Skip to content

Commit 2ed4dfe

Browse files
nusantara-selfnusantara-self
authored
Merge pull request #1405 from TheHive-Project/rename-ciscoumbrella
Folder/vendor structure & subscription/homepage info improvements
2 parents 9da6460 + f7ea8f2 commit 2ed4dfe

34 files changed

+247
-137
lines changed

‎analyzers/AILOnionLookup/AIL_OnionLookup.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,6 @@
4141
],
4242
"registration_required": false,
4343
"subscription_required": false,
44-
"free_subscription": false,
45-
"serviceHomepage": "https://onion.ail-project.org/"
44+
"free_subscription": true,
45+
"service_homepage": "https://onion.ail-project.org/"
4646
}

analyzers/Umbrella/Umbrella.py renamed to analyzers/CiscoUmbrella/Umbrella.py

File renamed without changes.

analyzers/Umbrella/Umbrella_Report.json renamed to analyzers/CiscoUmbrella/Umbrella_Report.json

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
{
2-
"name": "Umbrella_Report",
2+
"name": "CiscoUmbrella_Report",
33
"version": "1.0",
44
"author": "Kyle Parrish",
55
"url": "https://github.com/arnydo/thehive/Cortex-Analyzers",
66
"license": "AGPL-V3",
7-
"description": "Query the Umbrella Reporting API for recent DNS queries and their status.",
7+
"description": "Query the Cisco Umbrella Reporting API for recent DNS queries and their status.",
88
"dataTypeList": ["domain", "fqdn"],
9-
"command": "Umbrella/Umbrella.py",
10-
"baseConfig": "Umbrella",
9+
"command": "CiscoUmbrella/Umbrella.py",
10+
"baseConfig": "CiscoUmbrella",
1111
"config": {
1212
"service": "get"
1313
},
@@ -41,5 +41,9 @@
4141
"required": false,
4242
"default": 20
4343
}
44-
]
44+
],
45+
"registration_required": true,
46+
"subscription_required": true,
47+
"free_subscription": false,
48+
"service_homepage": "https://umbrella.cisco.com"
4549
}

analyzers/Umbrella/requirements.txt renamed to analyzers/CiscoUmbrella/requirements.txt

File renamed without changes.

