Python ioc_match Examples

Example #1

File: log4j_ip_iocs.py Project: panther-labs/panther-analysis

def title(event):
    ips = ",".join(ioc_match(event.get("p_any_ip_addresses"), LOG4J_IP_IOCS))
    return f"IP seen in LOG4J exploit scanning detected IP: {ips}"

Example #2

File: sunburst_fqdn_iocs.py Project: ttrues/panther-analysis

def title(event):
    domains = ','.join(
        ioc_match(event.get('p_any_domain_names'), SUNBURST_FQDN_IOCS))
    return sanitize_domain(
        f"Sunburst Indicator of Compromise Detected [Domains]: {domains}")

Example #3

File: log4j_ip_iocs.py Project: panther-labs/panther-analysis

def rule(event):
    return any(ioc_match(event.get("p_any_ip_addresses"), LOG4J_IP_IOCS))

Example #4

File: sunburst_fqdn_iocs.py Project: ttrues/panther-analysis

def rule(event):
    return any(ioc_match(event.get('p_any_domain_names'), SUNBURST_FQDN_IOCS))

Example #5

def title(event):
    ips = ",".join(ioc_match(event.get("p_any_ip_addresses"), SUNBURST_IP_IOCS))
    return f"Sunburst Indicator of Compromise Detected [IPs]: {ips}"

Example #6

def rule(event):
    return any(ioc_match(event.get("p_any_ip_addresses"), SUNBURST_IP_IOCS))

Example #7

def title(event):
    hashes = ','.join(
        ioc_match(event.get('p_any_sha256_hashes'), SUNBURST_SHA256_IOCS))
    return f"Sunburst Indicator of Compromise Detected [SHA256 hash]: {hashes}"

Example #8

def rule(event):
    return any(
        ioc_match(event.get('p_any_sha256_hashes'), SUNBURST_SHA256_IOCS))