var server = params.server.replace(/[\/]+$/, '') + '/searchApi/' + params.version + '/'; var commands = { 'threat-crowd-email': { url: 'email', title: 'Threat crowd report for email %email%', defaultFields: { 'type': 'Email', }, translator: [ {to: 'ThreatCrowd-Domains', from: 'domains'}, {to: 'Address', from: 'email'}, {to: 'Type', from: 'type'}, ], contextKey: 'Account.Email(val.Address==obj.Address)', }, 'threat-crowd-domain': { url: 'domain', title: 'Threat crowd report for domain %domain%', translator: [ {to: 'Name', from: 'domain'}, {to: 'ThreatCrowd-Emails', from: 'emails'}, {to: 'ThreatCrowd-SubDomains', from: 'subdomains'}, {to: 'ThreatCrowd-References', from: 'references'}, {to: 'ThreatCrowd-Votes', from: 'votes'}, ], contextKey: 'Domain(val.Name==obj.Name)', }, 'threat-crowd-ip': { url: 'ip', title: 'Threat crowd report for ip %ip%', translator: [ {to: 'Address', from: 'ip'}, {to: 'ThreatCrowd-Hashes', from: 'hashes'}, {to: 'ThreatCrowd-References', from: 'references'}, {to: 'ThreatCrowd-Resolutions', from: 'resolutions'}, {to: 'ThreatCrowd-Votes', from: 'votes'}, ], contextKey: 'IP(val.Address==obj.Address)', }, 'threat-crowd-antivirus': { url: 'antivirus', title: 'Threat crowd report for antivirus %antivirus%', translator: [ {to: 'Name', from: 'antivirus'}, {to: 'Hashes', from: 'hashes'}, {to: 'References', from: 'references'}, ], contextKey: 'ThreatCrowd.AntiVirus(val.Name==obj.Name)', }, 'threat-crowd-file': { url: 'file', title: 'Threat crowd report for file with hash %resource%', translator: [ {to: 'MD5', from: 'md5'}, {to: 'ThreatCrowd-IPs', from: 'ips'}, {to: 'ThreatCrowd-Domains', from: 'domains'}, {to: 'ThreatCrowd-Resource', from: 'resource'}, {to: 'ThreatCrowd-SHA1', from: 'sha1'}, {to: 'ThreatCrowd-References', from: 'references'}, {to: 'ThreatCrowd-Scans', from: 'scans'}, ], contextKey: 'File(val.MD5==obj.MD5)', }, 'test-module': { url: 'email', defaultArgs: { email: 'william19770319@yahoo.com', }, }, }; function createContext(data, dbotScore) { var createContextSingle = function(obj) { var res = {}; var keys = Object.keys(obj); keys.forEach(function(k) { var values = k.split('-'); var current = res; for (var j = 0; j= 300) { throw 'Failed to ' + commandData.url + ' , request status code: ' + res.StatusCode + ' and Body: ' + res.Body + '.'; } entry = { Type: entryTypes.note, Contents: JSON.parse(res.Body), ContentsFormat: formats.json, }; if (commandData.translator) { data = mapObjFunction(commandData.translator)(merge(merge(entry.Contents, args), commandData.defaultFields)); entry.ReadableContentsFormat = formats.markdown; entry.HumanReadable = tableToMarkdown(replaceInTemplates(commandData.title, args), data); entry.EntryContext = {}; var dbotScore = -1; if (commandData.url == 'domain' || commandData.url== 'ip') { // the only commands with dbotScore dbotScore = calculateDBotScore(JSON.parse(res.Body), args, commandData); entry.EntryContext = {}; entry.EntryContext['DBotScore'] = createDbotEntry(commandData, dbotScore); } entry.EntryContext[commandData.contextKey] = createContext(data, dbotScore); } return entry; } res = sendRequestAndParse(commands[command]); if (command === 'test-module') { return 'ok'; } return res;