the IPs within (CIDR value, 24 = /24, 16 = /16, etc.)zApply checks to affiliates?NFc                 C   s4   || _ |  | _t| D ]}|| | j|< qd S )N)sftempStorageresultslistkeysopts)selfsfcuserOptsopt r   9/var/www/spiderfoot.crq.systems/modules/sfp_alienvault.pysetup4   s    
zsfp_alienvault.setupc                 C   s   ddddgS )N
IP_ADDRESSAFFILIATE_IPADDRNETBLOCK_OWNERNETBLOCK_MEMBERr   r   r   r   r   watchedEvents?   s     zsfp_alienvault.watchedEventsc                 C   s
   dddgS )NMALICIOUS_IPADDRMALICIOUS_AFFILIATE_IPADDRZMALICIOUS_NETBLOCKr   r%   r   r   r   producedEventsD   s    zsfp_alienvault.producedEventsc           
   
   C   s  d }d}d|krd}| j |r$d}|dkr0d}d| d | d | }d	| jd
 d}| j j|| jd d|d}|d dkr| j dd d| _d S |d d ks|d dkr| j d|  d S zt|d }W n8 t	k
r }	 z| j dd W Y d S d }	~	X Y nX |S )Nhostname:IPv6IPv4)passive_dns
reputationr/   z1https://otx.alienvault.com:443/api/v1/indicators//zapplication/jsonr   )AcceptzX-OTX-API-KEY_fetchtimeoutr   )timeout	useragentheaderscodeZ403zcAlienVault OTX API key seems to have been rejected or you have exceeded usage limits for the month.FTcontentZ404z!No AlienVault OTX info found for z3Error processing JSON response from AlienVault OTX.)
r   validIPr   fetchUrlerror
errorStateinfojsonloads	Exception)
r   qryZ	querytyperetZ
targettypeurlr5   resr<   er   r   r   queryG   sJ     zsfp_alienvault.queryc                 C   s  |j }|j}|j}| jrd S | jd| d |  | jd dkrZ| jdd d| _d S || jkr|| jd| d	  d S d| j|< |d
kr| jd sd S t	|j
| jd k r| jdtt	|j
 d t| jd   d S |dkr| jddsd S |dkrZ| jd sd S t	|j
| jd k rZ| jdtt	|j
 d t| jd   d S t }|drt	|D ]"}|t| d| jt|< qtn
|| |dkrd}| |d}|d kr| jd|  nd|kr| jd |d }	|	D ]}
d|
kr|
d }zt|
dd}t|d}tt| }tt d| jd   }| jd d kr||k r| jd! W qW n0 tk
r } z| jd" W 5 d }~X Y nX t||| j|}| | q|D ]}|  r d S |dks|dr
d#}|dkrd$}| |d%}
|
d k	r|
d%d r| jd& |
d% d't }|
d% d( | jd) k rvqd*t|
d% d(  d+ }|D ]}|d,d }|d ks||krq|d-| 7 }|d.d}zht|d/}tt| }tt d| jd   }| jd d kr8||k r8| jd! W qW n0 tk
rj } z| jd" W 5 d }~X Y nX qt||| j|}| | qd S )0NzReceived event, z, from r   r   z?You enabled sfp_alienvault but did not set an API key/password!FTz	Skipping z as already mapped.r#   r   r   z$Network size bigger than permitted: z > r"   r   r$   r   r   Z	NETBLOCK_r!   CO_HOSTED_SITEZ
passve_dnszNo Passive DNS info for z+Found passive DNS results in AlienVault OTXr.   r*   lastz%Y-%m-%d %H:%M:%SiQ r   r   z#Record found but too old, skipping.z8Couldn't parse date from AlienVault so assuming it's OK.r'   r(   r/   z'Found reputation info in AlienVault OTXZ
activitiesZthreat_scorer   zAlienVault Threat Score: r+   namez
 - Z	last_datez%Y-%m-%dT%H:%M:%S)	eventTypemoduledatar;   r   debugr   r:   r   r   	prefixlenstrgetr   
startswithappendrE   r<   r   strptimeinttimemktime	timetupleBaseExceptionr   __name__notifyListenerscheckForStop)r   event	eventNamesrcModuleName	eventDataZqrylistipaddrevtTyperA   rC   rechostrG   Zlast_dtZlast_tsZage_limit_tsrD   addrZrec_historydescrresultnmcreatedZ
created_dtZ
created_tsr   r   r   handleEventp   s    














"zsfp_alienvault.handleEvent)rX   
__module____qualname____doc__r   optdescsr   r;   dictr    r&   r)   rE   rh   r   r   r   r   r      s4   )r   )
r=   r   rT   netaddrr   sflibr   r   r   r   r   r   r   r   <module>   s
   