-
Notifications
You must be signed in to change notification settings - Fork 13
feat: Add Threat Intelligence tools #22
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from 3 commits
Commits
Show all changes
5 commits
Select commit
Hold shift + click to select a range
8a14966
feat: Add Threat Intelligence APIs as MCP tools
Shreda cae3933
fix: remove building docker image on schedule. Not sure why this was …
Shreda 0a5226c
doc: update README with new tools
Shreda 900bcaa
fix: remove redundant comments
Shreda 392e3f6
fix: wrap up common POST logic
Shreda File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,254 @@ | ||
| package v1client | ||
|
|
||
| import ( | ||
| "bytes" | ||
| "encoding/json" | ||
| "fmt" | ||
| "net/http" | ||
|
|
||
| "github.com/google/go-querystring/query" | ||
| ) | ||
|
|
||
| // ThreatIntelQueryParameters contains query parameters specific to threat intel APIs | ||
Shreda marked this conversation as resolved.
Outdated
Show resolved
Hide resolved
|
||
| type ThreatIntelQueryParameters struct { | ||
| OrderBy string `url:"orderBy,omitempty"` | ||
| Top int `url:"top,omitempty"` | ||
| SkipToken string `url:"skipToken,omitempty"` | ||
| StartDateTime string `url:"startDateTime,omitempty"` | ||
| EndDateTime string `url:"endDateTime,omitempty"` | ||
| Filter string `url:"filter,omitempty"` | ||
| } | ||
|
|
||
| // ThreatIntelFeedParameters contains query parameters for threat intelligence feed APIs | ||
| type ThreatIntelFeedParameters struct { | ||
| StartDateTime string `url:"startDateTime,omitempty"` | ||
| EndDateTime string `url:"endDateTime,omitempty"` | ||
| Top int `url:"top,omitempty"` | ||
| TopReport int `url:"topReport,omitempty"` | ||
| IndicatorObjectFormat string `url:"indicatorObjectFormat,omitempty"` | ||
| ResponseObjectFormat string `url:"responseObjectFormat,omitempty"` | ||
| } | ||
|
|
||
| // SuspiciousObject represents an object to add to the suspicious object list | ||
| type SuspiciousObject struct { | ||
| URL string `json:"url,omitempty"` | ||
| Domain string `json:"domain,omitempty"` | ||
| IP string `json:"ip,omitempty"` | ||
| SenderMailAddress string `json:"senderMailAddress,omitempty"` | ||
| FileSha1 string `json:"fileSha1,omitempty"` | ||
| FileSha256 string `json:"fileSha256,omitempty"` | ||
| Description string `json:"description,omitempty"` | ||
| ScanAction string `json:"scanAction,omitempty"` | ||
| RiskLevel string `json:"riskLevel,omitempty"` | ||
| DaysToExpiration int `json:"daysToExpiration,omitempty"` | ||
| } | ||
|
|
||
| // SuspiciousObjectException represents an object to add to the exception list | ||
| type SuspiciousObjectException struct { | ||
| URL string `json:"url,omitempty"` | ||
| Domain string `json:"domain,omitempty"` | ||
| IP string `json:"ip,omitempty"` | ||
| SenderMailAddress string `json:"senderMailAddress,omitempty"` | ||
| FileSha1 string `json:"fileSha1,omitempty"` | ||
| FileSha256 string `json:"fileSha256,omitempty"` | ||
| Description string `json:"description,omitempty"` | ||
| } | ||
|
|
||
| // SuspiciousObjectDelete represents an object to delete from the suspicious object list | ||
| type SuspiciousObjectDelete struct { | ||
| URL string `json:"url,omitempty"` | ||
| Domain string `json:"domain,omitempty"` | ||
| IP string `json:"ip,omitempty"` | ||
| SenderMailAddress string `json:"senderMailAddress,omitempty"` | ||
| FileSha1 string `json:"fileSha1,omitempty"` | ||
| FileSha256 string `json:"fileSha256,omitempty"` | ||
