WhatsMyBrowser

import demistomock as demisto
from CommonServerPython import *

""" IMPORTS """
import json
from collections import defaultdict

import requests
import urllib3

# Disable insecure warnings
urllib3.disable_warnings()


"""GLOBAL VARS"""
API_URL = demisto.params().get("url")
USE_SSL = not demisto.params().get("insecure")
PROXY = demisto.params().get("proxy", False)


"""HELPER FUNCTIONS"""


def http_request(data):
    api_key = demisto.params().get("credentials_api_key", {}).get("password") or demisto.params().get("api_key")
    if not api_key:
        raise DemistoException("API key must be provided.")
    headers = {
        "X-API-KEY": api_key,
    }
    r = requests.request("POST", API_URL, data=data, headers=headers, verify=USE_SSL)
    if r.status_code != 200:
        return_error(f"Error in API call to WhatIsMyBrowser [{r.status_code}] - {r.reason}")
    return r.content


"""MAIN FUNCTIONS"""


def ua_parse(user_agent):
    post_data = {"user_agent": user_agent}
    post_json = json.dumps(post_data)
    r = http_request(post_json)
    return r


def ua_parse_command():
    user_agent = demisto.args().get("UserAgent")
    raw = ua_parse(user_agent)
    r = json.loads(raw)
    dbot_score = {}
    demisto.debug("Initializing dbot_score")
    if "success" in r["result"]["code"]:
        parsed = r["parse"]
        hr = defaultdict()  # type: dict
        ua_ec = defaultdict(lambda: defaultdict(int))  # type: dict
        if "software" in parsed:
            hr["Software"] = parsed["software"]
            ua_ec["Software"] = parsed["software"]
        if "software_name" in parsed:
            hr["Software Name"] = parsed["software_name"]
            ua_ec["SoftwareName"] = parsed["software_name"]
        if "operating_system" in parsed and parsed["operating_system"] is not None:
            hr["Operating System"] = parsed["operating_system"]
            ua_ec["OperatingSystem"] = parsed["operating_system"]
        if "is_abusive" in parsed:
            hr["Abusive"] = parsed["is_abusive"]
            ua_ec["Abusive"] = parsed["is_abusive"]
            if parsed["is_abusive"] is True:
                dbot_score = {
                    "Score": 3,
                    "Type": "UserAgent",
                    "Vendor": "WhatIsMyBrowser",  # disable-secrets-detection
                    "Indicator": parsed["user_agent"],
                }
            else:
                dbot_score = {
                    "Score": 1,
                    "Type": "UserAgent",
                    "Vendor": "WhatIsMyBrowser",  # disable-secrets-detection
                    "Indicator": parsed["user_agent"],
                }
        if "operating_system_name" in parsed and parsed["operating_system_name"] is not None:
            hr["Operating System Name"] = parsed["operating_system_name"]
            ua_ec["OperatingSystemName"] = parsed["operating_system_name"]
        if "user_agent" in parsed:
            hr["User Agent"] = parsed["user_agent"]
            ua_ec["UserAgent"] = parsed["user_agent"]
        if "hardware_type" in parsed and parsed["hardware_type"] is not None:
            hr["Hardware Type"] = parsed["hardware_type"]
            ua_ec["HardwareType"] = parsed["hardware_type"]
        if "hardware_sub_type" in parsed and parsed["hardware_sub_type"] is not None:
            hr["Hardware Sub Type"] = parsed["hardware_sub_type"]
            ua_ec["HardwareSubType"] = parsed["hardware_sub_type"]
        ec = {"UA.Parse(val.UserAgent && val.UserAgent == obj.UserAgent)": ua_ec, "DBotScore": dbot_score}
        demisto.results(
            {
                "Type": entryTypes["note"],
                "ContentsFormat": formats["json"],
                "Contents": r,
                "HumanReadable": tableToMarkdown(f"Parsed result for {user_agent}", hr),
                "EntryContext": ec,
            }
        )
    if r["result"]["code"] == "error":
        error_msg = r["result"]["message"]
        demisto.results(
            {"Type": entryTypes["note"], "ContentsFormat": formats["markdown"], "Contents": r, "HumanReadable": f"{error_msg}"}
        )


def test_command():
    post_data = {
        # disable-secrets-detection
        "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/537.36 (KHTML, like Gecko) "
        "Chrome/64.0.3282.140 Safari/537.36"
    }
    post_json = json.dumps(post_data)
    http_request(post_json)
    demisto.results("ok")


"""EXECUTION BLOCK"""
try:
    handle_proxy()
    if demisto.command() == "ua-parse":
        ua_parse_command()
    if demisto.command() == "test-module":
        test_command()
except Exception as e:
    return_error(str(e))