Added enhanced support for "Auto extraction" with observables for the emlparser analyzer

analyzers/EmlParser/parse.py

@@ -9,6 +9,35 @@
 import base64
 from pprint import pprint
 
+#Required for analyzer specific observable auto extraction
+from cortexutils.extractor import Extractor
+import re
+
+class EnhancedExtractor(Extractor):
+
+    def __init__(self, ignore=None):
+        Extractor.__init__(self)
+        self.asregex = self.__init_analyzer_regex()
+
+    @staticmethod
+    def __init_analyzer_regex():
+
+        """
+        Returns compiled regex list specifically for mail.
+
+        :return: List of {type, regex} dicts
+        :rtype: list
+        """
+
+        ### Mail Specific regexes
+        # Received from
+        as_regex = [{
+            'types': ['fqdn','fqdn'],
+            'regex': re.compile(r'from\s\[?([A-Za-z0-9\.\-]*)\]?.*?\sby\s\[?([A-Za-z0-9\.\-]*)\]?', re.MULTILINE)
+        }]
+
+        return as_regex
+
 class EmlParserAnalyzer(Analyzer):
 
     def __init__(self):
@@ -43,6 +72,14 @@ def summary(self, raw):
 
         return {"taxonomies": taxonomies}
 
+    def artifacts(self, raw):
+        # Use the regex extractor, if auto_extract setting is not False
+        if self.auto_extract:
+            extractor = EnhancedExtractor(ignore=self.get_data())
+            return extractor.check_iterable(raw)
+
+        # Return empty list
+        return []
 
 def parseEml(filepath):
 
@@ -119,4 +156,4 @@ def parseEml(filepath):
     return result
 
 if __name__ == '__main__':
-    EmlParserAnalyzer().run()
+    EmlParserAnalyzer().run()

analyzers/EmlParser/requirements.txt

@@ -1,2 +1,3 @@
 cortexutils;python_version>='3.5'
 eml_parser
+python-magic

analyzers/IBMXForce/IBMXForce_Lookup.json

@@ -47,4 +47,4 @@
       "default": true
     }
   ]
-}
+}

analyzers/IBMXForce/ibmxforce_lookup.py

@@ -220,4 +220,4 @@ def run(self):
 
 
 if __name__ == '__main__':
-    IBMXForceAnalyzer().run()
+    IBMXForceAnalyzer().run()