def bot_scan_backend(community, redis, consumer_name, api_key):
session = requests.Session()
api = PolyswarmAPI(api_key, community=community)
consumer = EventConsumer(['scan-requests'], 'bot-scan-backend',
consumer_name, get_walrus_db(redis), ScanRequest)
producer = EventProducer('scan-results', get_walrus_db(redis))
waiter = ResultWaiter(api, producer)
with ThreadPoolExecutor() as pool:
for event in consumer.iter_events():
try:
event = ScanRequest()
if event.artifact_type == 'FILE':
stream = session.get(event.uri, stream=True).raw
result = api.submit(stream)
elif event.artifact_type == 'URL':
result = api.submit(
event.uri, artifact_type=resources.ArtifactType.URL)
else:
logger.warning(
'Unsupported artifact type %s, maybe update this backend',
event.artifact_type)
continue
future = pool.submit(waiter.wait_for_result, result.id,
event.context)
except Exception as e:
logger.exception('Exception occurred processing event %s: %s',
event, e)
def __init__(self, apikey):
self.polyswarm_api = PolyswarmAPI(apikey)
self.alert_output = {}
self.alert_output['integration'] = INTEGRATION_NAME
self.alert_output['polyswarm'] = {}
self.alert_output['polyswarm']['found'] = 0
self.alert_output['polyswarm']['malicious'] = 0
def each_with_type(self, target, file_type):
self.results = dict()
poly = PolyswarmAPI(key=self.api_key)
if file_type == 'url' or file_type == 'msg' or file_type == 'eml':
pass
else:
positives = 0
total = 0
sha256 = None
if file_type == "hash":
sha256 = target.lower()
else:
sha256 = hashlib.sha256(open(target, 'r').read()).hexdigest()
try:
response = poly.search(sha256)
self.results['scans'] = list()
for result in response:
if result.assertions:
for assertion in result.assertions:
if assertion.verdict:
self.results['scans'].append({'av': assertion.author_name, 'veredict': 'Malware'})
positives += 1
total += 1
self.results['total'] = "{0}/{1}".format(positives, total)
self.results['positives'] = positives
self.results['PolyScore'] = result.polyscore
self.results['permalink'] = result.permalink
self.results['message'] = "Hash found"
return True
else:
return False
except NoResultsException:
return False
except Exception as error:
return False