TopMaliciousRatioIndicators

Find the top malicious ratio indicators. Malicious ratio is defined by the ratio between the number of "bad" incidents divided by the number of total number of incidents that the indicators appears in.

Type

python

Pack

CommonScripts

Source

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401


def select_indicator_columns(indicator: dict) -> Dict:
    display_indicator = {}
    display_indicator["ID"] = indicator["id"]
    display_indicator["Type"] = indicator["indicator_type"]
    display_indicator["Malicious Ratio"] = "%.2f" % float(indicator["maliciousRatio"])  # noqa: UP031
    display_indicator["Value"] = indicator["value"]
    display_indicator["Last Seen"] = indicator["lastSeen"]
    return display_indicator


def dedup_by_value(indicators: list) -> List:
    exist_values = set()
    result = []
    for e in indicators:
        value = e["value"]
        if value not in exist_values:
            exist_values.add(value)
            result.append(e)
    return result


def find_indicators_with_mal_ratio(
    max_indicators: int, min_number_of_invs: int, max_results: int, from_date: str
) -> tuple[str, list]:
    indicators = execute_command(
        "findIndicators", {"query": f"lastSeen:>={from_date} investigationsCount:>={min_number_of_invs}", "size": max_indicators}
    )

    if not indicators:
        return json.dumps({"total": 0, "data": []}), []

    indicators_map = {i["id"]: i for i in indicators}

    malicious_ratio_result = execute_command("maliciousRatio", {"id": ",".join(indicators_map)})

    for mr in malicious_ratio_result:
        indicators_map[mr["indicatorId"]]["maliciousRatio"] = mr["maliciousRatio"]
        indicators_map[mr["indicatorId"]]["from_date"] = from_date

    sorted_indicators = sorted(indicators_map.values(), key=lambda x: x["maliciousRatio"], reverse=True)
    sorted_indicators = [x for x in sorted_indicators if x["maliciousRatio"] > 0]
    sorted_indicators = dedup_by_value(sorted_indicators)
    sorted_indicators = sorted_indicators[:max_results]
    sorted_indicators = list(map(select_indicator_columns, sorted_indicators))
    widget_table = json.dumps({"total": len(sorted_indicators), "data": sorted_indicators})

    return widget_table, sorted_indicators


def main():
    try:
        args: dict = demisto.args()
        max_indicators = int(args["maxNumberOfIndicators"])
        min_number_of_invs = int(args["minimumNumberOfInvs"])
        max_results = int(args["maximumNumberOfResults"])
        from_date = args.get("from", '"30 days ago"')

        widget_table, sorted_indicators = find_indicators_with_mal_ratio(
            max_indicators, min_number_of_invs, max_results, from_date
        )

        demisto.results(
            {
                "Type": entryTypes["note"],
                "Contents": widget_table,
                "ContentsFormat": formats["text"],
                "ReadableContentsFormat": formats["markdown"],
                "HumanReadable": tableToMarkdown("Top Malicious Ratio Indicators", sorted_indicators),
            }
        )

    except Exception:
        demisto.error(traceback.format_exc())  # print the traceback
        return_error(f"Failed to execute TopMaliciousRatioIndicators. Error: {traceback.format_exc()}")


if __name__ in ("__builtin__", "builtins", "__main__"):  # pragma: no cover
    main()

README