CheckIndicatorValue

Check if indicators exist in the Threat Intel database.

Type

python

Pack

CommonScripts

Source

import base64
import urllib.parse
from typing import Any

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401


def exists_indicator(indicator: str) -> bool:
    # res =  (
    #     (contents := execute_command("getIndicator", {"value": indicator}))
    #     and len(contents) > 0
    #     and contents[0].get("value") in [indicator]
    # )
    # return res
    return bool(
        (contents := execute_command("getIndicator", {"value": indicator}))
        and (len(contents) > 0 and contents[0].get("value") in [indicator])
    )


def decode_indicator(indicator: str, encoding: str | None) -> str:
    if not encoding or encoding == "none":
        return indicator
    elif encoding == "base64":
        return base64.b64decode(indicator.encode()).decode()
    elif encoding == "url-encoding":
        return urllib.parse.unquote(indicator)
    else:
        raise DemistoException(f"Unknown encoding mode: {encoding}")  # pragma: no cover


def check_indicators(indicators: List[str], encoding: str) -> List[dict[str, Any]]:
    # Decode and dedup indicators
    pairs = {decode_indicator(encoded_indicator, encoding): encoded_indicator for encoded_indicator in indicators}

    # Check if each indicator exists
    return [
        {"Indicator": indicator, "EncodedIndicator": encoded_indicator, "Exists": exists_indicator(indicator)}
        for indicator, encoded_indicator in pairs.items()
    ]


def main():
    try:
        args = demisto.args()
        encoding = args.get("encoding") or "none"
        indicators = argToList(args.get("indicator") or [])

        outputs = check_indicators(indicators, encoding)
        count = sum(1 for ent in outputs if ent.get("Exists"))

        return_results(
            CommandResults(
                outputs_key_field="Indicator",
                outputs_prefix="CheckIndicatorValue",
                outputs=outputs,
                readable_output=f"{count} indicators exist.",
                raw_response=outputs,
            )
        )
    except Exception as e:  # pragma: no cover
        return_error(f"Failed to execute CheckIndicatorValue. Error: {e!s}")


if __name__ in ("__main__", "__builtin__", "builtins"):
    main()

README