TruSTAR Deprecated

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401
import base64
import collections
import time

import requests

import trustar

''' IMPORTS '''

handle_proxy()

# disable insecure warnings
requests.packages.urllib3.disable_warnings()

''' GLOBAL VARS '''
SERVER = demisto.params()['server']
API_KEY = str(demisto.params()['key'])
API_SECRET = str(demisto.params()['secret'])
BASE_URL = SERVER + '/api/1.3'
INSECURE = demisto.params()['insecure']

''' HELPER FUNCTIONS '''


def translate_indicators(ts_indicators, context_path=''):
    if context_path and context_path[-1] != '.':
        context_path += '.'
    indicators = []
    file_context = []
    url_context = []
    ip_context = []
    email_context = []
    key_context = []
    cve_context = []
    for indicator in ts_indicators:
        current_indicator = indicator if isinstance(indicator, dict) else indicator.to_dict(remove_nones=True)
        indicator_type = current_indicator['indicatorType']
        value = current_indicator['value']
        if indicator_type == 'SOFTWARE':
            # Extracts the filename out of file path
            if "\\" in r"%r" % value:
                file_name = value.split('\\')[-1]  # Handles file path with backslash
            else:
                file_name = value.split('/')[-1]  # Handles file path with slash
            current_indicator['value'] = file_name
            context_dict = {'Name': file_name}
            file_context.append(context_dict)
        elif indicator_type in {'SHA256', 'SHA1', 'MD5'}:
            context_dict = {indicator_type: value}
            file_context.append(context_dict)
        elif indicator_type == 'URL':
            context_dict = {'Address': value}
            url_context.append(context_dict)
        elif indicator_type == 'IP':
            context_dict = {'Address': value}
            ip_context.append(context_dict)
        elif indicator_type == 'EMAIL_ADDRESS':
            context_dict = {'Address': value}
            email_context.append(context_dict)
        elif indicator_type == 'REGISTRY_KEY':
            context_dict = {'Path': value}
            key_context.append(context_dict)
        elif indicator_type == 'CVE':
            context_dict = {'ID': value}
            cve_context.append(context_dict)
        indicators.append(current_indicator)
    # Build Entry Context
    ec = {}
    if file_context:
        ec['{}File(val.Name && val.Name === obj.Name)'.format(context_path)] = file_context
    if url_context:
        ec['{}URL(val.Address && val.Address === obj.Address)'.format(context_path)] = url_context
    if ip_context:
        ec['{}IP(val.Address && val.Address === obj.Address)'.format(context_path)] = ip_context
    if email_context:
        ec['{}Account.Email(val.Address && val.Address === obj.Address)'.format(context_path)] = email_context
    if key_context:
        ec['{}RegistryKey(val.Path && val.Path === obj.Path)'.format(context_path)] = key_context
    if cve_context:
        ec['{}CVE(val.ID && val.ID === obj.ID)'.format(context_path)] = cve_context
    return indicators, ec


def translate_triage_submission(submissions):
    submission_dicts = [s.to_dict(remove_nones=True) for s in submissions]
    ec = {'TruSTAR.PhishingSubmission(val.submissionId == obj.submissionId)': submission_dicts}
    return submission_dicts, ec


def translate_phishing_indicators(indicators):
    indicator_dicts = [i.to_dict(remove_nones=True) for i in indicators]
    ec = {'TruSTAR.PhishingIndicator(val.value == obj.value)': indicator_dicts}
    return indicator_dicts, ec


def translate_specific_indicators(ts_indicators, specific_types):
    res = []
    for indicator in ts_indicators:
        current_indicator = indicator.to_dict(remove_nones=True)
        indicator_type = current_indicator['indicatorType']
        value = current_indicator['value']
        whitelisted = current_indicator.get('whitelisted')
        if indicator_type in specific_types:
            res.append({
                'value': value,
                'whitelisted': whitelisted,
                'indicatorType': indicator_type
            })
    return res


