A script to submit email addresses seen in the message body of UCE to csirtg.io

1. py-cgmail
2. py-csirtgsdk

1. To demonstrate how to interact with csirtg using the csirtg SDK

1. A csirtg account
2. A csirtg account token; within csirtg:
3. Select your username
4. Select "tokens"
5. Select "Generate Token
6. A csirtg feed; within csirtg
7. Select (the plus sign)
8. Select Feed
9. Choose a feed name (e.g. port scanners)
10. Choose a feed description (hosts blocked in firewall logs)
11. A Linux mail server with procmail installed

• procmail is only one way this script could be used

1. Create a virtual environment for this project.
2. Install py-cgmail and py-csirtgsdk within the virtual environment.
3. Download the wf-email-addresses.py script

$ wget https://raw.githubusercontent.com/giovino/wf-email-addresses/master/wf-email-addresses.py

1. Edit wf-email-addresses.py to fill in (WHITEFACE_USER, WHITEFACE_FEED, WHITEFACE_TOKEN)
2. Leverage procmail to feed spam email through standard in. This is just an example, you will want to customize it appropriately.

# Process spam emails to have the email addresses in the message body submitted
# to csirtg
:0 c
* ^X-Spam-Level: \*\*\*\*\*
| /path/to/venv/bin/python2.7 /path/to/wf-email-addresses.py