import demistomock as demisto # noqa: F401 from CommonServerPython import * # noqa: F401 """ IMPORTS """ from socket import gaierror def results_return(command, thingtoreturn): for item in thingtoreturn: description = "" ip_reputation = { "indicator": item["Address"], } try: if item["Malicious"]["Vendor"]: score = Common.DBotScore.BAD description = ip_reputation["description"] = item["Malicious"]["Description"] else: score = Common.DBotScore.NONE demisto.debug(f"No Malicious Vendor -> {score=}") except LookupError: score = Common.DBotScore.NONE dbot_score = Common.DBotScore( indicator=item["Address"], indicator_type=DBotScoreType.IP, integration_name="Spamcop", malicious_description=description, score=score, reliability=demisto.params().get("integrationReliability"), ) ip = Common.IP(ip=item["Address"], dbot_score=dbot_score) results = CommandResults( outputs_prefix="Spamcop." + str(command), outputs_key_field="indicator", outputs=ip_reputation, indicator=ip ) return_results(results) def get_ip_details(ip): finaldata = [] listofips = str(ip).split(",") for item in listofips: reverselist = str(item).split(".") address = reverselist[3] + "." + reverselist[2] + "." + reverselist[1] + "." + reverselist[0] + ".bl.spamcop.net" try: result = socket.gethostbyname(address) if result == "127.0.0.2": data = { "Address": item, "Malicious": {"Vendor": "Spamcop", "Description": "IP was found to be on the Spamcop block list"}, } finaldata.append(data) except gaierror: data = {"Address": item} finaldata.append(data) except Exception as e: return_error(f"Error from Spamcop - {e!s}.") return finaldata def test_module(): """ Returning 'ok' indicates that the integration works like it is supposed to. Connection to the service is successful. Returns: 'ok' if test passed, anything else will fail the test. """ result = socket.gethostbyname("www.spamcop.net") reverselist = str(result).split(".") address = reverselist[3] + "." + reverselist[2] + "." + reverselist[1] + "." + reverselist[0] + ".bl.spamcop.net" try: testresult = socket.gethostbyname(address) return "Test Failed. Spamcop is blocklisted " + str(testresult) except gaierror: return "ok" except Exception as e: return f"Error from Spamcop - {e!s}." def main(): """ PARSE AND VALIDATE INTEGRATION PARAMS """ demisto.info(f"Command being called is {demisto.command()}") try: if demisto.command() == "test-module": # This is the call made when pressing the integration Test button. result = test_module() demisto.results(result) elif demisto.command() == "ip": results_return("IP", get_ip_details(demisto.args().get("ip"))) # Log exceptions except Exception as e: return_error(f"Failed to execute {demisto.command()} command. Error: {e!s}") if __name__ in ("__main__", "__builtin__", "builtins"): main()