def priority_level_to_score(priority_level):
    if priority_level == 'LOW':
        return 1
    elif priority_level == 'MEDIUM':
        return 2
    elif priority_level == 'HIGH':
        return 3
    return 0


def normalize_time(timestamp):
    '''
    Converts unix epoch time to GMT
    '''
    if isinstance(timestamp, str):
        return timestamp
    return time.strftime('%Y-%m-%d %H:%M:%S', time.gmtime(timestamp / 1000.0))


def date_to_unix(timestamp):
    d = datetime.strptime(timestamp, "%Y-%m-%d %H:%M:%S")
    return int(d.strftime("%s")) * 1000


def create_file_ec(indicators, file, threshold):
    '''DEPRECATED this function relies on priorityLevel score which TruSTAR no longer supports.
    This function will be removed in a future release
    '''
    if not indicators:
        return {
            'DBotScore': {
                'Indicator': file,
                'Type': 'file',
                'Score': 0,
                'Vendor': 'TruSTAR',
            }
        }
    trustar_ec = {}
    file_ec = {}
    dbot_ec = {}
    for indicator in indicators:
        file_ec.update({
            indicator['indicatorType']: indicator['value'],
        })
        trustar_ec.update({
            'Value': indicator['value'],
            'Whitelisted': indicator['whitelisted'],
            'Priority': indicator['priorityLevel']
        })
        indicator_score = priority_level_to_score(indicator['priorityLevel'])
        dbot_ec.update({
            'Indicator': file,
            'Type': 'file',
            'Vendor': 'TruSTAR',
            'Score': 0 if indicator_score == 0 else (2 if threshold > indicator_score else 3)
        })
        if threshold <= indicator_score:
            file_ec.update({
                'Malicious': {
                    'Vendor': 'TruSTAR',
                    'Description': 'Priority level above {0}'.format(indicator['priorityLevel'])
                }
            })
    return {
        outputPaths['dbotscore']: dbot_ec,
        outputPaths['file']: file_ec,
        'TruSTAR.File(val.Value === obj.Value)': trustar_ec
    }


def create_ip_ec(indicators, ip, threshold):
    '''DEPRECATED this function relies on priorityLevel score which TruSTAR no longer supports.
    This function will be removed in a future release
    '''
    if not indicators:
        return {
            'DBotScore': {
                'Indicator': ip,
                'Type': 'ip',
                'Score': 0,
                'Vendor': 'TruSTAR',
            }
        }
    trustar_ec = {}
    ip_ec = {}
    dbot_ec = {}
    for indicator in indicators:
        ip_ec.update({
            'Address': indicator['value'],
        })
        trustar_ec.update({
            'Value': indicator['value'],
            'Whitelisted': indicator['whitelisted'],
            'Priority': indicator['priorityLevel']
        })
        indicator_score = priority_level_to_score(indicator['priorityLevel'])
        dbot_ec.update({
            'Indicator': ip,
            'Type': 'ip',
            'Vendor': 'TruSTAR',
            'Score': 0 if indicator_score == 0 else (2 if threshold > indicator_score else 3)
        })
        if threshold <= indicator_score:
            ip_ec.update({
                'Malicious': {
                    'Vendor': 'TruSTAR',
                    'Description': 'Priority level above {0}'.format(indicator['priorityLevel'])
                }
            })
    return {
        outputPaths['dbotscore']: dbot_ec,
        outputPaths['ip']: ip_ec,
        'TruSTAR.IP(val.Value === obj.Value)': trustar_ec
    }


