3
@6^3                 @   s8   d dl Z d dlZd dlmZmZmZ G dd deZdS )    N)
SpiderFootSpiderFootPluginSpiderFootEventc               @   sj   e Zd ZdZdddZdddZdZdZe fd	d
Z	dd Z
dd Zdd Zdd Zdd Zdd ZdS )sfp_metadefenderzMetaDefender:Footprint,Investigate,Passive:Reputation Systems:apikey:Search MetaDefender API for IP address and domain IP reputation.    )api_keydelayzMetaDefender API key.z#Delay between requests, in seconds.NFc             C   s>   || _ | j | _d| _x"t|j D ]}|| | j|< q$W d S )NF)sftempStorageresults
errorStatelistkeysopts)selfsfcuserOptsopt r   ;/var/www/spiderfoot.crq.systems/modules/sfp_metadefender.pysetup&   s
    
zsfp_metadefender.setupc             C   s   ddgS )N
IP_ADDRESSINTERNET_NAMEr   )r   r   r   r   watchedEvents/   s    zsfp_metadefender.watchedEventsc             C   s
   dddgS )NMALICIOUS_IPADDRMALICIOUS_INTERNET_NAMEGEOINFOr   )r   r   r   r   producedEvents3   s    zsfp_metadefender.producedEventsc             C   sH   d| j d d}| jjd| |d| j d d}tj| j d  | j|S )	Nzapplication/jsonr   )Acceptapikeyz'https://api.metadefender.com/v4/domain/   
_useragent)headerstimeout	useragentr	   )r   r
   fetchUrltimesleepparseApiResponse)r   qryr#   resr   r   r   queryDomain8   s    zsfp_metadefender.queryDomainc             C   sH   d| j d d}| jjd| |d| j d d}tj| j d  | j|S )	Nzapplication/jsonr   )r   r    z#https://api.metadefender.com/v4/ip/r!   r"   )r#   r$   r%   r	   )r   r
   r&   r'   r(   r)   )r   r*   r#   r+   r   r   r   queryIpH   s    zsfp_metadefender.queryIpc             C   s   |d dkr$| j jdd d| _d S |d dkrH| j jdd d| _d S |d dkrXd S |d	 d krhd S ytj|d	 }W n, tk
r } z| j jd
 d S d }~X nX |S )Ncode401zInvalid MetaDefender API keyFT429z*You are being rate-limited by MetaDefender404contentzError processing JSON response.)r
   errorr   jsonloads	Exceptiondebug)r   r+   dataer   r   r   r)   W   s$    z!sfp_metadefender.parseApiResponsec             C   sX  |j }|j}|j}| jrd S || jkr*d S | jd dkrP| jjdd d| _d S d| j|< | jjd| d |  |dkr| j	|}|d kr| jjd	|  d S |j
d
}|rdjdd |j
dj
d|j
dj
dgD }td|| j|}| j| |j
d}	|	s| jjd	|  d S |	j
d}
|
sB| jjd	|  d S xJ|
D ]B}|j
drH|j
d}td|d | d | j|}| j| qHW |dkrT| j|}|d kr| jjd	|  d S |j
d}	|	s| jjd	|  d S |	j
d}
|
s| jjd	|  d S xJ|
D ]B}|j
dr|j
d}td|d | d | j|}| j| qW d S )Nr   r   z8You enabled sfp_metadefender but did not set an API key!FTzReceived event, z, from r   zNo matches found for geo_infoz, c             S   s   g | ]}|r|qS r   r   ).0_fr   r   r   
<listcomp>   s    z0sfp_metadefender.handleEvent.<locals>.<listcomp>citynamecountryr   Zlookup_resultssourcesZ
assessmentproviderr   z []r   r   )	eventTypemoduler8   r   r   r   r
   r3   r7   r-   getjoinr   __name__notifyListenersr,   )r   event	eventNamesrcModuleName	eventDatar8   r:   locationevtr+   rA   mrB   r   r   r   handleEvents   sl    




0











zsfp_metadefender.handleEvent)rH   
__module____qualname____doc__r   optdescsr   r   dictr   r   r   r,   r-   r)   rQ   r   r   r   r   r      s   	r   )r4   r'   sflibr   r   r   r   r   r   r   r   <module>   s   