GoogleSafeBrowsing Deprecated

Deprecated. Use Google Safe Browsing v2 instead.

Data Enrichment & Threat Intelligence · Google Safe Browsing

Details

IDGoogleSafeBrowsing
ProviderGoogle
CategoryData Enrichment & Threat Intelligence
From Version5.0.0
Supported ModulesAgentix XSIAM

README

Search Safe Browsing

Configure GoogleSafeBrowsing in Cortex

Parameter Description Required
API Key   True
Client ID   True
Client Version   True
Base URL   True
Source Reliability Reliability of the source providing the intelligence data. True
Use system proxy settings   False
Trust any certificate (not secure)   False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

url

Check URL Reputation

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

Base Command

url

Input

Argument Name Description Required
url URL to check. Required

Context Output

Path Type Description
URL.Data string Bad URLs found
URL.Malicious.Vendor string For malicious URLs, the vendor that made the decision
URL.Malicious.Description string For malicious URLs, the reason for the vendor to make the decision
DBotScore.Indicator string The indicator we tested
DBotScore.Type string The type of the indicator
DBotScore.Vendor string Vendor used to calculate the score
DBotScore.Score int The actual score
DBotScore.Reliability string Reliability of the source providing the intelligence data.

Command Example

!url url="http://testsafebrowsing.appspot.com/apiv4/ANY_PLATFORM/MALWARE/URL/"

Context Example

{
    "DBotScore": {
        "Indicator": "http://testsafebrowsing.appspot.com/apiv4/ANY_PLATFORM/MALWARE/URL/",
        "Reliability": "C - Fairly reliable",
        "Score": 3,
        "Type": "url",
        "Vendor": "GoogleSafeBrowsing"
    },
    "URL": {
        "Data": "http://testsafebrowsing.appspot.com/apiv4/ANY_PLATFORM/MALWARE/URL/",
        "Malicious": {
            "Description": "Match found: MALWARE/ANY_PLATFORM,MALWARE/WINDOWS,MALWARE/LINUX,MALWARE/ALL_PLATFORMS,MALWARE/OSX,MALWARE/CHROME",
            "Vendor": "GoogleSafeBrowsing"
        }
    }
}

Human Readable Output

Google Safe Browsing APIs - URL Query

Found matches for URL http://testsafebrowsing.appspot.com/apiv4/ANY_PLATFORM/MALWARE/URL/

cacheDuration platformType threat threatEntryType threatType
300s ANY_PLATFORM {“url”:”http://testsafebrowsing.appspot.com/apiv4/ANY_PLATFORM/MALWARE/URL/”} URL MALWARE
300s WINDOWS {“url”:”http://testsafebrowsing.appspot.com/apiv4/ANY_PLATFORM/MALWARE/URL/”} URL MALWARE
300s LINUX {“url”:”http://testsafebrowsing.appspot.com/apiv4/ANY_PLATFORM/MALWARE/URL/”} URL MALWARE
300s ALL_PLATFORMS {“url”:”http://testsafebrowsing.appspot.com/apiv4/ANY_PLATFORM/MALWARE/URL/”} URL MALWARE
300s OSX {“url”:”http://testsafebrowsing.appspot.com/apiv4/ANY_PLATFORM/MALWARE/URL/”} URL MALWARE
300s CHROME {“url”:”http://testsafebrowsing.appspot.com/apiv4/ANY_PLATFORM/MALWARE/URL/”} URL MALWARE

Configuration parameters

  • apiKey — API Key (required)
  • clientId — Client ID (required)
  • clientVer — Client Version (required)
  • url — Base URL (required)
  • integrationReliability — Source Reliability (required)
  • proxy — Use system proxy settings
  • insecure — Trust any certificate (not secure)

Commands (1)

