Cryptocurrency

Cryptocurrency will help classify Cryptocurrency indicators with the configured score when ingested.

Data Enrichment & Threat Intelligence · Cryptocurrency

Details

IDCryptocurrency
ProviderOpen Source
CategoryData Enrichment & Threat Intelligence
From Version5.0.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

Cryptocurrency will help classify Cryptocurrency indicators as suspicious when ingested.

Configure Cryptocurrency in Cortex

Parameter Description Required
reliability Source Reliability False
reputation Reputation False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

crypto


Return Cryptocurrency reputation.

Base Command

crypto

Input

Argument Name Description Required
crypto List of cryptocurrency addresses. Optional
address_type The cryptocurrency address type, if known. e.g. ‘bitcoin’. Possible values are: bitcoin. Optional

Context Output

Path Type Description
DBotScore.Indicator string The indicator that was tested.
DBotScore.Score number The actual score.
DBotScore.Type string The indicator type.
DBotScore.Vendor string The vendor used to calculate the score.
Cryptocurrency.Address string The cryptocurrency address.
Cryptocurrency.AddressType string The cryptocurrency type. e.g. ‘bitcoin’.

Command Example

!crypto crypto=bitcoin:1AGNa15ZQXAZUgFiqJ2i7Z2DPU2J6hW62i

Context Example

{
    "Cryptocurrency": {
        "Address": "bitcoin:1AGNa15ZQXAZUgFiqJ2i7Z2DPU2J6hW62i",
        "AddressType": "bitcoin"
    },
    "DBotScore": {
        "Indicator": "bitcoin:1AGNa15ZQXAZUgFiqJ2i7Z2DPU2J6hW62i",
        "Reliability": "B - Usually reliable",
        "Score": 2,
        "Type": "cryptocurrency",
        "Vendor": "Cryptocurrency"
    }
}

Human Readable Output

Cryptocurrency reputation for bitcoin:1AGNa15ZQXAZUgFiqJ2i7Z2DPU2J6hW62i

Address Cryptocurrency Address Type Reputation
bitcoin:1AGNa15ZQXAZUgFiqJ2i7Z2DPU2J6hW62i bitcoin Suspicious

Configuration parameters

  • reliability — Source Reliability
  • reputation — Reputation

Commands (1)

  • crypto

    Return Cryptocurrency reputation.

import demistomock as demisto
import urllib3
from CommonServerPython import *

# Disable insecure warnings
urllib3.disable_warnings()

""" CONSTANTS """

DATE_FORMAT = "%Y-%m-%dT%H:%M:%SZ"
BITCOIN = "bitcoin"
INTEGRATION_NAME = "Cryptocurrency"
SCORE = {
    "None": 0,
    "Good": 1,
    "Suspicious": 2,
    "Bad": 3,
}


def get_bitcoin_reputation(addresses, reliability, reputation, score) -> list[CommandResults]:
    command_results: list[CommandResults] = []
    for address in addresses:
        dbot_score = Common.DBotScore(
            indicator=address,
            indicator_type=DBotScoreType.CRYPTOCURRENCY,
            integration_name=INTEGRATION_NAME,  # Vendor
            score=score,
            reliability=reliability,
        )
        crypto_context = Common.Cryptocurrency(
            address=address,
            address_type=BITCOIN,
            dbot_score=dbot_score,
        )
        table_data = {
            "Address": address,
            "Cryptocurrency Address Type": BITCOIN,
            "Reputation": reputation,
        }
        table_name = f"{INTEGRATION_NAME} reputation for {address}"
        hr = tableToMarkdown(table_name, table_data)

        command_results.append(
            CommandResults(
                outputs_prefix="Cryptocurrency",
                readable_output=hr,
                outputs_key_field="Address",
                indicator=crypto_context,
            )
        )
    return command_results


def crypto_reputation_command(args: dict[str, str], reliability: str, reputation: str):
    crypto_addresses = argToList(args.get("crypto", ""))

    # For cases the command was executed by a playbook/user and the addresses received are verified
    # Stripping the `bitcoin` prefix from the given addresses (if exists) then add it to match the convention.
    if args.get("address_type") == BITCOIN:
        bitcoin_addresses = [f'bitcoin:{address.lstrip("bitcoin:")}' for address in crypto_addresses]  # noqa: B005

    else:
        bitcoin_addresses = [address for address in crypto_addresses if BITCOIN in address]

    score = SCORE[reputation]
    result = get_bitcoin_reputation(bitcoin_addresses, reliability, reputation, score)

    return result


def main():
    params = demisto.params()
    reliability = params["reliability"]
    reputation = params["reputation"]

    demisto.info(f"Command being called is {demisto.command()}")
    try:
        if demisto.command() == "test-module":
            return_results("ok")

        elif demisto.command() == "crypto":
            return_results(crypto_reputation_command(demisto.args(), reliability, reputation))

    # Log exceptions and return errors
    except Exception as e:
        return_error(f"Failed to execute {demisto.command()} command.\nError:\n{e!s}")


""" ENTRY POINT """

if __name__ in ("__main__", "__builtin__", "builtins"):
    main()