def create_url_ec(indicators, url, threshold):
    '''DEPRECATED this function relies on priorityLevel score which TruSTAR no longer supports.
    This function will be removed in a future release
    '''
    if not indicators:
        return {
            'DBotScore': {
                'Indicator': url,
                'Type': 'url',
                'Score': 0,
                'Vendor': 'TruSTAR',
            }
        }
    trustar_ec = {}
    url_ec = {}
    dbot_ec = {}
    for indicator in indicators:
        url_ec.update({
            'Data': indicator['value'],
        })
        trustar_ec.update({
            'Value': indicator['value'],
            'Whitelisted': indicator['whitelisted'],
            'Priority': indicator['priorityLevel']
        })
        indicator_score = priority_level_to_score(indicator['priorityLevel'])
        dbot_ec.update({
            'Indicator': url,
            'Type': 'url',
            'Vendor': 'TruSTAR',
            'Score': 0 if indicator_score == 0 else (2 if threshold > indicator_score else 3)
        })
        if threshold <= indicator_score:
            url_ec.update({
                'Malicious': {
                    'Vendor': 'TruSTAR',
                    'Description': 'Priority level above {0}'.format(indicator['priorityLevel'])
                }
            })
    return {
        outputPaths['dbotscore']: dbot_ec,
        outputPaths['url']: url_ec,
        'TruSTAR.URL(val.Value === obj.Value)': trustar_ec
    }


def create_domain_ec(indicators, url, threshold):
    '''DEPRECATED this function relies on priorityLevel score which TruSTAR no longer supports.
    This function will be removed in a future release
    '''
    if not indicators:
        return {
            'DBotScore': {
                'Indicator': url,
                'Type': 'domain',
                'Score': 0,
                'Vendor': 'TruSTAR',
            }
        }
    trustar_ec = {}
    domain_ec = {}
    dbot_ec = {}
    for indicator in indicators:
        domain_ec.update({
            'Name': indicator['value'],
        })
        trustar_ec.update({
            'Value': indicator['value'],
            'Whitelisted': indicator['whitelisted'],
            'Priority': indicator['priorityLevel']
        })
        indicator_score = priority_level_to_score(indicator['priorityLevel'])
        dbot_ec.update({
            'Indicator': url,
            'Type': 'domain',
            'Vendor': 'TruSTAR',
            'Score': 0 if indicator_score == 0 else (2 if threshold > indicator_score else 3)
        })
        if threshold <= indicator_score:
            domain_ec.update({
                'Malicious': {
                    'Vendor': 'TruSTAR',
                    'Description': 'Priority level above {0}'.format(indicator['priorityLevel'])
                }
            })
    return {
        outputPaths['dbotscore']: dbot_ec,
        outputPaths['domain']: domain_ec,
        'TruSTAR.Domain(val.Value === obj.Value)': trustar_ec
    }


def encode_cursor(page_size, page_number):
    cursor = '{' + '"pageSize":{},"pageNumber":{}'.format(page_size, page_number) + '}'
    return base64.b64encode(cursor.encode()).decode()


''' FUNCTIONS '''


def get_related_indicators(indicators, enclave_ids, page_size, page_number):
    # To display priority score
    items_list = []
    related_indicator_response = ts.get_related_indicators_page(indicators, enclave_ids, page_size, page_number)
    for related_indicator in related_indicator_response:
        current_indicator = related_indicator.to_dict(remove_nones=True)
        search_indicator_response = ts.search_indicators_page(current_indicator['value'], enclave_ids, page_size,
                                                              page_number)
        for found_indicator in search_indicator_response:
            current_found_indicator = found_indicator.to_dict(remove_nones=True)
            if current_indicator['value'] == current_found_indicator['value']:
                break
        items_list.append(current_indicator)
    related_indicators, ec = translate_indicators(items_list)
    if related_indicators:
        title = 'TruSTAR indicators related to ' + indicators
        entry = {
            'Type': entryTypes['note'],
            'Contents': related_indicators,
            'ContentsFormat': formats['json'],
            'ReadableContentsFormat': formats['markdown'],
            'HumanReadable': tableToMarkdown(title, related_indicators),
            'EntryContext': ec
        }
    else:
        entry = 'No indicators related to ' + indicators + ' were found.'
    return entry


