Skip to content

Commit

Permalink
Merge pull request #928 from amr-cossi/feature/opencti-v4
Browse files Browse the repository at this point in the history
  • Loading branch information
@dadokkio
dadokkio authored Jan 21, 2021
2 parents 288c9f2 + 4f412ef commit b52c022
Show file tree
Hide file tree
Showing 10 changed files with 393 additions and 186 deletions.
17 changes: 13 additions & 4 deletions analyzers/OpenCTI/OpenCTI.json → ...penCTI/OpenCTI_SearchExactObservable.json
View file
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
{
"name": "OpenCTI_SearchObservable",
"name": "OpenCTI_SearchExactObservable",
"author": "ANSSI",
"license": "AGPL-V3",
"url": "https://github.com/TheHive-Project/Cortex-Analyzers/",
"version": "1.0",
"description": "Query multiple OpenCTI instances for an observable.",
"version": "2.0",
"description": "Query multiple OpenCTI instances for a specific observable.",
"dataTypeList": [
"domain",
"ip",
Expand All @@ -20,6 +20,9 @@
"other",
"filename"
],
"config": {
"service": "search_exact"
},
"baseConfig": "OpenCTI",
"command": "OpenCTI/opencti.py",
"configurationItems": [
Expand Down Expand Up @@ -52,5 +55,11 @@
"required": true,
"defaultValue": true
}
]
],
"registration_required": true,
"subscription_required": false,
"free_subscription": false,
"service_homepage": "https://www.opencti.io",
"service_logo": {"path":"assets/logo_opencti.png", "caption": "logo"},
"screenshots": []
}
65 changes: 65 additions & 0 deletions analyzers/OpenCTI/OpenCTI_SearchObservables.json
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,65 @@
{
"name": "OpenCTI_SearchObservables",
"author": "ANSSI",
"license": "AGPL-V3",
"url": "https://github.com/TheHive-Project/Cortex-Analyzers/",
"version": "2.0",
"description": "Query multiple OpenCTI instances for a list of observables matching a pattern.",
"dataTypeList": [
"domain",
"ip",
"url",
"fqdn",
"uri_path",
"user-agent",
"hash",
"mail",
"mail_subject",
"registry",
"regexp",
"other",
"filename"
],
"config": {
"service": "search_observables"
},
"baseConfig": "OpenCTI",
"command": "OpenCTI/opencti.py",
"configurationItems": [
{
"name": "name",
"description": "Name of OpenCTI servers",
"multi": true,
"required": false,
"type": "string"
},
{
"name": "url",
"description": "URL of OpenCTI servers",
"type": "string",
"multi": true,
"required": true
},
{
"name": "key",
"description": "API key for each server",
"type": "string",
"multi": true,
"required": true
},
{
"name": "cert_check",
"description": "Verify server certificate",
"type": "boolean",
"multi": false,
"required": true,
"defaultValue": true
}
],
"registration_required": true,
"subscription_required": false,
"free_subscription": false,
"service_homepage": "https://www.opencti.io",
"service_logo": {"path":"assets/logo_opencti.png", "caption": "logo"},
"screenshots": []
}
Binary file added analyzers/OpenCTI/assets/logo_opencti.png
View file
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
82 changes: 36 additions & 46 deletions analyzers/OpenCTI/opencti.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ def __init__(self):
Analyzer.__init__(self)

self.service = self.get_param(
'config.service', "search_observable", None)
'config.service', "search_exact", None)

ssl = self.get_param('config.cert_check', True)
names = self.get_param('config.name', None, 'No OpenCTI instance name given.')
Expand All @@ -28,11 +28,11 @@ def __init__(self):
"name": names[i],
"url": urls[i],
"api_client": OpenCTIApiClient(
urls[i],
keys[i],
"error",
ssl,
proxies,
url=urls[i],
token=keys[i],
log_level="error",
ssl_verify=ssl,
proxies={'http': self.http_proxy, 'https': self.https_proxy}
)
})
except Exception as e:
Expand All @@ -44,24 +44,13 @@ def summary(self, raw):
namespace = "OpenCTI"
predicate = "Search Observable"

data = []
found = False
found = 0
for r in raw['results']:
if r['observable']:
found = True
for res in r['reports']:
if 'id' in res:
data.append(res['id'])