‎analyzers/Elasticsearch/Elasticsearch_Analysis.json‎

Lines changed: 134 additions & 95 deletions
Original file line numberDiff line numberDiff line change
@@ -1,95 +1,134 @@
1-
{
2-
"name": "Elasticsearch_Analysis",
3-
"author": "Nick Prokop",
4-
"license": "MIT",
5-
"url": "https://github.com/TheHive-Project/Cortex-Analyzers",
6-
"version": "1.0",
7-
"description": "Search for IoCs in Elasticsearch",
8-
"dataTypeList": ["url", "domain", "ip", "hash", "filename", "fqdn"],
9-
"command": "Elasticsearch/elk.py",
10-
"baseConfig": "Elasticsearch",
11-
"configurationItems": [
12-
{
13-
"name": "endpoints",
14-
"description": "Define the Elasticsearch endpoints",
15-
"type": "string",
16-
"multi": true,
17-
"required": true,
18-
"defaultValue": ["http://127.0.0.1:9200"]
19-
},
20-
{
21-
"name": "keys",
22-
"description": "Set the Elasticsearch api keys for each endpoint. Note: Use api key or basic auth, but not both.",
23-
"type": "string",
24-
"multi": true,
25-
"required": false
26-
},
27-
{
28-
"name": "users",
29-
"description": "Set the Elasticsearch users for each endpoint. Note: Use api key or basic auth, but not both.",
30-
"type": "string",
31-
"multi": true,
32-
"required": false
33-
},
34-
{
35-
"name": "passwords",
36-
"description": "Set the Elasticsearch passwords for each endpoint. Note: Use api key or basic auth, but not both.",
37-
"type": "string",
38-
"multi": true,
39-
"required": false
40-
},
41-
{
42-
"name": "kibana",
43-
"description": "Define the kibana address",
44-
"type": "string",
45-
"multi": false,
46-
"required": false
47-
},
48-
{
49-
"name": "dashboard",
50-
"description": "Set the kibana dashboard id that will be linked in the report",
51-
"type": "string",
52-
"multi": false,
53-
"required": false
54-
},
55-
{
56-
"name": "index",
57-
"description": "Define the Elasticsearch indices to use",
58-
"type": "string",
59-
"multi": true,
60-
"required": true,
61-
"defaultValue": ["apm-*-transaction*","auditbeat-*","endgame-*","filebeat-*","packetbeat-*","winlogbeat-*"]
62-
},
63-
{
64-
"name": "field",
65-
"description": "Define the fields to query",
66-
"type": "string",
67-
"multi": true,
68-
"required": true,
69-
"defaultValue": ["destination.ip","dll.hash.md5","dll.hash.sha256","dns.question.name","dns.resolved_ip","file.hash.md5","file.hash.sha256","file.name","hash.md5","hash.sha256","process.args","process.hash.md5","process.hash.sha256","process.parent.hash.md5","process.parent.hash.sha256","source.ip","url.domain","url.full"]
70-
},
71-
{
72-
"name": "size",
73-
"description": "Define the number of hits per index to return",
74-
"type": "string",
75-
"multi": false,
76-
"required": true,
77-
"defaultValue": "10"
78-
},
79-
{
80-
"name": "verifyssl",
81-
"description": "Verify SSL certificate",
82-
"type": "boolean",
83-
"multi": false,
84-
"required": true,
85-
"defaultValue": true
86-
},
87-
{
88-
"name": "cert_path",
89-
"description": "Path to the CA on the system used to check server certificate",
90-
"type": "string",
91-
"multi": false,
92-
"required": false
93-
}
94-
]
95-
}
1+
{
2+
"name": "Elasticsearch_Analysis",
3+
"author": "Nick Prokop",
4+
"license": "MIT",
5+
"url": "https://github.com/TheHive-Project/Cortex-Analyzers",
6+
"version": "1.0",
7+
"description": "Search for IoCs in Elasticsearch",
8+
"dataTypeList": [
9+
"url",
10+
"domain",
11+
"ip",
12+
"hash",
13+
"filename",
14+
"fqdn"
15+
],
16+
"command": "Elasticsearch/elk.py",
17+
"baseConfig": "Elasticsearch",
18+
"configurationItems": [
19+
{
20+
"name": "endpoints",
21+
"description": "Define the Elasticsearch endpoints",
22+
"type": "string",
23+
"multi": true,
24+
"required": true,
25+
"defaultValue": [
26+
"http://127.0.0.1:9200"
27+
]
28+
},
29+
{
30+
"name": "keys",
31+
"description": "Set the Elasticsearch api keys for each endpoint. Note: Use api key or basic auth, but not both.",
32+
"type": "string",
33+
"multi": true,
34+
"required": false
35+
},
36+
{
37+
"name": "users",
38+
"description": "Set the Elasticsearch users for each endpoint. Note: Use api key or basic auth, but not both.",
39+
"type": "string",
40+
"multi": true,
41+
"required": false
42+
},
43+
{
44+
"name": "passwords",
45+
"description": "Set the Elasticsearch passwords for each endpoint. Note: Use api key or basic auth, but not both.",
46+
"type": "string",
47+
"multi": true,
48+
"required": false
49+
},
50+
{
51+
"name": "kibana",
52+
"description": "Define the kibana address",
53+
"type": "string",
54+
"multi": false,
55+
"required": false
56+
},
57+
{
58+
"name": "dashboard",
59+
"description": "Set the kibana dashboard id that will be linked in the report",
60+
"type": "string",
61+
"multi": false,
62+
"required": false
63+
},
64+
{
65+
"name": "index",
66+
"description": "Define the Elasticsearch indices to use",
67+
"type": "string",
68+
"multi": true,
69+
"required": true,
70+
"defaultValue": [
71+
"apm-*-transaction*",
72+
"auditbeat-*",
73+
"endgame-*",
74+
"filebeat-*",
75+
"packetbeat-*",
76+
"winlogbeat-*"
77+
]
78+
},
79+
{
80+
"name": "field",
81+
"description": "Define the fields to query",
82+
"type": "string",
83+
"multi": true,
84+
"required": true,
85+
"defaultValue": [
86+
"destination.ip",
87+
"dll.hash.md5",
88+
"dll.hash.sha256",
89+
"dns.question.name",
90+
"dns.resolved_ip",
91+
"file.hash.md5",
92+
"file.hash.sha256",
93+
"file.name",
94+
"hash.md5",
95+
"hash.sha256",
96+
"process.args",
97+
"process.hash.md5",
98+
"process.hash.sha256",
99+
"process.parent.hash.md5",
100+
"process.parent.hash.sha256",
101+
"source.ip",
102+
"url.domain",
103+
"url.full"
104+
]
105+
},
106+
{
107+
"name": "size",
108+
"description": "Define the number of hits per index to return",
109+
"type": "string",
110+
"multi": false,
111+
"required": true,
112+
"defaultValue": "10"
113+
},
114+
{
115+
"name": "verifyssl",
116+
"description": "Verify SSL certificate",
117+
"type": "boolean",
118+
"multi": false,
119+
"required": true,
120+
"defaultValue": true
121+
},
122+
{
123+
"name": "cert_path",
124+
"description": "Path to the CA on the system used to check server certificate",
125+
"type": "string",
126+
"multi": false,
127+
"required": false
128+
}
129+
],
130+
"registration_required": false,
131+
"subscription_required": false,
132+
"free_subscription": true,
133+
"service_homepage": "https://www.elastic.co"
134+
}

