diff --git a/analyzers/DomainToolsIris/DomainToolsIris_Investigate.json b/analyzers/DomainToolsIris/DomainToolsIris_Investigate.json new file mode 100644 index 000000000..946937168 --- /dev/null +++ b/analyzers/DomainToolsIris/DomainToolsIris_Investigate.json @@ -0,0 +1,38 @@ +{ + "name": "DomainToolsIris_Investigate", + "version": "1.0", + "author": "DomainTools", + "url": "https://github.com/TheHive-Project/Cortex-Analyzers", + "license": "AGPL-V3", + "description": "Use DomainTools Iris API to investigate a domain.", + "dataTypeList": ["domain"], + "command": "DomainToolsIris/domaintoolsiris_analyzer.py", + "baseConfig": "DomainToolsIris", + "config": { + "service": "investigate-domain" + }, + "configurationItems": [ + { + "name": "username", + "description": "DomainTools Iris API credentials", + "type": "string", + "multi": false, + "required": true + }, + { + "name": "key", + "description": "DomainTools Iris API credentials", + "type": "string", + "multi": false, + "required": true + }, + { + "name": "pivot_count_threshold", + "description": "Pivot count threshold.", + "type": "number", + "multi": false, + "required": false, + "defaultValue": 500 + } + ] +} \ No newline at end of file diff --git a/analyzers/DomainToolsIris/domaintoolsiris_analyzer.py b/analyzers/DomainToolsIris/domaintoolsiris_analyzer.py index 259a633dd..a91025b60 100755 --- a/analyzers/DomainToolsIris/domaintoolsiris_analyzer.py +++ b/analyzers/DomainToolsIris/domaintoolsiris_analyzer.py @@ -153,12 +153,12 @@ def format_single_domain(self, domain_data): ] = DomainToolsAnalyzer.get_threat_level_class( domain_risk["tpm"]["value"] ) - threat_profile_phshing_data = DomainToolsAnalyzer.get_threat_component( + threat_profile_phishing_data = DomainToolsAnalyzer.get_threat_component( risk_components, "threat_profile_phishing" ) - if threat_profile_phshing_data: + if threat_profile_phishing_data: domain_risk["tpp"] = {} - domain_risk["tpp"]["value"] = threat_profile_malware_data.get( + domain_risk["tpp"]["value"] = threat_profile_phishing_data.get( "risk_score", 0 ) domain_risk["tpp"][ @@ -171,7 +171,7 @@ def format_single_domain(self, domain_data): ) if threat_profile_spam_data: domain_risk["tps"] = {} - domain_risk["tps"]["value"] = threat_profile_malware_data.get( + domain_risk["tps"]["value"] = threat_profile_spam_data.get( "risk_score", 0 ) domain_risk["tps"][ diff --git a/analyzers/DomainToolsIris/screenshots/InvestigateLongSummary.png b/analyzers/DomainToolsIris/screenshots/InvestigateLongSummary.png new file mode 100644 index 000000000..42dd809d9 Binary files /dev/null and b/analyzers/DomainToolsIris/screenshots/InvestigateLongSummary.png differ diff --git a/analyzers/DomainToolsIris/screenshots/InvestigateShortSummary.png b/analyzers/DomainToolsIris/screenshots/InvestigateShortSummary.png new file mode 100644 index 000000000..728e00d22 Binary files /dev/null and b/analyzers/DomainToolsIris/screenshots/InvestigateShortSummary.png differ diff --git a/thehive-templates/DomainToolsIris_Investigate_1_0/long.html b/thehive-templates/DomainToolsIris_Investigate_1_0/long.html new file mode 100644 index 000000000..493fa552c --- /dev/null +++ b/thehive-templates/DomainToolsIris_Investigate_1_0/long.html @@ -0,0 +1,567 @@ +
+
+ {{artifact.data | fang}} +
+
+ {{content.errorMessage}} +
+
+ +
+
+ {{artifact.data | fang}} +
+
+
+

