Feodo Tracker Hashes Feed Deprecated

Deprecated. Feodo Tracker no longer supports this feed. No available replacement.

Data Enrichment & Threat Intelligence · FeodoTracker Feed · Feed

Details

IDFeodo Tracker Hashes Feed
ProviderOpen Source
CategoryData Enrichment & Threat Intelligence
From Version5.5.0
Docker Imagedemisto/python3:3.10.13.74666
Supported ModulesAgentix XSIAM

Configuration parameters

  • feed — Fetch indicators
  • feedReputation — Indicator Reputation
  • feedReliability — Source Reliability (required)
  • tlp_color — Traffic Light Protocol Color
  • feedExpirationPolicy —
  • feedExpirationInterval —
  • feedFetchInterval — Feed Fetch Interval
  • feedBypassExclusionList — Bypass exclusion list
  • feedTags — Tags
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (1)

  • feodotracker-hashes-get-indicators

    Gets the feed indicators.

Source

FeedFeodoTrackerHashes.py FeedFeodoTrackerHashes.yml FeedFeodoTrackerHashes_description.md
Download History Raw 
from CommonServerPython import *


def main():
    params = {k: v for k, v in demisto.params().items() if v is not None}

    params['indicator_type'] = FeedIndicatorType.File
    params['indicator'] = json.dumps({
        "regex": r"^.+,(.+),",
        "transform": "\\1"
    })

    params['fields'] = json.dumps({
        "firstseenbysource": {
            "regex": r"^(\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2})",
            "transform": "\\1"
        },
        "malwarefamily": {
            "regex": r"^.+,.+,(.+)",
            "transform": "\\1"
        }
    })

    params['ignore_regex'] = '#'

    params['custom_fields_mapping'] = {
        "firstseenbysource": "firstseenbysource",
        "malwarefamily": "malwarefamily"
    }
    params['url'] = "https://feodotracker.abuse.ch/downloads/malware_hashes.csv"
    # Call the main execution of the HTTP API module.
    feed_main('Feodo Tracker Hashes Feed', params, 'feodotracker-hashes-')


from HTTPFeedApiModule import *  # noqa: E402


if __name__ == '__builtin__' or __name__ == 'builtins':
    main()