def get_trending_indicators(indicator_type, days_back):
    if indicator_type == 'other':
        indicator_type = None
    response = ts.get_community_trends(indicator_type, days_back)
    trending_indicators, ec = translate_indicators(response)
    if trending_indicators:
        title = 'TruSTAR Community Trending Indicators'
        entry = {
            'Type': entryTypes['note'],
            'Contents': trending_indicators,
            'ContentsFormat': formats['json'],
            'ReadableContentsFormat': formats['markdown'],
            'HumanReadable': tableToMarkdown(title, trending_indicators),
            'EntryContext': ec
        }
        return entry
    return 'No trending indicators were found.'


def search_indicators(search_term, enclave_ids, page_size, page_number):
    response = ts.search_indicators_page(search_term, enclave_ids, page_size, page_number)
    indicators, ec = translate_indicators(response)
    if indicators:
        title = 'TruSTAR indicators that contain the term ' + search_term
        entry = {
            'Type': entryTypes['note'],
            'Contents': indicators,
            'ContentsFormat': formats['json'],
            'ReadableContentsFormat': formats['markdown'],
            'HumanReadable': tableToMarkdown(title, indicators),
            'EntryContext': ec
        }
        return entry
    return 'No indicators were found.'


def generic_search_indicator(search_term, threshold, search_type, ec_function):
    if demisto.args().get('threshold'):
        threshold = demisto.args().get('threshold')
    response = ts.search_indicators_page(search_term=search_term)
    indicators = translate_specific_indicators(response, search_type)
    threshold = priority_level_to_score(threshold)
    title = 'TruSTAR results for {0} indicator: {1}'.format(search_type[0], search_term)
    ec = ec_function(indicators, search_term, threshold)
    entry = {
        'Type': entryTypes['note'],
        'Contents': indicators,
        'ContentsFormat': formats['json'],
        'ReadableContentsFormat': formats['markdown'],
        'HumanReadable': tableToMarkdown(title, indicators),
        'EntryContext': ec
    }
    return entry


def submit_report(title, report_body, enclave_ids, external_url, time_began, distribution_type):
    if distribution_type == 'ENCLAVE' and enclave_ids is None:
        return 'Distribution type is ENCLAVE, but no enclave ID was given.'
    ts_report = trustar.models.Report(
        title=title,
        body=report_body,
        enclave_ids=[enclave_ids] if enclave_ids else enclave_ids,
        is_enclave=True if distribution_type == 'ENCLAVE' else False,
        time_began=time_began,
        external_url=external_url
    )
    response = ts.submit_report(ts_report)
    deep_link = '{server_url}/constellation/reports/{report_id}'.format(server_url=SERVER, report_id=response.id)
    report = collections.OrderedDict()  # type: OrderedDict
    report['id'] = response.id
    report['reportTitle'] = title
    report['reportDeepLink'] = '[{}]({})'.format(deep_link, deep_link)
    report['reportBody'] = report_body
    ec = {
        'TruSTAR.Report(val.id && val.id === obj.id)': report
    }
    title = 'TruSTAR report was successfully created'
    entry = {
        'Type': entryTypes['note'],
        'Contents': report,
        'ContentsFormat': formats['json'],
        'ReadableContentsFormat': formats['markdown'],
        'HumanReadable': tableToMarkdown(title, report),
        'EntryContext': ec
    }
    return entry


