From 835931f970f8ae11c1825c855214c3616461f892 Mon Sep 17 00:00:00 2001
From: Jerome Leonard <jeromeleonard@users.noreply.github.com>
Date: Sun, 9 Feb 2020 10:25:48 +0100
Subject: [PATCH] Revert "DomainTools add risky DNS tag to artifact and case
 depending on risk score tag from DomainTools. (#587)"

This reverts commit 9e12508a96198e41c84a3e557c625370db9e10ef.
---
 .../DomainToolsIris_AddRiskyDNSTag.json       | 28 -------------
 .../domaintoolsiris_responder.py              | 41 -------------------
 .../requirements.txt                          |  0
 3 files changed, 69 deletions(-)
 delete mode 100644 responders/DomainToolsIris_AddRiskyDNSTag/DomainToolsIris_AddRiskyDNSTag.json
 delete mode 100644 responders/DomainToolsIris_AddRiskyDNSTag/domaintoolsiris_responder.py
 delete mode 100644 responders/DomainToolsIris_AddRiskyDNSTag/requirements.txt

diff --git a/responders/DomainToolsIris_AddRiskyDNSTag/DomainToolsIris_AddRiskyDNSTag.json b/responders/DomainToolsIris_AddRiskyDNSTag/DomainToolsIris_AddRiskyDNSTag.json
deleted file mode 100644
index fafd73f73..000000000
--- a/responders/DomainToolsIris_AddRiskyDNSTag/DomainToolsIris_AddRiskyDNSTag.json
+++ /dev/null
@@ -1,28 +0,0 @@
-{
-  "name": "DomainToolsIris_AddRiskyDNSTag",
-  "version": "1.0",
-  "author": "DomainTools",
-  "url": "https://github.com/TheHive-Project/Cortex-Analyzers",
-  "license": "AGPL-V3",
-  "description": "Add Tag saying that the case contains a risky DNS.",
-  "dataTypeList": ["thehive:case_artifact"],
-  "command": "DomainToolsIris_AddRiskyDNSTag/domaintoolsiris_responder.py",
-  "baseConfig": "DomainToolsIris",
-  "configurationItems": [
-    {
-      "name": "high_risk_threshold",
-      "description": "Risk score threshold to be considered high risk.",
-      "type": "number",
-      "multi": false,
-      "required": false,
-      "defaultValue": 70
-    },
-    {
-      "name": "monitored_iris_tags",
-      "description": "Monitored Iris tags.",
-      "type": "string",
-      "multi": true,
-      "required": false
-    }
-  ]
-}
\ No newline at end of file
diff --git a/responders/DomainToolsIris_AddRiskyDNSTag/domaintoolsiris_responder.py b/responders/DomainToolsIris_AddRiskyDNSTag/domaintoolsiris_responder.py
deleted file mode 100644
index 38062a18c..000000000
--- a/responders/DomainToolsIris_AddRiskyDNSTag/domaintoolsiris_responder.py
+++ /dev/null
@@ -1,41 +0,0 @@
-#!/usr/bin/env python3
-# encoding: utf-8
-
-
-from cortexutils.responder import Responder
-
-
-class DomainToolsIris(Responder):
-    def __init__(self):
-        Responder.__init__(self)
-
-    def run(self):
-        Responder.run(self)
-        if self.get_param("data.dataType") == "domain":
-            self.report({"data": self.get_data()})
-        else:
-            self.report({"data": 'Can only operate on "domain" observables'})
-
-    def operations(self, raw):
-        build_list = []
-        taxonomies = (
-            raw.get("data", {})
-            .get("reports", {})
-            .get("DomainToolsIris_Investigate_1_0", {})
-            .get("taxonomies", None)
-        )
-
-        for x in taxonomies:
-            if x["predicate"] == "Risk Score":
-                if int(x["value"]) > int(self.get_param("config.high_risk_threshold")):
-                    build_list.append(
-                        self.build_operation("AddTagToCase", tag="DT:Risky DNS")
-                    )
-                    build_list.append(
-                        self.build_operation("AddTagToArtifact", tag="DT:Risky DNS")
-                    )
-        return build_list
-
-
-if __name__ == "__main__":
-    DomainToolsIris().run()
diff --git a/responders/DomainToolsIris_AddRiskyDNSTag/requirements.txt b/responders/DomainToolsIris_AddRiskyDNSTag/requirements.txt
deleted file mode 100644
index e69de29bb..000000000