  • url

    Check URL Reputation

Source

GoogleSafeBrowsing.js GoogleSafeBrowsing.yml GoogleSafeBrowsing_description.md
Download History Raw 
var apiKey = params.apiKey; var lookupUrl = params.url; if (lookupUrl[lookupUrl.length - 1] !== '/') {
    lookupUrl += '/';
} lookupUrl += "?key=" + apiKey;
var client = {
    clientId: params.clientId,
    clientVersion: params.clientVer
}
var types = {
    threatTypes:      ["MALWARE", "SOCIAL_ENGINEERING","POTENTIALLY_HARMFUL_APPLICATION","UNWANTED_SOFTWARE"],
    platformTypes:    ["ANY_PLATFORM","WINDOWS","LINUX","ALL_PLATFORMS","OSX","CHROME","IOS","ANDROID"]
}

var sendRequest = function(body) {
    var result = http(
        lookupUrl,
        {
            Headers: {
                'Content-Type': ['application/json'],
                'Accept': ['application/json']
            },
            Method: "POST",
            Body: JSON.stringify(body)
        },
        params.insecure,
        params.proxy
    );

    if (result.StatusCode < 200 && result.StatusCode > 299) {
        throw 'Failed to perform request ' + path + ', request status code: ' + result.StatusCode;
    }
    if (result.Body === '' && result.StatusCode == 204) {
        throw 'No content recieved. Possible API rate limit reached.';
    }
    if (result.Body === '') {
        throw 'No content recieved. Maybe you tried a private API?.';
    }
    var obj;
    try {
        obj = JSON.parse(result.Body);

    } catch (ex) {
        throw 'Error parsing reply - ' + result.Body + ' - ' + ex;
    }
    if (obj.error) {
        throw 'Failed accessing Google Safe Browsing APIs. Error: ' + obj.error.message + '. Error code: ' + obj.error.code;

    }
    return {body: result.Body, obj: obj, statusCode: result.StatusCode};
};
var checkURL = function(url) {
    var body = {
        "client": client,
        "threatInfo": {
            "threatTypes": types.threatTypes,
            "platformTypes": types.platformTypes,
            "threatEntryTypes": ["URL"],
            "threatEntries": [{"url": url}]
        }
    }
    var res = sendRequest(body);
    return res.obj;
}
var getThreats = function(matches) {
    return dq(matches,"[]=val.threatType+'/'+val.platformType");
}
var isValidReliability = function(reliability) {
    var reliability_options = ['A+ - 3rd party enrichment', 'A - Completely reliable', 'B - Usually reliable', 'C - Fairly reliable', 'D - Not usually reliable', 'E - Unreliable', 'F - Reliability cannot be judged'];
    return reliability_options.indexOf(reliability) >= 0;
}
switch (command) {
    case 'test-module':
        // testing a known malicous URL to check if we get matches
        var testUrl="http://testsafebrowsing.appspot.com/apiv4/ANY_PLATFORM/MALWARE/URL/";
        var res = checkURL(testUrl);
        if (res.matches) {
            return 'ok';
        } else {
            return 'Error querying Google Safe Browsing. Expected matching respons, but received none';
        }
        break;
    case 'url':
        var res = checkURL(args.url);
        var md = "### Google Safe Browsing APIs - URL Query\n";
        var ec = {};

        var reliability = params.integrationReliability;

        if(!reliability){
            reliability = 'B - Usually reliable';
        }
        if(!isValidReliability(reliability)) {
            return 'Error, Source Reliability value is invalid. Please choose from available reliability options.';
        }


        if (res.matches) {
            dbotScore=3;
            addMalicious(ec, outputPaths.url, {
                Data: args.url,
                Malicious: {Vendor: 'GoogleSafeBrowsing', Description: 'Match found: '+getThreats(res.matches)}
            });

            ec.DBotScore = {Indicator: args.url, Type: 'url', Vendor: 'GoogleSafeBrowsing', Score: dbotScore, Reliability: reliability};

            md += "#### Found matches for URL " + args.url + "\n";
            md += arrToMd(res.matches);
        } else {
            ec.DBotScore = {Indicator: args.url, Type: 'url', Vendor: 'GoogleSafeBrowsing', Score: 0};
            md += "#### No matches for URL " + args.url + "\n";
        }


        return {Type: entryTypes.note, Contents: res, ContentsFormat: formats.json, HumanReadable: md, EntryContext: ec};

        break;
    default:
        throw 'Unknown command - ' + command;
}