U
    @6^|                      @   sP   d dl Z d dlmZ d dlZd dlmZ d dlmZmZmZ G dd deZ	dS )    N)datetime)	IPNetwork)
SpiderFootSpiderFootPluginSpiderFootEventc                   @   sj   e Zd ZdZdddddddZddd	d
dddZdZdZe fddZ	dd Z
dd Zdd Zdd ZdS )sfp_greynoiseznGreynoise:Investigate,Passive:Reputation Systems:apikey:Obtain information from Greynoise.io's Enterprise API.    T   )api_keyage_limit_daysnetblocklookupmaxnetblocksubnetlookup	maxsubnetzGreynoise API Key.z<Ignore any records older than this many days. 0 = unlimited.zwLook up netblocks deemed to be owned by your target for possible blacklisted hosts on the same target subdomain/domain?zyIf looking up owned netblocks, the maximum netblock size to look up all IPs within (CIDR value, 24 = /24, 16 = /16, etc.)z@Look up subnets which your target is a part of for blacklisting?zsIf looking up subnets, the maximum subnet size to look up all the IPs within (CIDR value, 24 = /24, 16 = /16, etc.)NFc                 C   s4   || _ |  | _t| D ]}|| | j|< qd S )N)sftempStorageresultslistkeysopts)selfsfcuserOptsopt r   8/var/www/spiderfoot.crq.systems/modules/sfp_greynoise.pysetup3   s    
zsfp_greynoise.setupc                 C   s   ddddgS )N
IP_ADDRESSAFFILIATE_IPADDRNETBLOCK_MEMBERNETBLOCK_OWNERr   r   r   r   r   watchedEvents>   s     zsfp_greynoise.watchedEventsc              
   C   s   ddddddddd	d
g
S )NMALICIOUS_IPADDRMALICIOUS_ASNMALICIOUS_SUBNETMALICIOUS_AFFILIATE_IPADDRMALICIOUS_NETBLOCKCOMPANY_NAMEGEOINFOBGP_AS_MEMBEROPERATING_SYSTEMRAW_RIR_DATAr   r"   r   r   r   producedEventsC   s        zsfp_greynoise.producedEventsc              
   C   s   d }d| j d i}d| }| jj|| j d d|d}|d dkrX| jd	d
 d| _d S zt|d }W n6 tk
r } z| jdd
 W Y d S d }~X Y nX |S )Nkeyr   z?https://enterprise.api.greynoise.io/v2/experimental/gnql?query=_fetchtimeoutr   )timeout	useragentheaderscode)200zPGreynoise API key seems to have been rejected or you have exceeded usage limits.FTcontentz.Error processing JSON response from Greynoise.)r   r   fetchUrlerror
errorStatejsonloads	Exception)r   qryretheaderurlresinfoer   r   r   queryIPI   s"     zsfp_greynoise.queryIPc                 C   s  |j }|j}|j}| jrd S | jd| d |  | jd dkrZ| jdd d| _d S || jkr|| jd| d	  d S d| j|< |d
kr| jd sd S t	|j
| jd k r| jdtt	|j
 d t| jd   d S |dkr>| jd sd S t	|j
| jd k r>| jdtt	|j
 d t| jd   d S |dksT|drXd}|dkrfd}| |}|szd S d|krd S t|d dkr|d D ]P}|dd r| jd |dd}t|d}	tt|	 }
tt d| jd   }| jd dkr2|
|k r2| jd   d S |d!rj|dkrj|d!}|d"d#d#krd}|d$r|d$d% }||d"7 }td&|| j|}| | |d'd#d#kr|d'd(d}td)|| j|}| | |d*d#d#krtd+|d*| j|}| | |d,d#d#krLtd-|d,| j|}| | td.t|| j|}| | |d/rd0| d1 |d/ }|d2r|d3d%|d2 7 }n|d4t|d5 7 }|d6| d7 7 }t||| j|}| | qd S )8NzReceived event, z, from r   r   z5You enabled sfp_greynoise but did not set an API key!FTz	Skipping z as already mapped.r!   r   r   z$Network size bigger than permitted: z > r    r   r   r   	NETBLOCK_r$   r   r'   datar   seenzFound threat info in Greynoise	last_seenz
1970-01-01z%Y-%m-%diQ r   z#Record found but too old, skipping.metadatacountryunknowncityz, r*   asnASr+   organizationr)   osr,   r-   classificationzGreynoise [z]
 - Classification: tagsz, Tags: z
 - Raw data: raw_dataz$
<SFURL>https://viz.greynoise.io/ip/z</SFURL>)	eventTypemodulerF   r9   r   debugr   r8   r   r   	prefixlenstr
startswithrD   lengetr   strptimeinttimemktime	timetupler   __name__notifyListenersreplacejoin)r   event	eventNamesrcModuleName	eventDataevtTyper>   reclastseenZlastseen_dtZlastseen_tsage_limit_tsZmetlocrC   rM   descrr   r   r   handleEvent_   s    













zsfp_greynoise.handleEvent)ra   
__module____qualname____doc__r   optdescsr   r9   dictr   r#   r.   rD   ro   r   r   r   r   r      s,   r   )
r:   r   r^   netaddrr   sflibr   r   r   r   r   r   r   r   <module>   s
   