PhishLabsPopulateIndicators

Populate indicators by the PhishLabs IOC global feed. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

python · PhishLabs

Details

ID	`PhishLabsPopulateIndicators`
Language	python
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Tags	PhishLabs

Source

PhishLabsPopulateIndicators.py PhishLabsPopulateIndicators_test.py PhishLabsPopulateIndicators.yml

Download History Raw

import json


def test_indicator_type_and_value_finder_email_recognition():
    from PhishLabsPopulateIndicators import indicator_type_and_value_finder

    indicator_data_1 = {"value": "email@email.com", "type": "Sender"}

    indicator_type_1, indicator_value_1 = indicator_type_and_value_finder(indicator_data_1)
    assert indicator_type_1 == "Email"
    assert indicator_value_1 == "email@email.com"


def test_indicator_type_and_value_finder_url_recognition():
    from PhishLabsPopulateIndicators import indicator_type_and_value_finder

    indicator_data_2 = {"value": "https://www.some.path/email@email.com", "type": "URL"}

    indicator_type_2, indicator_value_2 = indicator_type_and_value_finder(indicator_data_2)
    assert indicator_type_2 == "URL"
    assert indicator_value_2 == "https://www.some.path/email@email.com"


def test_indicator_type_and_value_finder_file_recognition():
    from PhishLabsPopulateIndicators import indicator_type_and_value_finder

    files_json = """
            {
                "attributes": [
                    {
                        "createdAt": "2019-05-14T13:03:45Z",
                        "id": "xyz",
                        "name": "md5",
                        "value": "c8092abd8d581750c0530fa1fc8d8318"
                    },
                    {
                        "createdAt": "2019-05-14T13:03:45Z",
                        "id": "abc",
                        "name": "filetype",
                        "value": "application/zip"
                    },
                    {
                        "createdAt": "2019-05-14T13:03:45Z",
                        "id": "qwe",
                        "name": "name",
                        "value": "Baycc.zip"
                    }
                ],
                "createdAt": "2019-05-14T13:03:45Z",
                "falsePositive": false,
                "id": "def",
                "type": "Attachment",
                "updatedAt": "0001-01-01T00:00:00Z",
                "value": "c8092abd8d581750c0530fa1fc8d8318"
            } """

    indicator_data_3 = json.loads(files_json)

    indicator_type_3, indicator_value_3 = indicator_type_and_value_finder(indicator_data_3)
    assert indicator_type_3 == "File"
    assert indicator_value_3 == "c8092abd8d581750c0530fa1fc8d8318"