Barracuda Reputation Block List

Details

ID	`Barracuda Reputation Block List - BRBL`
Provider	KKR
Category	Data Enrichment & Threat Intelligence
From Version	6.0.0
Docker Image	`demisto/python3:3.12.8.3296088`
Supported Modules	Agentix XSIAM

README

This integration enables reputation checks against IPs from Barracuda Reputation Block List (BRBL)
This integration was integrated and tested with Barracuda Reputation Block List (BRBL)

Configure Barracuda Reputation Block List (BRBL) in Cortex

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

ip

Get IP Reputation

Base Command

ip

Input

Argument Name	Description	Required
ip	IP to look up	Required

Context Output

Path	Type	Description
ip	String	Get IP details from Barracuda(BRBL) service
Barracuda.IP	String	IP details
DBotScore.Indicator	String	The indicator itself
DBotScore.Score	Number	Score
DBotScore.Type	String	Type of the indicator
DBotScore.Vendor	String	Vendor information
IP.Address	String	IP address
IP.Malicious.Vendor	String	The vendor reporting the IP address as malicious.
IP.Malicious.Description	String	A description explaining why the IP address was reported as malicious.

Command Example

!ip ip=1.1.1.1

Context Example

{
    "Barracuda": {
        "IP": {
            "indicator": "1.1.1.1"
        }
    },
    "DBotScore": {
        "Indicator": "1.1.1.1",
        "Score": 0,
        "Type": "ip",
        "Vendor": "Barracuda"
    },
    "IP": {
        "Address": "1.1.1.1"
    }
}

Human Readable Output

Results

indicator

1.1.1.1

indicator
1.1.1.1

Configuration parameters

integrationReliability — Source Reliability
feedExpirationPolicy —
feedExpirationInterval —

Commands (1)

ip
Get IP Reputation.

Source

BarracudaReputationBlockListBRBL.py BarracudaReputationBlockListBRBL.yml BarracudaReputationBlockListBRBL_description.md command_examples.txt

Download History Raw

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401

""" IMPORTS """
from socket import gaierror


def results_return(command, thingtoreturn):
    for item in thingtoreturn:
        description = ""
        ip_reputation = {
            "indicator": item["Address"],
        }
        try:
            if item["Malicious"]["Vendor"]:
                score = Common.DBotScore.BAD
                description = ip_reputation["description"] = item["Malicious"]["Description"]
            else:
                score = Common.DBotScore.NONE
                demisto.debug(f"No Malicious Vendor {score=}")
        except LookupError:
            score = Common.DBotScore.NONE
        dbot_score = Common.DBotScore(
            indicator=item["Address"],
            indicator_type=DBotScoreType.IP,
            integration_name="Barracuda",
            malicious_description=description,
            score=score,
            reliability=demisto.params().get("integrationReliability"),
        )
        ip = Common.IP(ip=item["Address"], dbot_score=dbot_score)
        results = CommandResults(
            outputs_prefix="Barracuda." + str(command), outputs_key_field="indicator", outputs=ip_reputation, indicator=ip
        )
        return_results(results)


def get_ip_details(ip):
    finaldata = []
    listofips = str(ip).split(",")
    for item in listofips:
        reverselist = str(item).split(".")
        address = reverselist[3] + "." + reverselist[2] + "." + reverselist[1] + "." + reverselist[0] + ".b.barracudacentral.org"
        try:
            result = socket.gethostbyname(address)
            if result == "127.0.0.2":
                data = {
                    "Address": item,
                    "Malicious": {"Vendor": "Barracuda", "Description": "IP was found to be on the Barracuda(BRBL) block list"},
                }
                finaldata.append(data)
        except gaierror:
            data = {"Address": item}
            finaldata.append(data)
        except Exception as e:
            return_error(f"Error from Barracuda - {e!s}.")

    return finaldata


def test_module():
    """
    Returning 'ok' indicates that the integration works like it is supposed to. Connection to the service is successful.
    Returns:
        'ok' if test passed, anything else will fail the test.
    """
    result = socket.gethostbyname("www.barracudacentral.org")
    reverselist = str(result).split(".")
    address = reverselist[3] + "." + reverselist[2] + "." + reverselist[1] + "." + reverselist[0] + ".b.barracudacentral.org"
    try:
        testresult = socket.gethostbyname(address)
        return "Test Failed. Barracuda is blocklisted " + str(testresult)
    except gaierror:
        return "ok"
    except Exception as e:
        return f"Error from Barracuda - {e!s}."


def main():
    """
    PARSE AND VALIDATE INTEGRATION PARAMS
    """

    demisto.info(f"Command being called is {demisto.command()}")
    try:
        if demisto.command() == "test-module":
            # This is the call made when pressing the integration Test button.
            result = test_module()
            demisto.results(result)

        elif demisto.command() == "ip":
            results_return("IP", get_ip_details(demisto.args().get("ip")))

    # Log exceptions
    except Exception as e:
        return_error(f"Failed to execute {demisto.command()} command. Error: {e!s}")


if __name__ in ("__main__", "__builtin__", "builtins"):
    main()

Barracuda Reputation Block List - BRBL