def connect(self, params={}):
self.url = '{}://{}:{}'.format(params.get('protocol'), params.get('host'), params.get('port'))
self.verify = params.get('verify', True)
self.logger.info('URL: %s', self.url)
if not params.get('proxy'):
self.proxy = {}
else:
self.proxy = params.get('proxy')
self.logger.info('Proxy specified: %s', self.proxy)
self.logger.info("Connect: Connecting..")
self.client = CortexApi(self.url, cert=self.verify, proxies=self.proxy)
def connect(self, params={}):
self.url = "{}://{}:{}".format(params.get("protocol"),
params.get("host"), params.get("port"))
self.verify = params.get("verify", True)
self.logger.info("URL: %s", self.url)
if not params.get("proxy"):
self.proxy = {}
else:
self.proxy = params.get("proxy")
self.logger.info("Proxy specified: %s", self.proxy)
self.logger.info("Connect: Connecting..")
self.client = CortexApi(self.url, cert=self.verify, proxies=self.proxy)
#!/usr/bin/env python
# -*- coding: utf-8 -*-
import sys
import json
from cortex4py.api import CortexApi
from cortex4py.api import CortexException
api = CortexApi('http://127.0.0.1:9000')
print('Run analyzer')
print('-----------------------------')
job_id = None
try:
response = api.run_analyzer("MaxMind_GeoIP_3_0", "ip", 1, "8.8.8.8")
print(json.dumps(response, indent=4, sort_keys=True))
print('')
job_id = response["id"]
except CortexException as ex:
print('[ERROR]: Failed to run analyzer ({})'.format(ex.message))
sys.exit(0)
print('Get Job Report')
print('-----------------------------')
try:
response = api.get_job_report(job_id, '30s')
print(json.dumps(response, indent=4, sort_keys=True))
print('')
except CortexException as ex:
print('[ERROR]: Failed to get job report ({})'.format(ex.message))
sys.exit(0)
#!/usr/bin/env python
# -*- coding: utf-8 -*-
import sys
import json
from cortex4py.api import CortexApi
from cortex4py.api import CortexException
api = CortexApi('http://127.0.0.1:9000')
print('Run analyzer')
print('-----------------------------')
try:
job_id = None
response = api.run_analyzer("File_Info_2_0", "file", 1, "./sample.txt")
print(json.dumps(response, indent=4, sort_keys=True))
print('')
job_id = response["id"]
except CortexException as ex:
print('[ERROR]: Failed to run file analyzer ({})'.format(ex.message))
sys.exit(0)
print('Get Job Report')
print('-----------------------------')
try:
response = api.get_job_report(job_id)
print(json.dumps(response, indent=4, sort_keys=True))
print('')
except CortexException as ex:
print('[ERROR]: Failed to get job report ({})'.format(ex.message))
sys.exit(0)
#!/usr/bin/env python
# -*- coding: utf-8 -*-
import sys
import json
from cortex4py.api import CortexApi
from cortex4py.api import CortexException
api = CortexApi('http://127.0.0.1:9000')
print('List all analyzers')
print('-----------------------------')
try:
response = api.get_analyzers()
print('{} analyzers found'.format(len(response)))
print(json.dumps(response, indent=4, sort_keys=True))
print('')
except CortexException as ex:
print('[ERROR]: Failed to list analyzers ({})'.format(ex.message))
sys.exit(0)
print('List analyzers for file observables')
print('-----------------------------')
try:
response = api.get_analyzers("ip")
print('{} analyzers found for ip observables'.format(len(response)))
print(json.dumps(response, indent=4, sort_keys=True))
print('')
except CortexException as ex:
THEHIVE_KEY = (boto3.client("kms").decrypt(
CiphertextBlob=b64decode(THEHIVE_KEY),
EncryptionContext={
"LambdaFunctionName": os.environ["AWS_LAMBDA_FUNCTION_NAME"]
},
)["Plaintext"].decode("utf-8"))
CORTEX_KEY = (boto3.client("kms").decrypt(
CiphertextBlob=b64decode(CORTEX_KEY),
EncryptionContext={
"LambdaFunctionName": os.environ["AWS_LAMBDA_FUNCTION_NAME"]
},
)["Plaintext"].decode("utf-8"))
# TheHive and Cortex instances
thehive = TheHiveApi(THEHIVE_URL, THEHIVE_KEY)
cortex = CortexApi(CORTEX_URL, CORTEX_KEY)
# Configure logging
logger = logging.getLogger(__name__)
logger.setLevel(logging.DEBUG if os.getenv("DEBUG", False) else logging.INFO)
def lambda_handler(event, context):
# Validate event before proceeding
logger.debug(event)
if not all(key in event for key in ["object", "objectType", "operation"]):
raise ValueError(
"Missing 'object', 'objectType', and/or 'operation' in event")
# Parse and validate event type
event_type = hooks.parse_event_type(event["objectType"],