def update_report(report_id, title, report_body, enclave_ids, external_url, time_began, distribution_type):
    ts_report = trustar.models.Report(
        id=report_id,
        title=title,
        body=report_body,
        enclave_ids=[enclave_ids] if enclave_ids else enclave_ids,
        is_enclave=True if distribution_type == 'ENCLAVE' else False,
        time_began=time_began,
        external_url=external_url
    )
    ts.update_report(ts_report)
    deep_link = '{server_url}/constellation/reports/{report_id}'.format(server_url=SERVER, report_id=report_id)
    report = collections.OrderedDict()  # type: OrderedDict
    report['id'] = report_id
    report['reportTitle'] = title
    report['reportDeepLink'] = '[{}]({})'.format(deep_link, deep_link)
    report['reportBody'] = report_body
    ec = {
        'TruSTAR.Report(val.id && val.id === obj.id)': report
    }
    title = 'TruSTAR report was successfully updated'
    entry = {
        'Type': entryTypes['note'],
        'Contents': report,
        'ContentsFormat': formats['json'],
        'ReadableContentsFormat': formats['markdown'],
        'HumanReadable': tableToMarkdown(title, report),
        'EntryContext': ec
    }
    return entry


def get_report_details(report_id, id_type):
    response = ts.get_report_details(report_id, id_type)
    current_report_dict = response.to_dict(remove_nones=True)
    report_details = collections.OrderedDict()  # type: OrderedDict
    report_details['id'] = current_report_dict['id']
    report_details['title'] = current_report_dict['title']
    deep_link = '{server_url}/constellation/reports/{report_id}'.format(server_url=SERVER,
                                                                        report_id=current_report_dict['id'])
    report_details['reportDeepLink'] = '[{}]({})'.format(deep_link, deep_link)
    if current_report_dict['enclaveIds']:
        report_details['enclaveIds'] = ', '.join(current_report_dict['enclaveIds'])  # Prettify list of enclave IDs
    report_details['updated'] = normalize_time(current_report_dict['updated'])
    report_details['created'] = normalize_time(current_report_dict['created'])
    report_details['timeBegan'] = normalize_time(current_report_dict['timeBegan'])
    report_details['distributionType'] = current_report_dict['distributionType']
    if current_report_dict.get('externalUrl'):
        report_details['externalUrl'] = current_report_dict['externalUrl']
    report_details['reportBody'] = current_report_dict['reportBody']
    report_context = {
        'reportTitle': report_details['title'],
        'reportBody': report_details['reportBody'],
        'id': report_details['id']
    }
    ec = {
        'TruSTAR.Report(val.id && val.id === obj.id)': report_context
    }
    title = 'TruSTAR report ID ' + report_id + ' details'
    entry = {
        'Type': entryTypes['note'],
        'Contents': report_details,
        'ContentsFormat': formats['json'],
        'ReadableContentsFormat': formats['markdown'],
        'HumanReadable': tableToMarkdown(title, report_details),
        'EntryContext': ec
    }
    return entry


def delete_report(report_id, id_type):
    ts.delete_report(report_id, id_type)
    return 'Report ' + report_id + ' was successfully deleted'


def get_reports(from_time, to_time, enclave_ids, distribution_type, tags, excluded_tags):
    is_encalve = True if distribution_type == 'ENCLAVE' else False
    from_time = date_to_unix(from_time) if from_time else from_time
    to_time = date_to_unix(to_time) if to_time else to_time
    response = ts.get_reports(is_encalve, enclave_ids, tags, excluded_tags, from_time, to_time)
    reports = []
    reports_context = []
    for report in response:
        current_report_dict = report.to_dict(remove_nones=True)
        current_report = collections.OrderedDict()  # type: OrderedDict
        current_report['id'] = current_report_dict['id']
        current_report['title'] = current_report_dict['title']
        deep_link = '{server_url}/constellation/reports/{report_id}'.format(
            server_url=SERVER, report_id=current_report_dict['id'])
        current_report['reportDeepLink'] = '[{}]({})'.format(deep_link, deep_link)
        if current_report_dict['enclaveIds']:
            current_report['enclaveIds'] = ', '.join(current_report_dict['enclaveIds'])  # Prettify list of enclave IDs
        current_report['updated'] = normalize_time(current_report_dict['updated'])
        current_report['created'] = normalize_time(current_report_dict['created'])
        current_report['timeBegan'] = normalize_time(current_report_dict['timeBegan'])
        current_report['distributionType'] = current_report_dict['distributionType']
        if current_report_dict.get('externalUrl'):
            current_report['externalUrl'] = current_report_dict['externalUrl']
        current_report['reportBody'] = current_report_dict['reportBody']
        reports.append(current_report)
        reports_context.append({
            'reportTitle': current_report['title'],
            'reportBody': current_report['reportBody'],
            'id': current_report['id']
        })
    if reports:
        ec = {
            'TruSTAR.Report(val.id && val.id === obj.id)': reports_context
        }
        title = 'TruSTAR reports'
        entry = {
            'Type': entryTypes['note'],
            'Contents': reports,
            'ContentsFormat': formats['json'],
            'ReadableContentsFormat': formats['markdown'],
            'HumanReadable': tableToMarkdown(title, reports),
            'EntryContext': ec
        }
        return entry
    return 'No reports were found.'


