AbuseIPDBPopulateIndicators

Extracts IP addresses on block lists from AbuseIPDB, and Populates Indicators accordingly.

Type

python

Pack

AbuseDB

Source

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401

BLACKLISTED = "Bad"


def get_contents(args: Dict[str, Any]):
    """Get IP addresses on block lists from AbuseIPDB

    :return: dictionary containing block lists
    :rtype: ``dict[str, Any]``
    """

    return (
        execute_command(
            "abuseipdb-get-blacklist",
            {
                "days": args.get("days"),
                "limit": args.get("limit"),
                "confidence": args.get("confidence"),
            },
        )
        or None
    )


def check_ips(ips: list):
    """Check 'ips' list validity

    :return: None if valid, else execute return_error()
    :rtype: ``None``
    """
    if not ips or "Too many requests" in ips:
        raise DemistoException("No Indicators were created (possibly bad API key)")


def main():
    try:
        args = demisto.args()
        ips = get_contents(args)
        check_ips(ips)

        # Extract IPs into new Indicators
        for ip in ips:
            execute_command(
                "createNewIndicator",
                {
                    "type": "IP",
                    "value": ip,
                    "source": "AbuseIPDB",
                    "reputation": BLACKLISTED,
                    "seenNow": "true",
                },
            )

        return_results("All Indicators were created successfully")

    except DemistoException as e:
        return_error(e.message)


if __name__ in ("__main__", "__builtin__", "builtins"):
    main()

README