| } | ||
|
|
||
| // IntelligenceReportDelete represents a report to delete | ||
| type IntelligenceReportDelete struct { | ||
| ID string `json:"id"` | ||
| } | ||
|
|
||
| // IntelligenceReportSweep represents a sweep request | ||
| type IntelligenceReportSweep struct { | ||
| ID string `json:"id"` | ||
| SweepType string `json:"sweepType"` | ||
| Description string `json:"description,omitempty"` | ||
| } | ||
|
|
||
| // ThreatIntelListSuspiciousObjects retrieves suspicious objects from the list | ||
| func (c *V1ApiClient) ThreatIntelListSuspiciousObjects(filter string, queryParams ThreatIntelQueryParameters) (*http.Response, error) { | ||
| return c.searchAndFilter("v3.0/threatintel/suspiciousObjects", filter, queryParams) | ||
| } | ||
|
|
||
| // ThreatIntelAddSuspiciousObjects adds objects to the suspicious object list | ||
| func (c *V1ApiClient) ThreatIntelAddSuspiciousObjects(objects []SuspiciousObject) (*http.Response, error) { | ||
| b, err := json.Marshal(&objects) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| r, err := c.newRequest( | ||
| http.MethodPost, | ||
| "v3.0/threatintel/suspiciousObjects", | ||
| bytes.NewReader(b), | ||
| withContentTypeJSON(), | ||
| ) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| return c.client.Do(r) | ||
| } | ||
|
|
||
| // ThreatIntelDeleteSuspiciousObjects removes objects from the suspicious object list | ||
| func (c *V1ApiClient) ThreatIntelDeleteSuspiciousObjects(objects []SuspiciousObjectDelete) (*http.Response, error) { | ||
| b, err := json.Marshal(&objects) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| r, err := c.newRequest( | ||
| http.MethodPost, | ||
| "v3.0/threatintel/suspiciousObjects/delete", | ||
| bytes.NewReader(b), | ||
| withContentTypeJSON(), | ||
| ) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| return c.client.Do(r) | ||
| } | ||
|
|
||
| // ThreatIntelListExceptions retrieves the exception list | ||
| func (c *V1ApiClient) ThreatIntelListExceptions(filter string, queryParams ThreatIntelQueryParameters) (*http.Response, error) { | ||
| return c.searchAndFilter("v3.0/threatintel/suspiciousObjectExceptions", filter, queryParams) | ||
| } | ||
|
|
||
| // ThreatIntelAddExceptions adds objects to the exception list | ||
| func (c *V1ApiClient) ThreatIntelAddExceptions(objects []SuspiciousObjectException) (*http.Response, error) { | ||
| b, err := json.Marshal(&objects) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| r, err := c.newRequest( | ||
| http.MethodPost, | ||
| "v3.0/threatintel/suspiciousObjectExceptions", | ||
| bytes.NewReader(b), | ||
| withContentTypeJSON(), | ||
| ) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| return c.client.Do(r) | ||
| } | ||
|
|
||
| // ThreatIntelDeleteExceptions removes objects from the exception list | ||
| func (c *V1ApiClient) ThreatIntelDeleteExceptions(objects []SuspiciousObjectDelete) (*http.Response, error) { | ||
| b, err := json.Marshal(&objects) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| r, err := c.newRequest( | ||
| http.MethodPost, | ||
| "v3.0/threatintel/suspiciousObjectExceptions/delete", | ||
| bytes.NewReader(b), | ||
| withContentTypeJSON(), | ||
| ) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| return c.client.Do(r) | ||
| } | ||
|
|
||
| // ThreatIntelListIntelligenceReports retrieves custom intelligence reports | ||
| func (c *V1ApiClient) ThreatIntelListIntelligenceReports(queryParams ThreatIntelQueryParameters) (*http.Response, error) { | ||
| return c.searchAndFilter("v3.0/threatintel/intelligenceReports", "", queryParams) | ||
| } | ||
|
|
||
| // ThreatIntelGetIntelligenceReport downloads a custom intelligence report as a STIX Bundle | ||
| func (c *V1ApiClient) ThreatIntelGetIntelligenceReport(reportId string) (*http.Response, error) { | ||
| return c.genericGet(fmt.Sprintf("v3.0/threatintel/intelligenceReports/%s", reportId)) | ||
| } | ||
|
|
||
| // ThreatIntelDeleteIntelligenceReports deletes custom intelligence reports | ||
| func (c *V1ApiClient) ThreatIntelDeleteIntelligenceReports(reportIds []string) (*http.Response, error) { | ||
| deleteBody := []IntelligenceReportDelete{} | ||
| for _, id := range reportIds { | ||
| deleteBody = append(deleteBody, IntelligenceReportDelete{ID: id}) | ||
| } | ||
| b, err := json.Marshal(&deleteBody) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| r, err := c.newRequest( | ||
| http.MethodPost, | ||
| "v3.0/threatintel/intelligenceReports/delete", | ||
| bytes.NewReader(b), | ||
| withContentTypeJSON(), | ||
| ) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| return c.client.Do(r) | ||
| } | ||
|
|
||
| // ThreatIntelTriggerSweep triggers a sweeping task for intelligence reports | ||
| func (c *V1ApiClient) ThreatIntelTriggerSweep(sweeps []IntelligenceReportSweep) (*http.Response, error) { | ||
| b, err := json.Marshal(&sweeps) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| r, err := c.newRequest( | ||
| http.MethodPost, | ||
| "v3.0/threatintel/intelligenceReports/sweep", | ||
| bytes.NewReader(b), | ||
| withContentTypeJSON(), | ||
| ) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| return c.client.Do(r) | ||
| } | ||
|
|
||
| // ThreatIntelListTasks retrieves sweeping tasks | ||
| func (c *V1ApiClient) ThreatIntelListTasks(queryParams ThreatIntelQueryParameters) (*http.Response, error) { | ||
| return c.searchAndFilter("v3.0/threatintel/tasks", "", queryParams) | ||
| } | ||
|
|
||
| // ThreatIntelGetTaskResults retrieves the results of a task | ||
| func (c *V1ApiClient) ThreatIntelGetTaskResults(taskId string) (*http.Response, error) { | ||
| return c.genericGet(fmt.Sprintf("v3.0/threatintel/tasks/%s", taskId)) | ||
| } | ||
|
|
||
| // ThreatIntelListFeedIndicators retrieves IoCs from Trend Threat Intelligence Feed | ||
| func (c *V1ApiClient) ThreatIntelListFeedIndicators(queryParams ThreatIntelFeedParameters) (*http.Response, error) { | ||
| return c.searchAndFilter("v3.0/threatintel/feedIndicators", "", queryParams) | ||
| } | ||
|
|
||
| // ThreatIntelListFeeds retrieves intelligence objects from Trend Threat Intelligence Feed | ||
| func (c *V1ApiClient) ThreatIntelListFeeds(contextualFilter string, queryParams ThreatIntelFeedParameters) (*http.Response, error) { | ||
| p, err := query.Values(queryParams) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| r, err := c.newRequest( | ||
| http.MethodGet, | ||
| "v3.0/threatintel/feeds", | ||
| http.NoBody, | ||
| withHeader("TMV1-Contextual-Filter", contextualFilter), | ||
| withUrlParameters(p), | ||
| ) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| return c.client.Do(r) | ||
| } | ||
|
|
||
| // ThreatIntelGetFeedFilterDefinition retrieves supported filter keys and values for feed queries | ||
| func (c *V1ApiClient) ThreatIntelGetFeedFilterDefinition() (*http.Response, error) { | ||
| return c.genericGet("v3.0/threatintel/feeds/filterDefinition") | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.