def get_correlated_reports(indicators, enclave_ids, distribution_type, page_size, page_number):
    response = ts.get_correlated_reports_page(indicators, enclave_ids, page_number, page_size)
    correlated_reports = []
    for report in response:
        current_report = report.to_dict(remove_nones=True)
        current_report['updated'] = normalize_time(current_report['updated'])
        current_report['created'] = normalize_time(current_report['created'])
        current_report['timeBegan'] = normalize_time(current_report['timeBegan'])
        correlated_reports.append(current_report)
    if correlated_reports:
        title = 'TruSTAR correlated reports'
        entry = {
            'Type': entryTypes['note'],
            'Contents': correlated_reports,
            'ContentsFormat': formats['json'],
            'ReadableContentsFormat': formats['markdown'],
            'HumanReadable': tableToMarkdown(title, correlated_reports)
        }
        return entry
    return 'No reports were found.'


def search_reports(search_term, enclave_ids):
    response = ts.search_reports(search_term, enclave_ids)
    reports = []
    report_context = []
    for i, report in enumerate(response):
        current_report = report.to_dict(remove_nones=True)
        current_report['updated'] = normalize_time(current_report['updated'])
        current_report['created'] = normalize_time(current_report['created'])
        current_report['timeBegan'] = normalize_time(current_report['timeBegan'])
        reports.append(current_report)
        report_context.append({
            'reportTitle': current_report['title'],
            'id': current_report['id']
        })
        if 'reportBody' in current_report:
            report_context[i]['reportBody'] = current_report['reportBody']

    ec = {
        'TruSTAR.Report(val.id && val.id === obj.id)': report_context
    }

    title = 'TruSTAR reports that contain the term ' + search_term
    entry = {
        'Type': entryTypes['note'],
        'Contents': reports,
        'ContentsFormat': formats['json'],
        'ReadableContentsFormat': formats['markdown'],
        'HumanReadable': tableToMarkdown(title, reports),
        'EntryContext': ec
    }
    return entry


def add_to_whitelist(indicators):
    response = ts.add_terms_to_whitelist([indicators])
    if response:
        return 'Added to the whitelist successfully'
    else:
        return 'Indicator could not be added to the whitelist.'


def remove_from_whitelist(indicator, indicator_type):
    ts_indicator = trustar.models.Indicator(
        value=indicator,
        type=indicator_type
    )
    try:
        ts.delete_indicator_from_whitelist(ts_indicator)
        return 'Removed from the whitelist successfully'
    except Exception:
        return 'Indicator could not be removed from the whitelist.'