# return number of reports
value = "Found - " if found else "Not found - "
if not data:
value += "0 reports"
taxonomies.append(self.build_taxonomy(level, namespace, predicate, value))
else:
value += "{} report(s)".format(len(list(set(data))))
level = "suspicious"
taxonomies.append(self.build_taxonomy(level, namespace, predicate, value))
if r['observables']:
found += len(r['observables'])

value = ("Found " + str(found) + " observables") if found > 0 else "Not found"
taxonomies.append(self.build_taxonomy(level, namespace, predicate, value))

return {"taxonomies": taxonomies}

Expand All @@ -72,46 +61,47 @@ def run(self):
response = []

for opencti in self.openctis:
# Lookup observable
observable = opencti["api_client"].stix_observable.read(
filters=[{"key": "observable_value", "values": [data]}]
)
reports = []
if observable:
# Strip observable data for lighter output.
del(observable["markingDefinitionsIds"])
del(observable["tagsIds"])
# Lookup observables
observables = opencti["api_client"].stix_cyber_observable.list(search=data)

if self.service == "search_exact":
# Filter results to only keep exact matches
observables = [observable for observable in observables if observable["observable_value"] == data]

for observable in observables:
# Strip observable data for lighter output
del(observable["objectMarkingIds"])
del(observable["objectLabelIds"])
del(observable["externalReferencesIds"])
del(observable["indicatorsIds"])
del(observable["parent_types"])

# Get a list of reports containing this observable
reports = opencti["api_client"].report.list(
filters=[
{
"key": "observablesContains",
"key": "objectContains",
"values": [observable["id"]],
}
]
)

# Strip reports data for lighter output.
for r in reports:
del(r["graph_data"])
del(r["objectRefs"])
del(r["observableRefs"])
del(r["relationRefs"])
del(r["markingDefinitionsIds"])
del(r["tagsIds"])
del(r["externalReferencesIds"])
del(r["objectRefsIds"])
del(r["observableRefsIds"])
del(r["relationRefsIds"])
for report in reports:
del(report["objects"])
del(report["objectMarkingIds"])
del(report["externalReferencesIds"])
del(report["objectLabelIds"])
del(report["parent_types"])
del(report["objectsIds"])
del(report["x_opencti_graph_data"])

observable["reports"] = reports

response.append({
"name": opencti["name"],
"url": opencti["url"],
"observable": observable,
"reports": reports
"observables": observables
})

