33
44from cortexutils .analyzer import Analyzer
55
6+
67class TestAnalyzer (Analyzer ):
78 def __init__ (self ):
89 Analyzer .__init__ (self )
9- self .some_string = self .get_param (
10- "config.some_string" , None , "some_string parameter is missing"
11- )
12- self .some_list = self .get_param (
13- "config.some_list" , ["item1" , "item2" , "item3" ], "some_list parameter is missing"
14- )
15- self .some_number = self .get_param (
16- "config.some_number" , 1 , "some_number parameter is missing"
17- )
10+ self .some_string = self .get_param ("config.some_string" , None )
11+ self .some_list = self .get_param ("config.some_list" , ["item1" , "item2" , "item3" ])
12+ self .some_number = self .get_param ("config.some_number" , 1 )
1813 self .throw_error = self .get_param (
1914 "config.throw_error" , False , "throw_error parameter is missing"
2015 )
21-
16+ self .service = self .get_param (
17+ "config.service" , None , "Service parameter is missing"
18+ )
19+
2220 def run (self ):
23- if self .throw_error :
24- error_message = "this is an error string: throw_error boolean is set to True in Cortex"
25- self .error (error_message )
26- data = self .get_data ()
27- #data = self.get_param("data", None, "Data is missing")
28- datatype = self .data_type
29-
30- #result = {"data": data, "dataType": datatype, "arrayExample": ["A", "B", "C"], "tableExample": {"colA": "row A value", "colB": "row B value", "colC": "row C value",}}
31-
32- # Unicode test data
33- unicode_test_string = "こんにちは, 你好, 안녕하세요, 😀, 💻, π, ∑, ∞, « Bonjour, comment ça va ? »"
34- unicode_table_example = {
35- "colA" : "Row A: こんにちは (Hello in Japanese)" ,
36- "colB" : "Row B: 你好 (Hello in Chinese)" ,
37- "colC" : "Row C: 😀 (Smiley emoji)" ,
38- "colD" : "«Row D: Bonjour, comment ça va ? Très bien. » (Hello, how are you? Doing very well. in French)"
39- }
40-
41- result = {
42- "data" : data ,
43- "dataType" : datatype ,
44- "arrayExample" : ["A" , "B" , "C" , "Δ" , "Ж" , "Ω" , "💡" ],
45- "tableExample" : unicode_table_example ,
46- "unicodeTest" : unicode_test_string
47- }
48-
49- self .report (result )
50-
21+ try :
22+ if self .throw_error :
23+ error_message = "this is an error string: throw_error boolean is set to True in Cortex"
24+ self .error (error_message )
25+ data = self .get_data ()
26+ # data = self.get_param("data", None, "Data is missing")
27+ datatype = self .data_type
28+
29+ if self .service == "echo" :
30+ everything = {
31+ # Observable metadata
32+ # "_id": self.get_param("_id", None), ## Not supported / Not in input
33+ # "_type": self.get_param("_type", None), ## Not supported / Not in input
34+ # "_createdBy": self.get_param("_createdBy", None), ## Not supported / Not in input
35+ # "_updatedBy": self.get_param("_updatedBy", None), ## Not supported / Not in input
36+ # "_createdAt": self.get_param("_createdAt", None), ## Not supported / Not in input
37+ # "_updatedAt": self.get_param("_updatedAt", None), ## Not supported / Not in input
38+
39+ # Core observable
40+ "dataType" : self .get_param ("dataType" , None ),
41+ "data" : self .get_param ("data" , None ),
42+
43+ # Dates
44+ # "startDate": self.get_param("startDate", None), ## Not supported / Not in input
45+
46+ # TLP / PAP
47+ "tlp" : self .get_param ("tlp" , None ),
48+ # "tlpLabel": self.get_param("tlpLabel", None), ## Not supported / Not in input
49+ "pap" : self .get_param ("pap" , None ),
50+ # "papLabel": self.get_param("papLabel", None), ## Not supported / Not in input
51+
52+ # Tags / IOC / Sighted
53+ # "tags": self.get_param("tags", None), ## Not supported / Not in input
54+ # "ioc": self.get_param("ioc", None), ## Not supported / Not in input
55+ # "sighted": self.get_param("sighted", None), ## Not supported / Not in input
56+ # "sightedAt": self.get_param("sightedAt", None), ## Not supported / Not in input
57+ # "ignoreSimilarity": self.get_param("ignoreSimilarity", None), ## Not supported / Not in input
58+
59+ # Reports
60+ # "reports": self.get_param("reports", None), ## Not supported / Not in input
61+
62+ # Message
63+ "message" : self .get_param ("message" , None ), # Represents case ID!