def get_enclaves():
    response = ts.get_user_enclaves()
    enclave_ids = []
    for enclave in response:
        enclave_ids.append(enclave.to_dict(remove_nones=True))
    title = 'TruSTAR Enclaves'
    entry = {
        'Type': entryTypes['note'],
        'Contents': enclave_ids,
        'ContentsFormat': formats['json'],
        'ReadableContentsFormat': formats['markdown'],
        'HumanReadable': tableToMarkdown(title, enclave_ids),
    }
    return entry


def get_all_phishing_indicators(priority_event_score,
                                normalized_indicator_score,
                                from_time,
                                to_time,
                                status):
    cursor = encode_cursor(1000, 0)
    args = {'priority_event_score': priority_event_score,
            'normalized_indicator_score': normalized_indicator_score,
            'status': status,
            'cursor': cursor,
            'from_time': date_to_unix(from_time) if from_time else None,
            'to_time': date_to_unix(to_time) if to_time else None}
    response = ts.get_phishing_indicators_page(**args)
    indicators, ec = translate_phishing_indicators(response.items)
    if indicators:
        title = 'TruSTAR phishing indicators'
        entry = {
            'Type': entryTypes['note'],
            'Contents': indicators,
            'ContentsFormat': formats['json'],
            'ReadableContentsFormat': formats['markdown'],
            'HumanReadable': tableToMarkdown(title, indicators),
            'EntryContext': ec
        }
        return entry
    return 'No phishing indicators were found.'


def get_phishing_submissions(priority_event_score,
                             from_time,
                             to_time,
                             status):
    cursor = encode_cursor(1000, 0)
    args = {'priority_event_score': priority_event_score,
            'status': status,
            'cursor': cursor,
            'from_time': date_to_unix(from_time) if from_time else None,
            'to_time': date_to_unix(to_time) if to_time else None}
    response = ts.get_phishing_submissions_page(**args)
    if not response.items:
        return 'No phishing submissions were found.'
    submissions, ec = translate_triage_submission(response.items)
    title = 'TruSTAR phishing triage submissions'
    entry = {
        'Type': entryTypes['note'],
        'Contents': submissions,
        'ContentsFormat': formats['json'],
        'ReadableContentsFormat': formats['markdown'],
        'HumanReadable': tableToMarkdown(title, submissions),
        'EntryContext': ec
    }
    return entry


def set_triage_status(submission_id, status):
    try:
        response = ts.mark_triage_status(submission_id, status)
        response.raise_for_status()
        return "Submission ID {} is {}".format(submission_id, status)
    except requests.exceptions.HTTPError as err:
        return str(err)


''' EXECUTION CODE '''
config = {
    'user_api_key': API_KEY,
    'user_api_secret': API_SECRET,
    'api_endpoint': BASE_URL,
    'verify': INSECURE,
    'client_type': "Python_SDK",
    'client_metatag': "demisto-xsoar"
}
ts = trustar.TruStar(config=config)

LOG('command is %s' % (demisto.command(), ))

try:
    if demisto.command() == 'test-module':
        demisto.results('ok')

    elif demisto.command() == 'trustar-related-indicators':
        enclave_ids = demisto.args().get('enclave-ids', None)
        demisto.results(get_related_indicators(demisto.args()['indicators'], enclave_ids, demisto.args()[
                        'page-size'], demisto.args()['page-number']))

    elif demisto.command() == 'trustar-trending-indicators':
        demisto.results(get_trending_indicators(demisto.args()['type'], demisto.args()['days-back']))

    elif demisto.command() == 'trustar-search-indicators':
        enclave_ids = demisto.args().get('enclave-ids', None)
        demisto.results(search_indicators(demisto.args()['search-term'], enclave_ids,
                                          demisto.args()['page-size'], demisto.args()['page-number']))

    elif demisto.command() == 'trustar-submit-report':
        enclave_ids = demisto.args().get('enclave-ids', None)
        external_url = demisto.args().get('external-url', None)
        time_began = demisto.args().get('time-began', None)
        demisto.results(submit_report(demisto.args()['title'], demisto.args()[
                        'report-body'], enclave_ids, external_url, time_began, demisto.args()['distribution-type']))

