def get_api_key(path):
items = path.split('.')
path = path[items[0].__len__():path.__len__()]
return api.get_api_key(app.mdl.__name__ + path)
import api
API_KEY = api.get_api_key()
CATEGORY_DICT = {
1: 'Film & Animation',
2: 'Autos & Vehicles',
10: 'Music',
15: 'Pets & Animals',
17: 'Sports',
18: 'Short Movies',
19: 'Travel & Events',
20: 'Gaming',
21: 'Videoblogging',
22: 'People & Blogs',
23: 'Comedy',
24: 'Entertainment',
25: 'News & Politics',
26: 'Howto & Style',
27: 'Education',
28: 'Science & Technology',
29: 'Nonprofits & Activism',
30: 'Movies',
31: 'Anime/Animation',
32: 'Action/Adventure',
33: 'Classics',
34: 'Comedy',
35: 'Documentary',
36: 'Drama',
37: 'Family',
38: 'Foreign',
#!/usr/bin/env python
import socket
import json
import argparse
from api import get_api_key, APIError
from query import search_is_domain, query_threat_recon
search_default = 'serval.essanavy.com'
api_key_default = get_api_key() or 'my API key'
if __name__ == "__main__":
parser = argparse.ArgumentParser(
description='Query the ThreatRecon database'
)
parser.add_argument(
'search_indicator',
default=search_default,
nargs="?"
)
parser.add_argument(
'-k', '--api-key', '--key',
dest="api_key",
default=api_key_default,
help="your API key (overrides ~/.threatrecon-apikey)"
)
args = parser.parse_args()
api_key = args.api_key
search = args.search_indicator
print "***** Searching %s" % search
def test_get_api_key(self):
key = get_api_key()
logger.info("get_api_key: key: %s, length: %s", key, len(key))
self.assertEqual(len(key), 32)
self.assertNotEqual(len(key), 50)
import socket
from api import get_api_key
from query import search_is_domain, query_threat_recon
api_key = get_api_key() or 'my API key'
search = raw_input("Please Enter an indicator: ")
results = query_threat_recon(search, api_key)
indicator_meta = []
related_indicators = []
#check host IP if no results
if results is None:
if search_is_domain(search):
try: # tries to get IP from domain
iplookup = socket.gethostbyname(search)
print "***** No results found for this domain..."
print "***** checking host IP: %s\n" % iplookup
results = query_threat_recon(iplookup, api_key)
except socket.gaierror as e:
print "***** Lookup failed: %s" % e
#find relationships in JSON results and list out
else:
for item in results:
root_node = item["RootNode"]
rdata = item["Rdata"]
indicator = item["Indicator"]