Blueliv_Beta Deprecated

Deprecated. No available replacement.

Data Enrichment & Threat Intelligence · Blueliv (Beta) (Deprecated)

Details

IDBlueliv_Beta
ProviderOutpost24
CategoryData Enrichment & Threat Intelligence
From Version5.0.0
Docker Imagedemisto/blueliv:1.0.0.76921
Supported ModulesAgentix XSIAM

Configuration parameters

  • url — Server URL (e.g., https://api.blueliv.com) (required)
  • token — API Token
  • credentials_token —
  • proxy — Use system proxy settings

Commands (5)

  • blueliv-get-attackingips-feed Deprecated

    Data set collection that gives the latest STIX Indicators about attacking IPs gathered and analyzed by Blueliv.

  • blueliv-get-botips-feed Deprecated

    Data set collection that gives the latest STIX Indicators about bot ips gathered by Blueliv.

  • blueliv-get-crimeservers-feed Deprecated

    Data set collection that gives the latest STIX Indicators about known malicious servers gathered by Blueliv.

  • blueliv-get-hacktivism-feed Deprecated

    Data related to the number of hacktivism tweets recently created. Blueliv provides two types of feeds: the first one contains the most popular hacktivism hashtags and the second one contains the countries where more number of hacktivism tweets are coming from.

  • blueliv-get-malware-feed Deprecated

    Data set collection that gives the latest STIX Indicators about malware hashes gathered and analyzed by Blueliv.

Source

Blueliv.py Blueliv.yml Blueliv_description.md
Download History Raw 
import demistomock as demisto
from CommonServerPython import *
from CommonServerUserPython import *
''' IMPORTS '''

from sdk.blueliv_api import BluelivAPI

''' GLOBALS/PARAMS '''

TOKEN = demisto.params().get('credentials_token', {}).get('password') or demisto.params().get('token')
if not TOKEN:
    raise DemistoException('API Token must be provided.')
URL = demisto.params()['url']
SERVER = URL[:-1] if URL.endswith('/') else URL

if not demisto.params().get('proxy', False):
    del os.environ['HTTP_PROXY']
    del os.environ['HTTPS_PROXY']
    del os.environ['http_proxy']
    del os.environ['https_proxy']

''' HELPER FUNCTIONS '''


def verify_response_code(response):

    if response.status_code != 200:
        raise ValueError(response.error_msg)


''' COMMANDS + REQUESTS FUNCTIONS '''


def test_module():

    response = api.crime_servers.last('all')
    verify_response_code(response)
    demisto.results('ok')


def get_botips_feed_command():

    response = api.bot_ips.recent('full')
    verify_response_code(response)
    human_readable = tableToMarkdown('Bot IP feed', response.items)
    return_outputs(human_readable, {})


def get_crimeservers_feed_command():

    response = api.crime_servers.last('all')
    verify_response_code(response)
    human_readable = tableToMarkdown('Crimeservers feed', response.items)
    return_outputs(human_readable, {})


def get_malware_feed_command():

    response = api.malwares.recent('all')
    verify_response_code(response)
    human_readable = tableToMarkdown('Malware feed', response.items)
    return_outputs(human_readable, {})


def get_attackingips_feed_command():

    response = api.attacking_ips.recent('all')
    verify_response_code(response)
    human_readable = tableToMarkdown('Attacking IPs feed', response.items)
    return_outputs(human_readable, {})


def get_hacktivism_feed_command():

    response = api.hacktivism_ops.last('all')
    verify_response_code(response)
    human_readable = tableToMarkdown('Hacktivism feed', response.items)
    return_outputs(human_readable, {})


''' COMMANDS MANAGER / SWITCH PANEL '''

COMMANDS = {
    'test-module': test_module,
    'blueliv-get-botips-feed': get_botips_feed_command,
    'blueliv-get-crimeservers-feed': get_crimeservers_feed_command,
    'blueliv-get-malware-feed': get_malware_feed_command,
    'blueliv-get-attackingips-feed': get_attackingips_feed_command,
    'blueliv-get-hacktivism-feed': get_hacktivism_feed_command
}

try:
    api = BluelivAPI(
        base_url=SERVER,
        token=TOKEN
    )
    LOG('Command being called is {}'.format(demisto.command()))
    command_func = COMMANDS.get(demisto.command())
    if command_func is not None:
        command_func()
except Exception as e:
    return_error(str(e))