    elif demisto.command() == 'trustar-update-report':
        enclave_ids = demisto.args().get('enclave-ids', None)
        external_url = demisto.args().get('external-url', None)
        time_began = demisto.args().get('time-began', None)
        demisto.results(update_report(demisto.args()['report-id'], demisto.args()['title'],
                                      demisto.args()['report-body'], enclave_ids, external_url, time_began,
                                      demisto.args()['distribution-type']))

    elif demisto.command() == 'trustar-report-details':
        demisto.results(get_report_details(demisto.args()['report-id'], demisto.args()['id-type']))

    elif demisto.command() == 'trustar-delete-report':
        demisto.results(delete_report(demisto.args()['report-id'], demisto.args()['id-type']))

    elif demisto.command() == 'trustar-get-reports':
        from_time = demisto.args().get('from', None)
        to_time = demisto.args().get('to', None)
        enclave_ids = demisto.args().get('enclave-ids', None)
        tags = demisto.args().get('tags', None)
        excluded_tags = demisto.args().get('excluded-tags', None)
        demisto.results(get_reports(from_time, to_time, enclave_ids,
                                    demisto.args()['distribution-type'], tags, excluded_tags))

    elif demisto.command() == 'trustar-correlated-reports':
        enclave_ids = demisto.args().get('enclave-ids', None)
        demisto.results(get_correlated_reports(demisto.args()['indicators'], enclave_ids, demisto.args()[
                        'distribution-type'], demisto.args()['page-size'], demisto.args()['page-number']))

    elif demisto.command() == 'trustar-search-reports':
        enclave_ids = demisto.args().get('enclave-ids', None)
        demisto.results(search_reports(demisto.args()['search-term'], enclave_ids))

    elif demisto.command() == 'trustar-add-to-whitelist':
        demisto.results(add_to_whitelist(demisto.args()['indicators']))

    elif demisto.command() == 'trustar-remove-from-whitelist':
        demisto.results(remove_from_whitelist(demisto.args()['indicator'], demisto.args()['indicator-type']))

    elif demisto.command() == 'trustar-get-enclaves':
        demisto.results(get_enclaves())

    elif demisto.command() == 'file':
        demisto.results(generic_search_indicator(demisto.args().get('file'), demisto.params().get(
            'file_threshold'), ('File', 'MD5', 'SHA1', 'SHA256'), create_file_ec))

    elif demisto.command() == 'ip':
        demisto.results(generic_search_indicator(demisto.args().get('ip'),
                                                 demisto.params().get('ip_threshold'), ('IP',), create_ip_ec))

    elif demisto.command() == 'url':
        demisto.results(generic_search_indicator(demisto.args().get('url'),
                                                 demisto.params().get('url_threshold'), ('URL',), create_url_ec))

    elif demisto.command() == 'domain':
        demisto.results(generic_search_indicator(demisto.args().get('domain'),
                                                 demisto.params().get('domain_threshold'),
                                                 ('Domain', 'URL',), create_domain_ec))

    elif demisto.command() == 'trustar-get-phishing-indicators':
        nts = argToList(demisto.args().get('priority_event_score'))
        nss = argToList(demisto.args().get('normalized_indicator_score'))
        ft = demisto.args().get('from_time')
        tt = demisto.args().get('to_time')
        st = argToList(demisto.args().get('status'))
        demisto.results(get_all_phishing_indicators(nts, nss, ft, tt, st))

    elif demisto.command() == 'trustar-get-phishing-submissions':
        nts = argToList(demisto.args().get('priority_event_score'))
        ft = demisto.args().get('from_time')
        tt = demisto.args().get('to_time')
        st = argToList(demisto.args().get('status'))
        demisto.results(get_phishing_submissions(nts, ft, tt, st))

    elif demisto.command() == 'trustar-set-triage-status':
        demisto.results(set_triage_status(demisto.args().get('submission_id'),
                                          demisto.args().get('status')))

except Exception as e:
    return_error(str(e))