AnalyzeOSX

Get file and url reputation for osxcollector result. will use VirusTotal for Url checks, and IBM XForce for MD5 checks. maxchecks : for system : system name to run agent on. section : the type check that OSXCollector should run.

javascript · OSX Collector

Details

IDAnalyzeOSX
Languagejavascript
From Version5.0.0
Tagsosx

README

Uses this script to get file and URL reputation for osxcollector result.

This script will use VirusTotal for URL checks, and IBM XForce for MD5 file hash checks.

  • maxchecks : for.
  • system : system name to run agent on.
  • section : the type check that OSXCollector should run.

Script Data

Name Description
Script Type javascript
Tags osx

Dependencies

This script uses the following commands and scripts.

  • url
  • file

Inputs

Argument Name Description
section Asks OSXCollector for a specific section.
timeout The timeout to be passed to the OSXCollector script.
maxchecks The maximum amount of files/URLs to verify.
system THe OSX system to be used.

Outputs

There are no outputs for this script.

Source

AnalyzeOSX.js AnalyzeOSX.yml
Download History Raw 
var osx_report = executeCommand('Osxcollector', {section: args.section, system: args.system, timeout: args.timeout});
var res = [];
var maxchecks = 10;
if (args.maxchecks) {
  maxchecks = args.maxchecks;
}
for (var i=0; i<osx_report.length; i++) {
  if (osx_report[i].ContentsFormat == formats.json) {
    var content = osx_report[i].Contents;
    if (content.osxcollector_result){
      for (var j=0; j<content.osxcollector_result.length && j < maxchecks; j++) {
        if (content.osxcollector_result[j].md5) {
          var rep = executeCommand('file', {file: content.osxcollector_result[j].md5});
          if (rep && Array.isArray(rep)) {
            for (var r = 0; r < rep.length; r++) {
              if (positiveFile(rep[r])) {
                res.push(shortFile(rep[r]));
              }
            }
          }
        }
        var u = content.osxcollector_result[j].url;
        if (u && u.indexOf("http") === 0) {
          var rep = executeCommand('url', {url: u});
          if (rep && Array.isArray(rep)) {
            for (var r = 0; r < rep.length; r++) {
              if (positiveUrl(rep[r])) {
                res.push(shortUrl(rep[r]));
              }
            }
          }
        }
      }
    }
  }
}
if (res.length > 0) {
  return res;
}
return 'No infected files or malicious urls detected on OSX machine: '+args.system;