Hudsonrock

Enrichment from Hudsonrock OSINT tools at https://cavalier.hudsonrock.com/api/json/v2/osint-tools/ Supports: IP, Email and Username.

Data Enrichment & Threat Intelligence · Hudsonrock

Details

IDHudsonrock
ProviderHudson Rock
CategoryData Enrichment & Threat Intelligence
From Version6.10.0
Docker Imagedemisto/python3:3.12.8.3296088
Supported ModulesAgentix XSIAM

README

HYAS Insight

Integration with Hudsonrock OSINT tools to check IP, Email or username usage.

Configure HYASInsight in Cortex

Parameter Required
url True
Trust any certificate (not secure) False
Use system proxy settings False
integrationReliability True

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

ip


Send IP reputation query.

Base Command

ip

Input

Argument Name Description Required
ip List of IPs. Required

Context Output

Path Type Description
Hudsonrock.IP string IP reputation.
IP.Address String IP address.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Score Number The actual score.
DBotScore.Reliability String Reliability of the source providing the intelligence data.

email


Send Email reputation query.

Base Command

email

Input

Argument Name Description Required
email List of emails. Required

Context Output

Path Type Description
Hudsonrock.Email string Email reputation.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Score Number The actual score.
DBotScore.Reliability String Reliability of the source providing the intelligence data.

hudsonrock-get-username


Send username reputation query.

Base Command

hudsonrock-get-username

Input

Argument Name Description Required
username Username to query. Required

Context Output

Path Type Description
Hudsonrock.Username string Username reputation.

Configuration parameters

  • url — Server URL (e.g. https://cavalier.hudsonrock.com/) (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • integrationReliability — Source Reliability (required)

Commands (3)

  • email

    Send Email reputation query.

  • hudsonrock-get-username

    Send username reputation query.

  • ip

    Send IP reputation query.

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401

""" CLIENT CLASS """


class Client(BaseClient):
    def __init__(self, base_url: str, headers: dict, proxy: bool = False, verify: bool = False):
        super().__init__(base_url=base_url, headers=headers, proxy=proxy, verify=verify)

    def query(self, suffix: str) -> Dict[str, Any]:
        return self._http_request(method="GET", url_suffix=suffix)


def test_module(client: Client, query: str) -> str:
    result = client.query(query)
    if result:
        return "ok"
    else:
        return "Test failed: " + str(result)


def create_indicator_output(results: Dict[str, Any], indicator: str, indicatortype: str, reliability: str) -> CommandResults:
    if indicatortype == "ip":
        indicator_type = DBotScoreType.IP
    else:
        indicator_type = DBotScoreType.EMAIL

    if "is associated" in results["message"]:
        dbot_score_object = Common.DBotScore(
            indicator=indicator, indicator_type=indicator_type, integration_name="Hudsonrock", score=3, reliability=reliability
        )
    else:
        dbot_score_object = Common.DBotScore(
            indicator=indicator, indicator_type=indicator_type, integration_name="Hudsonrock", score=0, reliability=reliability
        )
    indicator_to_return: Union[Common.IP, Common.EMAIL]
    if indicatortype == "ip":
        indicator_to_return = Common.IP(dbot_score=dbot_score_object, ip=indicator)
        outputs_prefix_end = "IP"
        results["ip"] = indicator
    else:
        indicator_to_return = Common.EMAIL(dbot_score=dbot_score_object, address=indicator)
        outputs_prefix_end = "Email"
        results["email"] = indicator

    human_readable = tableToMarkdown("Hudsonrock results", results)
    return CommandResults(
        outputs_prefix=f"Hudsonrock.{outputs_prefix_end}",
        outputs_key_field="indicator",
        outputs=results,
        indicator=indicator_to_return,
        readable_output=human_readable,
    )


def create_output(results: Dict[str, Any], endpoint: str, keyfield: str = "") -> CommandResults:
    human_readable = tableToMarkdown("Hudsonrock results", results)
    return CommandResults(
        outputs_prefix=f"Hudsonrock.{endpoint}", outputs_key_field=keyfield, outputs=results, readable_output=human_readable
    )


def main():
    base_url = demisto.params()["url"]
    full_url = f"{base_url}api/json/v2/osint-tools/"

    verify_certificate = not demisto.params().get("insecure", False)

    proxy = demisto.params().get("proxy", False)

    headers = {"Accept": "application/json"}
    reliability = demisto.params().get("integrationReliability", DBotScoreReliability.B)

    demisto.info(f"Command being called is {demisto.command()}")

    try:
        client = Client(base_url=full_url, verify=verify_certificate, headers=headers, proxy=proxy)
        args = demisto.args()

        if demisto.command() == "test-module":
            # This is the call made when pressing the integration Test button.
            query = "/search-by-ip?ip=127.0.0.1"
            testresult = test_module(client, query)
            return_results(testresult)
        elif demisto.command() == "ip":
            ip = argToList(args.get("ip"))
            for item in ip:
                query = f"/search-by-ip?ip={item}"
                result = client.query(query)
                return_results(create_indicator_output(result, item, "ip", reliability))
        elif demisto.command() == "email":
            email = argToList(args.get("email"))
            for item in email:
                query = f"/search-by-email?email={item}"
                result = client.query(query)
                return_results(create_indicator_output(result, item, "email", reliability))
        elif demisto.command() == "hudsonrock-get-username":
            username = args.get("username")
            query = f"/search-by-username?username={username}"
            result = client.query(query)
            return_results(create_output(result, username, "Username"))

    # Log exceptions
    except Exception as e:
        return_error(f"Failed to execute {demisto.command()} command. Error: {str(e)}")


if __name__ in ("__main__", "__builtin__", "builtins"):
    main()