Python check_newobserved示例

示例#1

文件： es_query_ipv4_outhtml_outmail.py 项目： clverhack/es_email_intel

    <!-- Bootstrap core JavaScript
    ================================================== -->
    <!-- Placed at the end of the document so the pages load faster -->
    <script src="https://ajax.googleapis.com/ajax/libs/jquery/1.11.2/jquery.min.js"></script>
    <script src="../../dist/js/bootstrap.min.js"></script>
    <!-- IE10 viewport hack for Surface/desktop Windows 8 bug -->
    <script src="../../assets/js/ie10-viewport-bug-workaround.js"></script>
  </body>
</html>
'''

ipv4s = common_functions.pull_ipv4_addresses(es, es_collection_name, body)

# Remove recently-seen items from the result set
for i in xrange(len(ipv4s) - 1, -1, -1):
	if external_lookups.check_newobserved(ipv4s[i]):
		del ipv4s[i]


# Exclude previously seen addresses from the past 30 days

### Everything after this is to write the HTML page

report_contents += preskel

for ipv4 in ipv4s:
	meta = common_functions.describesources(es, es_collection_name, 'ipv4:'+ipv4)
	report_contents += '<tr>'
	v4hash = hashlib.sha224(ipv4).hexdigest()
	report_contents += '<th scope="row"><a href="#'+str(v4hash)+'">'+ipv4+'</a></th>'
	report_contents += '<td>'

示例#2

文件： es_query_domain_outhtml_outmail.py 项目： wzr/es_email_intel

    <script src="../../assets/js/ie10-viewport-bug-workaround.js"></script>
  </body>
</html>
'''

print 'Pulling domains...'

domains = common_functions.pull_domain_addresses(es, es_collection_name, body)

print 'Raw count of domains: ' + str(len(domains))

# Remove recently-seen items from the result set
for i in xrange(len(domains) - 1, -1, -1):
    if re.search('^\-', domains[i]):
        del domains[i]
    if external_lookups.check_newobserved(domains[i]):
        del domains[i]

print 'Scrubbed count of domains: ' + str(len(domains))
### Everything after this is to write the HTML page

report_contents += preskel

for domain in domains:
    meta = common_functions.describesources(es, es_collection_name,
                                            'domain:' + domain)
    report_contents += '<tr>'
    v4hash = hashlib.sha224(domain).hexdigest()
    report_contents += '<th scope="row"><a href="#' + str(
        v4hash) + '">' + domain + '</a></th>'
    report_contents += '<td>'

示例#3

文件： es_query_md5_outhtml_outmail.py 项目： clverhack/es_email_intel

    <script src="../../dist/js/bootstrap.min.js"></script>
    <!-- IE10 viewport hack for Surface/desktop Windows 8 bug -->
    <script src="../../assets/js/ie10-viewport-bug-workaround.js"></script>
  </body>
</html>
'''

#print 'Pulling md5s...'

md5s = common_functions.pull_md5s(es, es_collection_name, body)

print 'Raw count of md5s: '+str(len(md5s))

# Remove recently-seen items from the result set
for i in xrange(len(md5s) - 1, -1, -1):
	if external_lookups.check_newobserved(md5s[i]):
		del md5s[i]

print 'Scrubbed count of md5s: '+str(len(md5s))
### Everything after this is to write the HTML page

report_contents += preskel

for md5 in md5s:
	meta = common_functions.describesources(es, es_collection_name, 'md5:'+md5)
	report_contents += '<tr>'
	report_contents += '<th scope="row"><a href="#'+str(md5)+'">'+md5+'</a></th>'
	report_contents += '<td>'
	seensubjects = []
	for subject in meta[0]:
		subject = subject.strip()

示例#4

文件： es_query_ipv4_outhtml_outmail.py 项目： wzr/es_email_intel

    <!-- Bootstrap core JavaScript
    ================================================== -->
    <!-- Placed at the end of the document so the pages load faster -->
    <script src="https://ajax.googleapis.com/ajax/libs/jquery/1.11.2/jquery.min.js"></script>
    <script src="../../dist/js/bootstrap.min.js"></script>
    <!-- IE10 viewport hack for Surface/desktop Windows 8 bug -->
    <script src="../../assets/js/ie10-viewport-bug-workaround.js"></script>
  </body>
</html>
'''

ipv4s = common_functions.pull_ipv4_addresses(es, es_collection_name, body)

# Remove recently-seen items from the result set
for i in xrange(len(ipv4s) - 1, -1, -1):
    if external_lookups.check_newobserved(ipv4s[i]):
        del ipv4s[i]

# Exclude previously seen addresses from the past 30 days

### Everything after this is to write the HTML page

report_contents += preskel

for ipv4 in ipv4s:
    meta = common_functions.describesources(es, es_collection_name,
                                            'ipv4:' + ipv4)
    report_contents += '<tr>'
    v4hash = hashlib.sha224(ipv4).hexdigest()
    report_contents += '<th scope="row"><a href="#' + str(
        v4hash) + '">' + ipv4 + '</a></th>'

示例#5

    <script src="../../dist/js/bootstrap.min.js"></script>
    <!-- IE10 viewport hack for Surface/desktop Windows 8 bug -->
    <script src="../../assets/js/ie10-viewport-bug-workaround.js"></script>
  </body>
</html>
'''

#print 'Pulling md5s...'

md5s = common_functions.pull_md5s(es, es_collection_name, body)

print 'Raw count of md5s: ' + str(len(md5s))

# Remove recently-seen items from the result set
for i in xrange(len(md5s) - 1, -1, -1):
    if external_lookups.check_newobserved(md5s[i]):
        del md5s[i]

print 'Scrubbed count of md5s: ' + str(len(md5s))
### Everything after this is to write the HTML page

report_contents += preskel

for md5 in md5s:
    meta = common_functions.describesources(es, es_collection_name,
                                            'md5:' + md5)
    report_contents += '<tr>'
    report_contents += '<th scope="row"><a href="#' + str(
        md5) + '">' + md5 + '</a></th>'
    report_contents += '<td>'
    seensubjects = []

示例#6

文件： es_query_domain_outhtml_outmail.py 项目： clverhack/es_email_intel

    <script src="../../assets/js/ie10-viewport-bug-workaround.js"></script>
  </body>
</html>
'''

print 'Pulling domains...'

domains = common_functions.pull_domain_addresses(es, es_collection_name, body)

print 'Raw count of domains: '+str(len(domains))

# Remove recently-seen items from the result set
for i in xrange(len(domains) - 1, -1, -1):
	if re.search('^\-', domains[i]):
		del domains[i]
	if external_lookups.check_newobserved(domains[i]):
		del domains[i]

print 'Scrubbed count of domains: '+str(len(domains))
### Everything after this is to write the HTML page

report_contents += preskel

for domain in domains:
	meta = common_functions.describesources(es, es_collection_name, 'domain:'+domain)
	report_contents += '<tr>'
	v4hash = hashlib.sha224(domain).hexdigest()
	report_contents += '<th scope="row"><a href="#'+str(v4hash)+'">'+domain+'</a></th>'
	report_contents += '<td>'
	seensubjects = []
	for subject in meta[0]: