Skip to content

Commit d2cce92

Browse files
dmartinson-rfdmartinson-rf
authored
Recorded Future Intelligence v10 (#2) (chronicle#529)
* PSF-1146: fix links parsing * PSF-1152 - sync tracking connector param name * PSF-1154 - fix new entity logic * PSF-1155 - fix invalid param * PSF-1177 - fix domain abuse image fetch * PSF-1198 - fix incorrect documentation link * PSF-1145 - bump psengine v2.4.2+ * PSF-1138 - integration v10 meta * PSF-1072 - SOAR enrichment action * PSF-1072 - new action files * PSF-1071 - Add hash sandbox enrich action * PSF-1178 - update json result response examples * PSF-1138 - refactor enrichment
1 parent 3f0b643 commit d2cce92

44 files changed

Lines changed: 1829 additions & 513 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎content/response_integrations/third_party/partner/recorded_future_intelligence/actions/AddAnalystNote.py‎

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -103,13 +103,9 @@ def end_script() -> NoReturn:
103103
).document_id
104104

105105
except Exception as err:
106-
output_message = (
107-
f"Error executing action {ADD_ANALYST_NOTE_SCRIPT_NAME}. Reason: {err}"
108-
)
106+
output_message = f"Error executing action {ADD_ANALYST_NOTE_SCRIPT_NAME}. Reason: {err}"
109107
if isinstance(err, RecordedFutureUnauthorizedError):
110-
output_message = (
111-
"Unauthorized - please check your API token and try again. {}"
112-
)
108+
output_message = "Unauthorized - please check your API token and try again. {}"
113109
success = False
114110
status = EXECUTION_STATE_FAILED
115111
siemplify.LOGGER.error(output_message)

‎content/response_integrations/third_party/partner/recorded_future_intelligence/actions/DetonateFile.py‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -214,14 +214,11 @@ def main(is_first_run):
214214
else:
215215
pending_files = (
216216
file_name
217-
for file_name, submission in submit_action.action_context[
218-
"submissions"
219-
].items()
217+
for file_name, submission in submit_action.action_context["submissions"].items()
220218
if submission.get("pending_submissions", [])
221219
)
222220
output_message = (
223-
f"Waiting for results for the following files: "
224-
f"{','.join(pending_files)}"
221+
f"Waiting for results for the following files: {','.join(pending_files)}"
225222
)
226223
action_result = ActionResult(
227224
result_value=json.dumps(action_context),

‎content/response_integrations/third_party/partner/recorded_future_intelligence/actions/DetonateFile.yaml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
creator: severins
22
description: Submits a File to the Recorded Future Sandbox for analysis.
33
dynamic_results_metadata:
4-
- result_example_path: null
4+
- result_example_path: resources/DetonateSandbox_JsonResult_example.json
55
result_name: JsonResult
66
show_result: true
77
integration_identifier: RecordedFutureIntelligence
@@ -32,3 +32,5 @@ parameters:
3232
is_mandatory: false
3333
name: Password
3434
type: string
35+
script_result_name: is_success
36+
simulation_data_json: '{"Entities": ["FILEHASH"]}'

‎content/response_integrations/third_party/partner/recorded_future_intelligence/actions/DetonateURL.py‎

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -187,14 +187,10 @@ def main(is_first_run: bool):
187187
else:
188188
pending_urls = (
189189
entity_name
190-
for entity_name, submission in submit_action.action_context[
191-
"submissions"
192-
].items()
190+
for entity_name, submission in submit_action.action_context["submissions"].items()
193191
if submission.get("pending_submissions", [])
194192
)
195-
output_message = (
196-
f"Waiting for results for the following urls: {','.join(pending_urls)}"
197-
)
193+
output_message = f"Waiting for results for the following urls: {','.join(pending_urls)}"
198194
action_result = ActionResult(
199195
result_value=json.dumps(action_context),
200196
output_message=output_message,

‎content/response_integrations/third_party/partner/recorded_future_intelligence/actions/DetonateURL.yaml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
creator: severins
22
description: Submits a URL to the Recorded Future Sandbox for analysis.
33
dynamic_results_metadata:
4-
- result_example_path: null
4+
- result_example_path: resources/DetonateSandbox_JsonResult_example.json
55
result_name: JsonResult
66
show_result: true
77
integration_identifier: RecordedFutureIntelligence
@@ -13,3 +13,5 @@ parameters:
1313
is_mandatory: false
1414
name: Profile
1515
type: string
16+
script_result_name: is_success
17+
simulation_data_json: '{"Entities": ["DestinationURL"]}'

‎content/response_integrations/third_party/partner/recorded_future_intelligence/actions/EnrichCVE.py‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -101,9 +101,7 @@ def main():
101101
)
102102

103103
except RecordedFutureUnauthorizedError as e:
104-
output_message = (
105-
f"Unauthorized - please check your API token and try again. {e}"
106-
)
104+
output_message = f"Unauthorized - please check your API token and try again. {e}"
107105
siemplify.LOGGER.error(output_message)
108106
siemplify.LOGGER.exception(e)
109107
except Exception as e:

‎content/response_integrations/third_party/partner/recorded_future_intelligence/actions/EnrichHash.py‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -101,9 +101,7 @@ def main():
101101
)
102102

103103
except RecordedFutureUnauthorizedError as e:
104-
output_message = (
105-
f"Unauthorized - please check your API token and try again. {e}"
106-
)
104+
output_message = f"Unauthorized - please check your API token and try again. {e}"
107105
siemplify.LOGGER.error(output_message)
108106
siemplify.LOGGER.exception(e)
109107
except Exception as e:

‎content/response_integrations/third_party/partner/recorded_future_intelligence/actions/EnrichHost.py‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -101,9 +101,7 @@ def main():
101101
)
102102

103103
except RecordedFutureUnauthorizedError as e:
104-
output_message = (
105-
f"Unauthorized - please check your API token and try again. {e}"
106-
)
104+
output_message = f"Unauthorized - please check your API token and try again. {e}"
107105
siemplify.LOGGER.error(output_message)
108106
siemplify.LOGGER.exception(e)
109107
except Exception as e:

‎content/response_integrations/third_party/partner/recorded_future_intelligence/actions/EnrichIOC.py‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -108,9 +108,7 @@ def main():
108108
)
109109

110110
except RecordedFutureUnauthorizedError as e:
111-
output_message = (
112-
f"Unauthorized - please check your API token and try again. {e}"
113-
)
111+
output_message = f"Unauthorized - please check your API token and try again. {e}"
114112
siemplify.LOGGER.error(output_message)
115113
siemplify.LOGGER.exception(e)
116114
except Exception as e:

‎content/response_integrations/third_party/partner/recorded_future_intelligence/actions/EnrichIOCsBulk.py‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
############################## TERMS OF USE ################################### # noqa: E266
2+
# The following code is provided for demonstration purposes only, and should #
3+
# not be used without independent verification. Recorded Future makes no #
4+
# representations or warranties, express, implied, statutory, or otherwise, #
5+
# regarding this code, and provides it strictly "as-is". #
6+
# Recorded Future shall not be liable for, and you assume all risk of #
7+
# using the foregoing. #
8+
###############################################################################
9+
10+
from constants import (
11+
DEFAULT_DEVICE_VENDOR,
12+
ENRICH_IOC_SOAR_SCRIPT_NAME,
13+
PROVIDER_NAME,
14+
)
15+
from RecordedFutureCommon import RecordedFutureCommon
16+
from SiemplifyAction import SiemplifyAction
17+
from SiemplifyDataModel import EntityTypes
18+
from SiemplifyUtils import output_handler
19+
from TIPCommon.extraction import extract_action_param, extract_configuration_param
20+
21+
SUPPORTED_ENTITIES = [
22+
EntityTypes.HOSTNAME,
23+
EntityTypes.CVE,
24+
EntityTypes.FILEHASH,
25+
EntityTypes.ADDRESS,
26+
EntityTypes.URL,
27+
EntityTypes.DOMAIN,
28+
]
29+
30+
31+
@output_handler
32+
def main():
33+
siemplify = SiemplifyAction()
34+
siemplify.script_name = ENRICH_IOC_SOAR_SCRIPT_NAME
35+
siemplify.LOGGER.info("----------------- Main - Started -----------------")
36+
37+
api_url = extract_configuration_param(
38+
siemplify, provider_name=PROVIDER_NAME, param_name="ApiUrl"
39+
)
40+
api_key = extract_configuration_param(
41+
siemplify, provider_name=PROVIDER_NAME, param_name="ApiKey"
42+
)
43+
verify_ssl = extract_configuration_param(
44+
siemplify,
45+
provider_name=PROVIDER_NAME,
46+
param_name="Verify SSL",
47+
default_value=False,
48+
input_type=bool,
49+
)
50+
collective_insights_global = extract_configuration_param(
51+
siemplify,
52+
provider_name=PROVIDER_NAME,
53+
param_name="CollectiveInsights",
54+
default_value=True,
55+
input_type=bool,
56+
)
57+
collective_insights_action = extract_action_param(
58+
siemplify,
59+
param_name="Enable Collective Insights",
60+
default_value=True,
61+
input_type=bool,
62+
)
63+
64+
# Exclude Collective Insights submissions for Recorded Future Alerts
65+
reporting_vendor = siemplify.current_alert.reporting_vendor
66+
external_vendor = reporting_vendor != DEFAULT_DEVICE_VENDOR
67+
68+
collective_insights_enabled = (
69+
collective_insights_action and collective_insights_global and external_vendor
70+
)
71+
72+
recorded_future_common = RecordedFutureCommon(
73+
siemplify=siemplify,
74+
api_url=api_url,
75+
api_key=api_key,
76+
verify_ssl=verify_ssl,
77+
)
78+
79+
try:
80+
recorded_future_common.enrich_soar_logic(
81+
entity_types=SUPPORTED_ENTITIES,
82+
collective_insights_enabled=collective_insights_enabled,
83+
)
84+
except Exception as e:
85+
siemplify.LOGGER.error(
86+
"General error performing action {}".format(ENRICH_IOC_SOAR_SCRIPT_NAME)
87+
)
88+
siemplify.LOGGER.exception(e)
89+
90+
siemplify.LOGGER.info("\n----------------- Main - Finished -----------------")
91+
92+
93+
if __name__ == "__main__":
94+
main()

0 commit comments

Comments
 (0)