U
    @6^3                     @   s8   d dl Z d dlZd dlmZmZmZ G dd deZdS )    N)
SpiderFootSpiderFootPluginSpiderFootEventc                   @   sj   e Zd ZdZdddZdddZdZdZe fd	d
Z	dd Z
dd Zdd Zdd Zdd Zdd ZdS )sfp_metadefenderzMetaDefender:Footprint,Investigate,Passive:Reputation Systems:apikey:Search MetaDefender API for IP address and domain IP reputation.    )api_keydelayzMetaDefender API key.z#Delay between requests, in seconds.NFc                 C   s:   || _ |  | _d| _t| D ]}|| | j|< q"d S )NF)sftempStorageresults
errorStatelistkeysopts)selfsfcuserOptsopt r   ;/var/www/spiderfoot.crq.systems/modules/sfp_metadefender.pysetup&   s
    
zsfp_metadefender.setupc                 C   s   ddgS )N
IP_ADDRESSINTERNET_NAMEr   r   r   r   r   watchedEvents/   s    zsfp_metadefender.watchedEventsc                 C   s
   dddgS )NMALICIOUS_IPADDRMALICIOUS_INTERNET_NAMEGEOINFOr   r   r   r   r   producedEvents3   s    zsfp_metadefender.producedEventsc                 C   sH   d| j d d}| jjd| |d| j d d}t| j d  | |S )	Napplication/jsonr   Acceptapikeyz'https://api.metadefender.com/v4/domain/   
_useragentheaderstimeout	useragentr	   r   r
   fetchUrltimesleepparseApiResponser   qryr'   resr   r   r   queryDomain8   s    zsfp_metadefender.queryDomainc                 C   sH   d| j d d}| jjd| |d| j d d}t| j d  | |S )	Nr    r   r!   z#https://api.metadefender.com/v4/ip/r$   r%   r&   r	   r*   r/   r   r   r   queryIpH   s    zsfp_metadefender.queryIpc              
   C   s   |d dkr$| j dd d| _d S |d dkrH| j dd d| _d S |d dkrXd S |d	 d krhd S zt|d	 }W n4 tk
r } z| j d
 W Y d S d }~X Y nX |S )Ncode401zInvalid MetaDefender API keyFT429z*You are being rate-limited by MetaDefender404contentzError processing JSON response.)r
   errorr   jsonloads	Exceptiondebug)r   r1   dataer   r   r   r.   W   s$    z!sfp_metadefender.parseApiResponsec                 C   sP  |j }|j}|j}| jrd S || jkr*d S | jd dkrP| jdd d| _d S d| j|< | jd| d |  |dkr| 	|}|d kr| jd	|  d S |
d
}|rddd |
d
d|
d
dfD }td|| j|}| | |
d}	|	s| jd	|  d S |	
d}
|
sB| jd	|  d S |
D ]B}|
drF|
d}td|d | d | j|}| | qF|dkrL| |}|d kr| jd	|  d S |
d}	|	s| jd	|  d S |	
d}
|
s| jd	|  d S |
D ]B}|
dr|
d}td|d | d | j|}| | qd S )Nr   r   z8You enabled sfp_metadefender but did not set an API key!FTzReceived event, z, from r   zNo matches found for geo_infoz, c                 S   s   g | ]}|r|qS r   r   ).0_fr   r   r   
<listcomp>   s      z0sfp_metadefender.handleEvent.<locals>.<listcomp>citynamecountryr   Zlookup_resultssourcesZ
assessmentproviderr   z []r   r   )	eventTypemoduler>   r   r   r   r
   r9   r=   r3   getjoinr   __name__notifyListenersr2   )r   event	eventNamesrcModuleName	eventDatar>   r@   locationevtr1   rG   mrH   r   r   r   handleEvents   sl    




0









zsfp_metadefender.handleEvent)rN   
__module____qualname____doc__r   optdescsr   r   dictr   r   r   r2   r3   r.   rW   r   r   r   r   r      s    		r   )r:   r,   sflibr   r   r   r   r   r   r   r   <module>   s   