diff --git a/analyzers/EmlParser/parse.py b/analyzers/EmlParser/parse.py old mode 100755 new mode 100644 index ce4f1e0c0..42d279a35 --- a/analyzers/EmlParser/parse.py +++ b/analyzers/EmlParser/parse.py @@ -9,6 +9,35 @@ import base64 from pprint import pprint +#Required for analyzer specific observable auto extraction +from cortexutils.extractor import Extractor +import re + +class EnhancedExtractor(Extractor): + + def __init__(self, ignore=None): + Extractor.__init__(self) + self.asregex = self.__init_analyzer_regex() + + @staticmethod + def __init_analyzer_regex(): + + """ + Returns compiled regex list specifically for mail. + + :return: List of {type, regex} dicts + :rtype: list + """ + + ### Mail Specific regexes + # Received from + as_regex = [{ + 'types': ['fqdn','fqdn'], + 'regex': re.compile(r'from\s\[?([A-Za-z0-9\.\-]*)\]?.*?\sby\s\[?([A-Za-z0-9\.\-]*)\]?', re.MULTILINE) + }] + + return as_regex + class EmlParserAnalyzer(Analyzer): def __init__(self): @@ -43,6 +72,14 @@ def summary(self, raw): return {"taxonomies": taxonomies} + def artifacts(self, raw): + # Use the regex extractor, if auto_extract setting is not False + if self.auto_extract: + extractor = EnhancedExtractor(ignore=self.get_data()) + return extractor.check_iterable(raw) + + # Return empty list + return [] def parseEml(filepath): @@ -119,4 +156,4 @@ def parseEml(filepath): return result if __name__ == '__main__': - EmlParserAnalyzer().run() + EmlParserAnalyzer().run() \ No newline at end of file diff --git a/analyzers/EmlParser/requirements.txt b/analyzers/EmlParser/requirements.txt index bd0fe8249..f1b90baeb 100644 --- a/analyzers/EmlParser/requirements.txt +++ b/analyzers/EmlParser/requirements.txt @@ -1,2 +1,3 @@ cortexutils;python_version>='3.5' eml_parser +python-magic diff --git a/analyzers/IBMXForce/IBMXForce_Lookup.json b/analyzers/IBMXForce/IBMXForce_Lookup.json index 3581ce355..f304efd92 100644 --- a/analyzers/IBMXForce/IBMXForce_Lookup.json +++ b/analyzers/IBMXForce/IBMXForce_Lookup.json @@ -47,4 +47,4 @@ "default": true } ] -} \ No newline at end of file +} diff --git a/analyzers/IBMXForce/ibmxforce_lookup.py b/analyzers/IBMXForce/ibmxforce_lookup.py index 2a7074596..b255bdc48 100755 --- a/analyzers/IBMXForce/ibmxforce_lookup.py +++ b/analyzers/IBMXForce/ibmxforce_lookup.py @@ -220,4 +220,4 @@ def run(self): if __name__ == '__main__': - IBMXForceAnalyzer().run() \ No newline at end of file + IBMXForceAnalyzer().run()