64+
65+ # Extra data
66+ # "extraData": self.get_param("extraData", None), ## Not supported / Not in input
67+
68+ # File / attachment (if applicable)
69+ "file" : self .get_param ("file" , None ), ## Not in input (null unless dataType=="file")
70+ "attachment" : self .get_param ("attachment" , None ),## Not supported / Not in input
71+
72+ # Job parameters & analyzer config blocks
73+ "parameters" : self .get_param ("parameters" , {}),
74+ "config" : self .get_param ("config" , {}),
75+
76+ # Proxy (if passed)
77+ "proxy" : self .get_param ("proxy" , {}),
78+ }
79+ result = everything
80+
81+ elif self .service == "testing" :
82+ # result = {"data": data, "dataType": datatype, "arrayExample": ["A", "B", "C"], "tableExample": {"colA": "row A value", "colB": "row B value", "colC": "row C value",}}
83+
84+ # Unicode test data
85+ unicode_test_string = "こんにちは, 你好, 안녕하세요, 😀, 💻, π, ∑, ∞, « Bonjour, comment ça va ? »"
86+ unicode_table_example = {
87+ "colA" : "Row A: こんにちは (Hello in Japanese)" ,
88+ "colB" : "Row B: 你好 (Hello in Chinese)" ,
89+ "colC" : "Row C: 😀 (Smiley emoji)" ,
90+ "colD" : "«Row D: Bonjour, comment ça va ? Très bien. » (Hello, how are you? Doing very well. in French)" ,
91+ }
92+
93+ result = {
94+ "data" : data ,
95+ "dataType" : datatype ,
96+ "arrayExample" : ["A" , "B" , "C" , "Δ" , "Ж" , "Ω" , "💡" ],
97+ "tableExample" : unicode_table_example ,
98+ "unicodeTest" : unicode_test_string ,
99+ }
100+
101+ self .report (result )
102+ except Exception as e :
103+ self .error (f"Unhandled exception: { e } )
104+
51105 def summary (self , raw ):
52106 taxonomies = []
53107 namespace = "testing"
54108 predicate = self .data_type
55109 value = "None"
56-
57- # safe, info, suspicious, malicious
58- for level in ["info" , "safe" , "suspicious" , "malicious" ]:
59- taxonomies .append (
60- self .build_taxonomy (
61- level , namespace , predicate , value )
62- )
63-
110+
111+ if self .service == "testing" :
112+ # safe, info, suspicious, malicious
113+ for level in ["info" , "safe" , "suspicious" , "malicious" ]:
114+ taxonomies .append (
115+ self .build_taxonomy (level , namespace , predicate , value )
116+ )
64117 return {"taxonomies" : taxonomies }
65118
66119 def operations (self , raw ):
67120 operations = []
68- operations .append (self .build_operation ('AddTagToArtifact' , tag = "test" ))
69121 ## For reference only
70122 # case class AddTagToCase(tag: String) extends ActionOperation
71123 # case class AddTagToArtifact(tag: String) extends ActionOperation
@@ -86,16 +138,17 @@ def operations(self, raw):
86138 # tags: Option[Seq[String]]
87139 # ) extends ActionOperation
88140 # case class AssignCase(owner: String) extends ActionOperation
141+ if self .service == "testing" :
142+ operations .append (self .build_operation ("AddTagToArtifact" , tag = "test" ))
89143 return operations
90144
91145 def artifacts (self , raw ):
92146 artifacts = []
93- data_type = "ip"
94- value = "8.8.8.8"
95- extra_args = {
96- "tags" : ["test" ]
97- }
98- artifacts .append (self .build_artifact (data_type , value , ** extra_args ))
147+ if self .service == "testing" :
148+ data_type = "ip"
149+ value = "8.8.8.8"
150+ extra_args = {"tags" : ["test" ]}
151+ artifacts .append (self .build_artifact (data_type , value , ** extra_args ))
99152 return artifacts
100153
101154
0 commit comments