‎analyzers/HIBP/HIBP_Query.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,5 +47,9 @@
4747
"required": false,
4848
"defaultValue": 5
4949
}
50-
]
50+
],
51+
"registration_required": true,
52+
"subscription_required": true,
53+
"free_subscription": false,
54+
"service_homepage": "https://haveibeenpwned.com"
5155
}

‎analyzers/MSDefenderOffice365/ MSDefenderOffice365_SafeLinksDecoder.json‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,13 @@
55
"url": "https://github.com/TheHive-Project/Cortex-Analyzers",
66
"license": "AGPL-V3",
77
"description": "Decodes Office 365 ATP Safe Links to extract original URLs. Supports url observables containing safelinks.protection.outlook.com domains.",
8-
"dataTypeList": ["url"],
8+
"dataTypeList": [
9+
"url"
10+
],
911
"baseConfig": "SafeLinks",
1012
"registration_required": false,
1113
"subscription_required": false,
1214
"free_subscription": true,
13-
"command": "MSDefenderOffice365/safelinks_decoder.py"
14-
}
15+
"command": "MSDefenderOffice365/safelinks_decoder.py",
16+
"service_homepage": "https://www.microsoft.com/en-us/microsoft-365/security/office-365-defender"
17+
}

‎analyzers/Shodan/Shodan_DNSResolve.json‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,14 @@
55
"url": "https://github.com/TheHive-Project/Cortex-Analyzers/Shodan",
66
"license": "AGPL-V3",
77
"description": "Retrieve domain resolutions on Shodan.",
8-
"dataTypeList": ["domain", "fqdn"],
8+
"dataTypeList": [
9+
"domain",
10+
"fqdn"
11+
],
912
"command": "Shodan/shodan_analyzer.py",
1013
"baseConfig": "Shodan",
1114
"config": {
12-
"service": "dns_resolve"
15+
"service": "dns_resolve"
1316
},
1417
"configurationItems": [
1518
{
@@ -19,5 +22,9 @@
1922
"multi": false,
2023
"required": true
2124
}
22-
]
25+
],
26+
"registration_required": true,
27+
"subscription_required": false,
28+
"free_subscription": true,
29+
"service_homepage": "https://www.shodan.io"
2330
}

‎analyzers/Shodan/Shodan_Host.json‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,13 @@
55
"url": "https://github.com/TheHive-Project/Cortex-Analyzers/Shodan",
66
"license": "AGPL-V3",
77
"description": "Retrieve key Shodan information on an IP address.",
8-
"dataTypeList": ["ip"],
8+
"dataTypeList": [
9+
"ip"
10+
],
911
"command": "Shodan/shodan_analyzer.py",
1012
"baseConfig": "Shodan",
1113
"config": {
12-
"service": "host"
14+
"service": "host"
1315
},
1416
"configurationItems": [
1517
{
@@ -19,5 +21,9 @@
1921
"multi": false,
2022
"required": true
2123
}
22-
]
24+
],
25+
"registration_required": true,
26+
"subscription_required": false,
27+
"free_subscription": true,
28+
"service_homepage": "https://www.shodan.io"
2329
}

‎analyzers/Shodan/Shodan_Host_History.json‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,13 @@
55
"url": "https://github.com/TheHive-Project/Cortex-Analyzers/Shodan",
66
"license": "AGPL-V3",
77
"description": "Retrieve Shodan history scan results for an IP address.",
8-
"dataTypeList": ["ip"],
8+
"dataTypeList": [
9+
"ip"
10+
],
911
"command": "Shodan/shodan_analyzer.py",
1012
"baseConfig": "Shodan",
1113
"config": {
12-
"service": "host_history"
14+
"service": "host_history"
1315
},
1416
"configurationItems": [
1517
{
@@ -19,5 +21,9 @@
1921
"multi": false,
2022
"required": true
2123
}
22-
]
24+
],
25+
"registration_required": true,
26+
"subscription_required": false,
27+
"free_subscription": true,
28+
"service_homepage": "https://www.shodan.io"
2329
}

0 commit comments

Comments
 (0)