Python nwQuery Examples

Example #1

File: nw_threat_2_ip_dst.py Project: bostonlink/nwmaltego_canari

def dotransform(request, response, config):

    # NW REST API Query and results

    risk_name = request.value
    diff = nwmodule.nwtime(config['netwitness/days'])

    if 'ip' in request.fields:
        ip = request.fields['ip']
        query = 'select ip.dst where (time=%s) && risk.warning="%s" && ip.src=%s' % (diff, risk_name, ip)
    else:
        query = 'select ip.dst where (time=%s) && risk.warning="%s"' % (diff, risk_name)

    json_data = json.loads(nwmodule.nwQuery(0, 0, query, 'application/json', 2500))
    ip_list = []

    for d in json_data['results']['fields']:
        count = 1
        for a in json_data['results']['fields']:
            if d['value'] == a['value']:
                count += 1

        if d['value'] not in ip_list:
            response += IPv4Address(d['value'].decode('ascii'), weight=count)
            ip_list.append(d['value'])

    return response

Example #2

File: nw_phrase_2_threat.py Project: bostonlink/nwmaltego_canari

def dotransform(request, response, config):

    # NW REST API Query and results

    phrase = request.value
    diff = nwmodule.nwtime(config['netwitness/days'])
    query = 'select risk.warning where (time=%s) && risk.warning contains %s' % (diff, phrase)

    json_data = json.loads(nwmodule.nwQuery(0, 0, query, 'application/json', 2500))
    threat_list = []

    for d in json_data['results']['fields']:
        count = 1
        for a in json_data['results']['fields']:
            if d['value'] == a['value']:
                count += 1

        if d['value'] not in threat_list:
            response += NWThreat(
                d['value'].decode('ascii'),
                metaid1=d['id1'],
                metaid2=d['id2'],
                type_=d['type'],
                count=d['count'],
                weight=count
            )
            threat_list.append(d['value'])

        count = 0

    return response

Example #3

File: nw_ip_2_services.py Project: bostonlink/nwmaltego_canari

def dotransform(request, response, config):

    # NW REST API Query and results

    ip_entity = request.value
    diff = nwmodule.nwtime(config["netwitness/days"])
    query = "select service where (time=%s) && (ip.dst=%s || ip.src=%s)" % (diff, ip_entity, ip_entity)
    json_data = json.loads(nwmodule.nwQuery(0, 0, query, "application/json", 2500))
    service_list = []

    for d in json_data["results"]["fields"]:
        count = 1
        for a in json_data["results"]["fields"]:
            if d["value"] == a["value"]:
                count += 1

        if d["value"] not in service_list:
            e = Service(d["value"].decode("ascii"), weight=count)
            e += Field("ip", ip_entity, displayname="IP Address")
            response += e
            service_list.append(d["value"])

        count = 0

    return response

Example #4

File: nw_phrase_2_meta.py Project: bostonlink/nwmaltego_canari

def dotransform(request, response, config):

    # NW REST API Query and results

    phrase = request.value
    diff = nwmodule.nwtime(config['netwitness/days'])
    query = 'select %s where (time=%s) && %s exists' % (phrase, diff, phrase)

    json_data = json.loads(nwmodule.nwQuery(0, 0, query, 'application/json', 2500))
    meta_list = []

    for d in json_data['results']['fields']:
        count = 1
        for a in json_data['results']['fields']:
            if d['value'] == a['value']:
                count += 1

        if d['value'] not in meta_list:
            response += NWMetakey(
                d['value'].decode('ascii'),
                weight=count)

            meta_list.append(d['value'])

        count = 0

    return response

Example #5

File: nw_host_2_services.py Project: bostonlink/nwmaltego_canari

def dotransform(request, response, config):

    # NW REST API Query and results

    hostname = request.value
    diff = nwmodule.nwtime(config['netwitness/days'])
    query = 'select service where (time=%s) && alias.host=%s' % (diff, hostname)
    json_data = json.loads(nwmodule.nwQuery(0, 0, query, 'application/json', 2500))
    service_list = []

    for d in json_data['results']['fields']:
        count = 1
        for a in json_data['results']['fields']:
            if d['value'] == a['value']:
                count += 1

        if d['value'] not in service_list:
            e = Service(d['value'].decode('ascii'), weight=count)
            e += Field("hostalias", hostname, displayname='Hostalias')
            response += e
            service_list.append(d['value'])

        count = 0

    return response

Example #6

File: nw_action_2_entitydst.py Project: bostonlink/nwmaltego_canari

def dotransform(request, response, config):

    # NW REST API Query and results
    if "ip" in request.fields:
        diff = nwmodule.nwtime(config["netwitness/days"])
        query = "select ip.dst where (time=%s) && service=%s && (ip.dst=%s || ip.src=%s)" % (
            diff,
            request.fields["service"],
            request.fields["ip"],
            request.fields["ip"],
        )
        json_data = json.loads(nwmodule.nwQuery(0, 0, query, "application/json", 2500))
        entity_list = []

        for d in json_data["results"]["fields"]:
            count = 1
            for a in json_data["results"]["fields"]:
                if d["value"] == a["value"]:
                    count += 1

            if d["value"] not in entity_list:
                response += IPv4Address(d["value"], weight=count)
                entity_list.append(request.fields["ip"])

    elif "hostname" in request.fields:
        diff = nwmodule.nwtime(config["netwitness/days"])
        query = "select ip.dst where (time=%s) && service=%s && alias.host=%s" % (
            diff,
            request.fields["service"],
            request.fields["hostname"],
        )
        json_data = json.loads(nwmodule.nwQuery(0, 0, query, "application/json", 2500))
        entity_list = []

        for d in json_data["results"]["fields"]:
            count = 1
            for a in json_data["results"]["fields"]:
                if d["value"] == a["value"]:
                    count += 1

            if d["value"] not in entity_list:
                response += IPv4Address(d["value"], weight=count)
                entity_list.append(request.fields["hostname"])

    return response

Example #7

File: nw_action_2_entitysrc.py Project: bostonlink/nwmaltego_canari

def dotransform(request, response, config):

