AlienVault OTX API change

[ilyaglow]

Hello!

Request Type

Bug

Work Environment

Question	Answer
Cortex Analyzer Name	OTXQuery
Cortex Analyzer Version	1.0
Cortex Version	1.1.3

Description

OTXQuery analyzer doesn't work

Steps to Reproduce

Try to analyze URL, IP or whatever with OTXQuery analyzer

Possible Solutions

Looking at the sources of the otxquery.py it seems that json of the response message from AlienVault OTX does not have section name (general for example) as the top key anymore.

Complementary information

{
  "errorMessage": "Error: Invalid output\n{\"artifacts\": [{\"type\": \"url\", \"value\": \"http://www.alexa.com/siteinfo/skyfling.com\"}, {\"type\": \"url\", \"value\": \"https://otx20-web-media.s3.amazonaws.com/media/avatars/AlienVault/resized/80/unnamed (1).jpg\"}, {\"type\": \"url\", \"value\": \"https://blog.korumail.com/cyber-security/french-commercial-proposal-malware/\"}, {\"type\": \"url\", \"value\": \"http://whois.domaintools.com/skyfling.com\"}], \"full\": {\"pulse_count\": 1, \"alexa\": \"http://www.alexa.com/siteinfo/skyfling.com\", \"url_list\": [], \"pulses\": [{\"pulse_source\": \"web\", \"subscriber_count\": 33395, \"modified_text\": \"22 hours ago \", \"is_subscribing\": 0, \"is_following\": 0, \"vote\": 0, \"id\": \"595a1b6388a8a17abd6bc048\", \"industries\": [], \"author\": {\"username\": \"AlienVault\", \"is_subscribed\": true, \"avatar_url\": \"https://otx20-web-media.s3.amazonaws.com/media/avatars/AlienVault/resized/80/unnamed (1).jpg\", \"is_following\": false, \"id\": \"2\"}, \"cloned_from\": null, \"comment_count\": 0, \"follower_count\": 0, \"public\": 1, \"indicator_type_counts\": {\"URL\": 20, \"SHA1\": 2, \"SHA256\": 2, \"MD5\": 2}, \"TLP\": \"white\", \"description\": {\"input\": {\"dataType\": \"url\", \"config\": {\"max_tlp\": 3, \"check_tlp\": true, \"service\": \"query\", \"key\": \"REMOVED\"}, \"tlp\": 0, \"data\": \"http://skyfling.com/jYGUFye7\"}, \"errorMessage\": \"API Error! Please verify data type is correct.\", \"success\": false}\n",
  "success": false
}

[ilyaglow]

Hmmm, today it's fine and everything works, will try to figure things out