Investigate with DomainTools Iris

+

+ Investigate Date: {{content.last_enriched}} +

+
+ +

+ Iris Investigation: + + {{content.domain}} + +

+


+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+ Analytics +
Overall Risk Score + + {{content.domain_risk.overall.value}} + +
Proximity Risk Score + + {{ content.domain_risk.proximity.value }} + +
Threat Profile Risk Score + + {{ content.domain_risk.tp.value }} + +
Threat Profile Phishing Risk Score + + {{ content.domain_risk.tpp.value }} + +
Threat Profile Spam Risk Score + + {{ content.domain_risk.tps.value }} + +
Threat Profile Malware Risk Score + + {{ content.domain_risk.tpm.value }} + +
Threat Profile Evidence + + + + +
{{e}}
+
Threat Profile Threats + + + + +
{{t}}
+
Website Response Code + {{ content.website_response }} +
Alexa Rank + {{ content.alexa }} +
Google Adsense Tracking Code + {{ content.adsense.value}} +
Google Analytics Tracking Code + {{ content.google_analytics.value}} +
Iris Tags + + + + +
{{t.label}}
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+ Identity +
{{c.type}} + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Name{{c.name.value}} + + {{c.name.count}} + +
Org{{c.org.value}} + + {{c.org.count}} + +
Street{{c.street.value}} + + {{c.street.count}} + +
City{{c.city.value}} + + {{c.city.count}} + +
State{{c.state.value}} + + {{c.state.count}} + +
Postal{{c.postal.value}} + + {{c.postal.count}} + +
Country{{c.country.value}} + + {{c.country.count}} + +
Phone{{c.phone.value}} + + {{c.phone.count}} + +
Fax{{c.fax.value}} + + {{c.fax.count}} + +
Email{{e.value}} + + {{e.count}} + +
+
SOA Email + + + + + +
{{e.value}} + + {{e.count}} + +
+
SSL Certificate Email + + + + + +
{{e.value}} + + {{e.count}} + +
+
Email Domains + + + + + +
{{e.value}} + + {{e.count}} + +
+
Whois Emails + + + + + +
{{e.value}} + + {{e.count}} + +
+
+ + + + + + + + + + + + + + + + + + + + + + + + +
+ Registration +
Domain Registrar + {{ content.registrar.value}} +
Domain Status + {{ content.registrar_status[0]}} +
Create Date + {{ content.create_date.value}} +
Expiration Date + {{ content.expiration_date.value}} +
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+ Hosting +
IP Addresses + + + + +
+ + + + + + + + + + + + + + + + + + + + + +
ISP{{i.isp.value}} + + {{i.isp.count}} + +
ASN{{a.value}} + + {{a.count}} + +
Country Code{{i.country_code.value}} + + {{i.country_code.count}} + +
Address{{i.address.value}} + + {{i.address.count}} + +
+
+
Mail Servers + + + + +
+ + + + + + + + + + + + + + + + + + + + + +
Domain{{m.domain.value}} + + {{m.domain.count}} + +
IP Address{{i.value}} + + {{i.count}} + +
Host{{m.host.value}} + + {{m.host.count}} + +
Priority{{m.priority}}
+
+
SPF Record + {{ content.spf_info}} +
Name Servers + + + + +
+ + + + + + + + + + + + + + + + +
Domain{{n.domain.value}} + + {{n.domain.count}} + +
IP Address{{i.value}} + + {{i.count}} + +
Host{{n.host.value}} + + {{n.host.count}} + +
+
+
SSL Certificate + + + + +
+ + + + + + + + + + + + + + + + + + + + + +
Organization{{s.organization.value}} + + {{s.organization.count}} + +
Email{{e.value}} + + {{e.count}} + +
Hash{{s.hash.value}} + + {{s.hash.count}} + +
Subject{{s.subject.value}} + + {{s.subject.count}} + +
+
+
Redirects To + + + + + +
+ {{ content.redirect.value}} + + + {{ content.redirect.count}} + +
+
+
+
diff --git a/thehive-templates/DomainToolsIris_Investigate_1_0/short.html b/thehive-templates/DomainToolsIris_Investigate_1_0/short.html new file mode 100644 index 000000000..641e4c54d --- /dev/null +++ b/thehive-templates/DomainToolsIris_Investigate_1_0/short.html @@ -0,0 +1,7 @@ + + {{t.namespace}}:{{t.predicate}}="{{t.value}}" +