IsItPhishing

var auth = 'Bearer ' + btoa(
    params.credentials 
    ? params.credentials.identifier + ':' + params.credentials.password 
    :  params.name + ':' + params.license
);

var sendRequest = function(method, api, body) {
    var url = params.url;
    var requestUrl = url.replace(/[\/]+$/, '') + '/' + api;
    var res = http(
        requestUrl,
        {
            Method: method,
            Headers: {
                'Authorization': [auth],
                'Content-Type': ['application/x-www-form-urlencoded']
            },
            Body: encodeToURLQuery(body).substring(1)
        },
        params.insecure,
        params.proxy
    );

    if (res.StatusCode < 200 || res.StatusCode >= 300) {
        throw 'Request Failed.\nStatus code: ' + res.StatusCode + '.\nBody: ' + JSON.stringify(res) + '.';
    }

    return res;
};

var isPhishing = function(url, force, smart, area, timeout) {
    var urls = url.split(',')
    var results = new Array(urls.length)
    for (var i = 0; i < urls.length; i++) {
        var md;
        var body = {
            name: params.credentials ? params.credentials.identifier : params.name,
            license: params.credentials  ? params.credentials.password : params.license,
            version: '2',
            force: force,
            url: urls[i],
            area: area,
            timeout: timeout
        };
        if (!area) {
            delete body.area;
        }
        if (!timeout) {
            delete body.timeout;
        }
        var res = sendRequest('POST', 'check', body);
        var ec = {
            IsItPhishing: {Url: urls[i]},
            DBotScore: {
                Indicator: urls[i],
                Score: 0,
                Type: 'url',
                Vendor: 'IsItPhishing',
                Reliability: params.integrationReliability
            }
        };
        var resBody = res.Body.trim();

        if (resBody.substring(0,17) == 'TOO_MANY_REQUESTS') {
        md = 'You have reached the maximum number of requests for your license. You must wait for the returned period of time' + resBody.substring(17) + 'before running requests again.';
        ec.IsItPhishing.Status = 'TOO_MANY_REQUESTS';
        }
        if (resBody.substring(0,5) == 'ERROR') {
        md = 'An error has occurred. Please refer to the description of the error indicated in the' + resBody.substring(0,5) + 'value.';
        ec.IsItPhishing.Status = 'ERROR';
        }

        switch (resBody){
            case 'SPAM':
                md = 'URL was identified as spam.';
                ec.IsItPhishing.Status = 'SPAM';
                ec.DBotScore.Score = 2;
                addMalicious(ec, outputPaths.url, {
                Data: urls[i],
                Malicious: {Vendor: 'IsItPhishing', Description: 'URL found as spam by IsItPhishing'}
                });
                break;
            case 'PHISHING':
                md = 'URL was identified as phishing.';
                ec.IsItPhishing.Status = 'PHISHING';
                ec.DBotScore.Score = 3;
                addMalicious(ec, outputPaths.url, {
                Data: urls[i],
                Malicious: {Vendor: 'IsItPhishing', Description: 'URL found as phishing by IsItPhishing'}
                });
                break;
            case 'UNKNOWN':
                md = 'URL is clean.';
                ec.IsItPhishing.Status = 'CLEAN';
                ec.DBotScore.Score = 1;
                break;
            case 'TIMEOUT':
                md = 'Timeout for the request has been reached. No verdict was returned for the request, and the URL should be considered clean.';
                ec.IsItPhishing.Status = 'TIMEOUT';
                break;
            case 'NOT_EXPLORED':
                md = 'The URL was not analyzed as triggering the analysis may cause collateral damage (unsubscribe, order conformation, etc.)';
                ec.IsItPhishing.Status = 'NOT_EXPLORED';
                break;
            case 'NOT_AUTHORIZED':
                md = 'Authorization has failed for one of the following reasons:\n• Invalid customer name,\n• Invalid customer license.';
                ec.IsItPhishing.Status = 'NOT_AUTHORIZED';
                break;
            case 'REVOKED':
                md = 'The license provided is no longer valid for one of the following reasons:\n• Validity period has expired,\n• License has been revoked.';
                ec.IsItPhishing.Status = 'REVOKED';
                break;
        }

        results[i] = {Type: entryTypes.note, Contents: resBody, ContentsFormat: formats.text, HumanReadable: md, EntryContext: ec, HumanReadableFormat: formats.text};
    }
    return results
};

switch (command) {
    case 'test-module':
        return 'ok';
    case 'url':
        return isPhishing(args.url, args.force, args.smart, args.area, args.timeout);
    default:
}