AnalyzeOSX

Get file and url reputation for osxcollector result. will use VirusTotal for Url checks, and IBM XForce for MD5 checks. maxchecks : for system : system name to run agent on. section : the type check that OSXCollector should run.

javascript · OSX Collector

Source

var osx_report = executeCommand('Osxcollector', {section: args.section, system: args.system, timeout: args.timeout});
var res = [];
var maxchecks = 10;
if (args.maxchecks) {
  maxchecks = args.maxchecks;
}
for (var i=0; i<osx_report.length; i++) {
  if (osx_report[i].ContentsFormat == formats.json) {
    var content = osx_report[i].Contents;
    if (content.osxcollector_result){
      for (var j=0; j<content.osxcollector_result.length && j < maxchecks; j++) {
        if (content.osxcollector_result[j].md5) {
          var rep = executeCommand('file', {file: content.osxcollector_result[j].md5});
          if (rep && Array.isArray(rep)) {
            for (var r = 0; r < rep.length; r++) {
              if (positiveFile(rep[r])) {
                res.push(shortFile(rep[r]));
              }
            }
          }
        }
        var u = content.osxcollector_result[j].url;
        if (u && u.indexOf("http") === 0) {
          var rep = executeCommand('url', {url: u});
          if (rep && Array.isArray(rep)) {
            for (var r = 0; r < rep.length; r++) {
              if (positiveUrl(rep[r])) {
                res.push(shortUrl(rep[r]));
              }
            }
          }
        }
      }
    }
  }
}
if (res.length > 0) {
  return res;
}
return 'No infected files or malicious urls detected on OSX machine: '+args.system;

README

Uses this script to get file and URL reputation for osxcollector result.

This script will use VirusTotal for URL checks, and IBM XForce for MD5 file hash checks.

maxchecks : for.
system : system name to run agent on.
section : the type check that OSXCollector should run.

Script Data

Name	Description
Script Type	javascript
Tags	osx

Dependencies

This script uses the following commands and scripts.

url
file

Inputs

Argument Name	Description
section	Asks OSXCollector for a specific section.
timeout	The timeout to be passed to the OSXCollector script.
maxchecks	The maximum amount of files/URLs to verify.
system	THe OSX system to be used.

Outputs

There are no outputs for this script.