self.report({'results': response})
Expand Down
1 change: 1 addition & 0 deletions analyzers/OpenCTI/requirements.txt
View file
Original file line number Diff line number Diff line change
@@ -1,2 +1,3 @@
cortexutils
pycti
six>=1.14.0
137 changes: 137 additions & 0 deletions thehive-templates/OpenCTI_SearchExactObservable_2_0/long.html
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,137 @@
<div class="panel panel-info" ng-repeat="res in content.results">
<div class="panel-heading">
<b>OpenCTI {{res.name}}</b> - Report from {{res.url}}
</div>
<div class="panel-body">
<div ng-if="res.observables.length == 0">
<dl class="dl-horizontal">
<dt><i class="fa fa-warning"></i> No results</dt>
<dd>No results from OpenCTI {{res.name}}</dd>
</dl>
</div>
<div ng-if="res.observables.length > 0">
<dl class="dl-horizontal">
<dt>Observable Id:</dt>
<dd><a target="_blank" href="{{res.url}}/dashboard/observations/observables/{{res.observables[0].id}}">{{res.observables[0].id}}</a></dd>
</dl>
<dl class="dl-horizontal">
<dt>Entity Type:</dt>
<dd>{{res.observables[0].entity_type}}</dd>
</dl>
<dl class="dl-horizontal">
<dt>Created on:</dt>
<dd>{{res.observables[0].created_at}}</dd>
</dl>
<dl class="dl-horizontal">
<dt>Created by:</dt>
<dd><a target="_blank" href="{{res.url}}/dashboard/entities/organizations/{{res.observables[0].createdBy.id}}">{{res.observables[0].createdBy.name}}</a></dd>
</dl>
<dl class="dl-horizontal" ng-if="res.observables[0].objectMarking.length > 0" >
<dt>Marking Definitions:</dt>
<dd ng-repeat="md in res.observables[0].objectMarking">
<span ng-if="md.x_opencti_color==='#ffffff'" class="label"
ng-style="{'border':'1px solid','color': '#000000', 'background-color': md.x_opencti_color}">{{md.definition}}
</span>
<span ng-if="md.x_opencti_color!=='#ffffff'" class="label"
ng-style="{'background-color': md.x_opencti_color}">{{md.definition}}
</span>
</dd>
</dl>
<dl class="dl-horizontal" ng-if="res.observables[0].objectLabel.length > 0" >
<dt>Tags:</dt>
<dd ng-repeat="label in res.observables[0].objectLabel">
<span ng-if="label.color==='#ffffff'" class="label"
ng-style="{'border':'1px solid','color': '#000000', 'background-color': label.color}">{{label.value}}
</span>
<span ng-if="label.color!=='#ffffff'" class="label"
ng-style="{'background-color': label.color}">{{label.value}}
</span>
</dd>
</dl>
<dl class="dl-horizontal" ng-if="res.observables[0].externalReferences.length > 0" >
<dt>External refs:</dt>
<dd ng-repeat="extref in res.observables[0].externalReferences">
<a target="_blank" href="{{extref.url}}">{{extref.source_name}}</a>
</dd>
</dl>
<dl class="dl-horizontal" ng-if="res.observables[0].indicators.length > 0" >
<dt>Indicators:</dt>
<dd ng-repeat="ind in res.observables[0].indicators">
<a target="_blank" href="{{res.url}}/dashboard/observations/indicators/{{ind.id}}">{{ind.pattern_type}}:{{ind.pattern}}</a>
</dd>
</dl>
<div ng-repeat="report in res.observables[0].reports">
<dl class="dl-horizontal">
<dt>Report Id:</dt>
<dd><a target="_blank" href="{{res.url}}/dashboard/analysis/reports/{{report.id}}">{{report.id}}</a></dd>
</dl>
<dl class="dl-horizontal">
<dt>Report types:</dt>
<dd>{{report.report_types}}</dd>
</dl>
<dl class="dl-horizontal">
<dt>Name:</dt>
<dd>{{report.name}}</dd>
</dl>
<dl class="dl-horizontal">
<dt>Description:</dt>
<dd>{{report.description}}</dd>
</dl>
<dl class="dl-horizontal">
<dt>Published on:</dt>
<dd>{{report.published}}</dd>
</dl>
<dl class="dl-horizontal">
<dt>Confidence:</dt>
<dd>{{report.confidence}}</dd>
</dl>
<dl class="dl-horizontal">
<dt>Created by:</dt>
<dd><a target="_blank" href="{{res.url}}/dashboard/entities/organizations/{{report.createdBy.id}}">{{report.createdBy.name}}</a></dd>
</dl>
<dl class="dl-horizontal" ng-if="report.objectMarking.length > 0" >
<dt>Marking Definitions:</dt>
<dd ng-repeat="md in report.objectMarking">
<span ng-if="md.x_opencti_color==='#ffffff'" class="label"
ng-style="{'border':'1px solid','color': '#000000', 'background-color': md.x_opencti_color}">{{md.definition}}
</span>
<span ng-if="md.x_opencti_color!=='#ffffff'" class="label"
ng-style="{'background-color': md.x_opencti_color}">{{md.definition}}
</span>
</dd>
</dl>
<dl class="dl-horizontal" ng-if="report.objectLabel.length > 0" >
<dt>Labels:</dt>
<dd ng-repeat="label in report.objectLabel">
<span ng-if="label.color==='#ffffff'" class="label"
ng-style="{'border':'1px solid','color': '#000000', 'background-color': label.color}">{{label.value}}
</span>
<span ng-if="label.color!=='#ffffff'" class="label"
ng-style="{'background-color': label.color}">{{label.value}}
</span>
</dd>
</dl>
<dl class="dl-horizontal" ng-if="report.externalReferences.length > 0" >
<dt>External refs:</dt>
<dd ng-repeat="extref in report.externalReferences">
<a target="_blank" href="{{extref.url}}">{{extref.source_name}}</a>
</dd>
</dl>
<hr>
<br>
</div>
</div>

</div>
</div>


<!-- General error -->
<div class="panel panel-danger" ng-if="!success">
<div class="panel-heading">
<strong>{{(artifact.data || artifact.attachment.name) | fang}}</strong>
</div>
<div class="panel-body">
{{content.errorMessage}}
</div>
</div>
0 ...s/OpenCTI_SearchObservable_1_0/short.html → ...nCTI_SearchExactObservable_2_0/short.html
View file
File renamed without changes.
Loading

0 comments on commit b52c022

Please sign in to comment.