Popular News
Popular News integration fetches from three sources of news - Threatpost, The Hacker News and Krebs on Security. It outputs the title, links of the news articles and other metadata as a markdown table. The integration commands can either fetch the news from one source or all sources at a time.
Utilities · Popular Cybersecurity News
Details
| ID | Popular News |
|---|---|
| Provider | Open Source |
| Category | Utilities |
| From Version | 6.0.0 |
| Docker Image | demisto/bs4-py3:1.0.0.10120494 |
| Supported Modules | Agentix XSIAM |
README
How to use this integration ?
- Enable the “Popular News” integration.
- Create a Job that creates an incident of - “News Type” included along with the Popular Cybersecurity News Pack.
- The News Type incident will run the “JOB Popular News” playbook automatically and populate the “News Tab” where the links can be looked at.
- Additionally, the playbook allows the user to configure to choose between the three sources using the Playbook inputs.
This integration was integrated and tested with version 1.0.0 of Popular News
Configure Popular News in Cortex
| Parameter | Required |
|---|---|
| False |
Commands
You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
get-news-KrebsOnSecurity
Get News from KrebsOnSecurity
Base Command
get-news-KrebsOnSecurity
Input
| Argument Name | Description | Required |
| — | — | — |
Context Output
There is no context output for this command.
Command Example
#### Human Readable Output
### get-news-Threatpost
***
Get News from Threatpost
#### Base Command
`get-news-Threatpost`
#### Input
| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
#### Context Output
There is no context output for this command.
#### Command Example
Human Readable Output
get-news-TheHackerNews
Get News from TheHackerNews
Base Command
get-news-TheHackerNews
Input
| Argument Name | Description | Required |
| — | — | — |
Context Output
There is no context output for this command.
Command Example
#### Human Readable Output
### get-news-generic-all
***
Get News from all outlets
#### Base Command
`get-news-generic-all`
#### Input
| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
#### Context Output
There is no context output for this command.
#### Command Example
Human Readable Output
Configuration parameters
insecure— Trust any certificate (not secure)
Commands (4)
-
get-news-KrebsOnSecurityGet News from KrebsOnSecurity
-
get-news-TheHackerNewsGet News from TheHackerNews
-
get-news-ThreatpostGet News from Threatpost
-
get-news-generic-allGet News from all outlets
import demistomock as demisto # noqa: F401 import requests from bs4 import BeautifulSoup, Tag from CommonServerPython import * # noqa: F401 TABLE = [] VERIFY = demisto.params()["insecure"] def scrape_kos(): articles = [] links = [] dates = [] response = requests.get("https://krebsonsecurity.com/", verify=VERIFY) soup = BeautifulSoup(response.text, "html.parser") for article in soup.select(".entry-title"): link_tag = article.find("a") if not isinstance(link_tag, Tag): # Title without a link - skip to keep titles and links aligned continue title = article.get_text().strip() articles.append(title) link = link_tag.attrs["href"] links.append(link) for date in soup.select(".adt"): date_span = date.find("span") if isinstance(date_span, Tag): dates.append(date_span.get_text().strip()) return list(zip(articles, list(zip(links, dates)))) def scrape_thn(): articles = [] links = [] dates = [] response = requests.get("https://thehackernews.com/", verify=VERIFY) soup = BeautifulSoup(response.text, "html.parser") for article in soup.select(".home-title"): articles.append(article.get_text().strip()) for link in soup.select(".story-link"): links.append(link["href"]) for date in soup.select(".item-label"): date_got = date.get_text().split(",")[0][1:] # February 23 dates.append(date_got) return list(zip(articles, list(zip(links, dates)))) def scrape_tp(): articles = [] links = [] dates = [] response = requests.get("https://threatpost.com/", verify=VERIFY) soup = BeautifulSoup(response.text, "html.parser") for article in soup.select(".c-card__title"): link_tag = article.find("a") if not isinstance(link_tag, Tag): # Title without a link - skip to keep titles and links aligned continue articles.append(article.get_text().strip()) links.append(link_tag.attrs["href"]) for date in soup.select(".c-card__time"): dates.append(date.get_text().strip()) return list(zip(articles, list(zip(links, dates)))) def aggregate(feed, source): for elem in feed: clickable_link = "[" + elem[1][0] + "](" + elem[1][0] + ")" TABLE.append({"Article": elem[0], "Link": clickable_link, "Date": elem[1][1], "Source": source}) def main(): # # The command demisto.command() holds the command sent from the user. if demisto.command() == "get-news-KrebsOnSecurity": kos = scrape_kos() aggregate(kos, "Krebs on Security") elif demisto.command() == "get-news-Threatpost": tp = scrape_tp() aggregate(tp, "Threatpost") elif demisto.command() == "get-news-TheHackerNews": thn = scrape_thn() aggregate(thn, "The Hacker News") elif demisto.command() == "test-module": # This is the call made when pressing the integration test button. test_response = requests.get("https://thehackernews.com/", verify=VERIFY) if str(test_response.status_code) == "200": demisto.results("ok") else: demisto.results(test_response) elif demisto.command() == "get-news-generic-all": tp = scrape_tp() thn = scrape_thn() kos = scrape_kos() aggregate(kos, "Krebs on Security") aggregate(thn, "The Hacker News") aggregate(tp, "Threatpost") else: raise NotImplementedError(f"Command {demisto.command()} was not implemented.") result = { "ContentsFormat": formats["table"], "Type": entryTypes["note"], "Contents": TABLE, "EntryContext": {}, "IgnoreAutoExtract": True, } if TABLE: result["ReadableContentsFormat"] = formats["markdown"] result["HumanReadable"] = tableToMarkdown("Your popular cybersecurity digest", TABLE, ["Article", "Link", "Date"]) result["EntryContext"] = {"News": TABLE} demisto.results(result) if __name__ in ("__main__", "__builtin__", "builtins"): main()