3
@6^|                  @   sP   d dl Z d dlmZ d dlZd dlmZ d dlmZmZmZ G dd deZ	dS )    N)datetime)	IPNetwork)
SpiderFootSpiderFootPluginSpiderFootEventc               @   sj   e Zd ZdZdddddddZddd	d
dddZdZdZe fddZ	dd Z
dd Zdd Zdd ZdS )sfp_greynoiseznGreynoise:Investigate,Passive:Reputation Systems:apikey:Obtain information from Greynoise.io's Enterprise API.    T   )api_keyage_limit_daysnetblocklookupmaxnetblocksubnetlookup	maxsubnetzGreynoise API Key.z<Ignore any records older than this many days. 0 = unlimited.zwLook up netblocks deemed to be owned by your target for possible blacklisted hosts on the same target subdomain/domain?zyIf looking up owned netblocks, the maximum netblock size to look up all IPs within (CIDR value, 24 = /24, 16 = /16, etc.)z@Look up subnets which your target is a part of for blacklisting?zsIf looking up subnets, the maximum subnet size to look up all the IPs within (CIDR value, 24 = /24, 16 = /16, etc.)NFc             C   s8   || _ | j | _x"t|j D ]}|| | j|< qW d S )N)sftempStorageresultslistkeysopts)selfsfcuserOptsopt r   8/var/www/spiderfoot.crq.systems/modules/sfp_greynoise.pysetup3   s    
zsfp_greynoise.setupc             C   s   ddddgS )N
IP_ADDRESSAFFILIATE_IPADDRNETBLOCK_MEMBERNETBLOCK_OWNERr   )r   r   r   r   watchedEvents>   s    zsfp_greynoise.watchedEventsc          
   C   s   ddddddddd	d
g
S )NMALICIOUS_IPADDRMALICIOUS_ASNMALICIOUS_SUBNETMALICIOUS_AFFILIATE_IPADDRMALICIOUS_NETBLOCKCOMPANY_NAMEGEOINFOBGP_AS_MEMBEROPERATING_SYSTEMRAW_RIR_DATAr   )r   r   r   r   producedEventsC   s    zsfp_greynoise.producedEventsc             C   s   d }d| j d i}d| }| jj|| j d d|d}|d dkrX| jjd
d d| _d S ytj|d }W n. tk
r } z| jjdd d S d }~X nX |S )Nkeyr   zhttps://z7enterprise.api.greynoise.io/v2/experimental/gnql?query=_fetchtimeoutr   )timeout	useragentheaderscode200zPGreynoise API key seems to have been rejected or you have exceeded usage limits.FTcontentz.Error processing JSON response from Greynoise.z?https://enterprise.api.greynoise.io/v2/experimental/gnql?query=)r4   )r   r   fetchUrlerror
errorStatejsonloads	Exception)r   qryretheaderurlresinfoer   r   r   queryIPI   s    
zsfp_greynoise.queryIPc             C   s   |j }|j}|j}| jrd S | jjd| d |  | jd dkrZ| jjdd d| _d S || jkr|| jjd| d	  d S d| j|< |d
kr| jd sd S t	|j
| jd k r| jjdtt	|j
 d t| jd   d S |dkr@| jd  sd S t	|j
| jd k r@| jjdtt	|j
 d t| jd   d S |dksV|jdrZd}|dkrhd}| j|}|s|d S d|krd S t|d dkrx\|d D ]N}|jdd r| jjd |jdd}tj|d}	ttj|	j }
ttj d| jd   }| jd dkr6|
|k r6| jjd  d S |jd!rn|dkrn|jd!}|jd"d#d#krd}|jd$r|jd$d% }||jd"7 }td&|| j|}| j| |jd'd#d#kr|jd'jd(d}td)|| j|}| j| |jd*d#d#krtd+|jd*| j|}| j| |jd,d#d#krPtd-|jd,| j|}| j| td.t|| j|}| j| |jd/rd0| d1 |jd/ }|jd2r|d3d%j|jd2 7 }n|d9t|jd6 7 }|d7| d8 7 }t||| j|}| j| qW d S ):NzReceived event, z, from r   r   z5You enabled sfp_greynoise but did not set an API key!FTz	Skipping z as already mapped.r!   r   r   z$Network size bigger than permitted: z > r    r   r   r   	NETBLOCK_r#   r   r&   datar   seenzFound threat info in Greynoise	last_seenz
1970-01-01z%Y-%m-%diQ r   z#Record found but too old, skipping.metadatacountryunknowncityz, r)   asnASr*   organizationr(   osr+   r,   classificationzGreynoise [z]
 - Classification: tagsz, Tags: z
 - z
Raw data: Zraw_dataz$
<SFURL>https://viz.greynoise.io/ip/z</SFURL>z
 - Raw data: )	eventTypemodulerE   r8   r   debugr   r7   r   r   	prefixlenstr
startswithrC   lengetr   strptimeinttimemktime	timetupler   __name__notifyListenersreplacejoin)r   event	eventNamesrcModuleName	eventDataevtTyper=   reclastseenZlastseen_dtZlastseen_tsage_limit_tsZmetlocrB   rL   descrr   r   r   handleEvent_   s    












zsfp_greynoise.handleEvent)r_   
__module____qualname____doc__r   optdescsr   r8   dictr   r"   r-   rC   rm   r   r   r   r   r      s(   r   )
r9   r   r\   netaddrr   sflibr   r   r   r   r   r   r   r   <module>   s
   