    # NW REST API Query and results
    if 'ip' in request.fields:
        diff = nwmodule.nwtime(config['netwitness/days'])
        query = 'select ip.src where (time=%s) && service=%s && (ip.dst=%s || ip.src=%s)' % (diff, request.fields['service'],request.fields['ip'], request.fields['ip'])
        json_data = json.loads(nwmodule.nwQuery(0, 0, query, 'application/json', 2500))
        entity_list = []

        for d in json_data['results']['fields']:
            count = 1
            for a in json_data['results']['fields']:
                if d['value'] == a['value']:
                    count += 1

            if d['value'] not in entity_list:
                response += IPv4Address(d['value'], weight=count)
                entity_list.append(request.fields['ip'])

    elif 'hostname' in request.fields:
        diff = nwmodule.nwtime(config['netwitness/days'])
        query = 'select ip.src where (time=%s) && service=%s && alias.host=%s' % (diff, request.fields['service'], request.fields['hostname'])
        json_data = json.loads(nwmodule.nwQuery(0, 0, query, 'application/json', 2500))
        entity_list = []

        for d in json_data['results']['fields']:
            count = 1
            for a in json_data['results']['fields']:
                if d['value'] == a['value']:
                    count += 1

            if d['value'] not in entity_list:
                response += IPv4Address(d['value'], weight=count)
                entity_list.append(request.fields['hostname'])

    return response

Example #8

File: nw_ipsrc_2_ip_dst.py Project: bornio/nwmaltego_canari

def dotransform(request, response):

    nwmodule.nw_http_auth()

    # NW REST API Query and results

    ip_entity = request.value
    diff = nwmodule.nwtime(config['netwitness/days'])
    query = 'select ip.dst where (time=%s) && ip.src=%s' % (diff, ip_entity)

    json_data = json.loads(nwmodule.nwQuery(0, 0, query, 'application/json', 10))
    ip_list = []

    for d in json_data['results']['fields']:
        if d['value'] not in ip_list:
            response += IPv4Address(d['value'].decode('ascii'))
            ip_list.append(d['value'])

    return response

Example #9

File: nw_ipdst_2_ip_src.py Project: bostonlink/nwmaltego_canari

def dotransform(request, response, config):

    # NW REST API Query and results

    ip_entity = request.value
    diff = nwmodule.nwtime(config['netwitness/days'])
    query = 'select ip.src where (time=%s) && ip.dst=%s' % (diff, ip_entity)

    json_data = json.loads(nwmodule.nwQuery(0, 0, query, 'application/json', 2500))
    ip_list = []

    for d in json_data['results']['fields']:
        count = 1
        for a in json_data['results']['fields']:
            if d['value'] == a['value']:
                count += 1

        if d['value'] not in ip_list:
            response += IPv4Address(d['value'].decode('ascii'), weight=count)
            ip_list.append(d['value'])

        count = 0

    return response

Example #10

File: nw_ipsrc_2_ip_dst.py Project: bostonlink/nwmaltego_canari

def dotransform(request, response, config):

    # NW REST API Query and results

    ip_entity = request.value
    diff = nwmodule.nwtime(config["netwitness/days"])
    query = "select ip.dst where (time=%s) && ip.src=%s" % (diff, ip_entity)

    json_data = json.loads(nwmodule.nwQuery(0, 0, query, "application/json", 2500))
    ip_list = []

    for d in json_data["results"]["fields"]:
        count = 1
        for a in json_data["results"]["fields"]:
            if d["value"] == a["value"]:
                count += 1

        if d["value"] not in ip_list:
            response += IPv4Address(d["value"].decode("ascii"), weight=count)
            ip_list.append(d["value"])

        count = 0

    return response

Example #11

File: nw_service_2_ipdst.py Project: bostonlink/nwmaltego_canari

def dotransform(request, response, config):

    # NW REST API Query and results
    diff = nwmodule.nwtime(config['netwitness/days'])
    service = request.value

    if 'ip' in request.fields:
        ip = request.fields['ip']
        query = 'select ip.dst where (time=%s) && service=%s && (ip.src=%s || ip.dst=%s)' % (diff, service, ip, ip)
    else:
        breadhost = request.fields['hostname']
        query = 'select ip.dst where (time=%s) && service=%s && alias.host=%s' % (diff, service, breadhost)

    json_data = json.loads(nwmodule.nwQuery(0, 0, query, 'application/json', 2500))
    service_list = []

    for d in json_data['results']['fields']:
        count = 1
        for a in json_data['results']['fields']:
            if d['value'] == a['value']:
                count += 1

        if d['value'] not in service_list:
            e = IPv4Address(d['value'].decode('ascii'), weight=count)
            if 'ip' in request.fields:
                e += Field("ip", ip, displayname='IP Address')
            else:
                e += Field("hostname", breadhost, displayname='Hostname')

            e += Field("service", request.value, displayname='Service')
            response += e
            service_list.append(d['value'])

        count = 0

    return response