diff --git a/analyzers/Censys-platform/Censys_search.json b/analyzers/Censys-platform/Censys_search.json index 7554183b3..d93f80769 100644 --- a/analyzers/Censys-platform/Censys_search.json +++ b/analyzers/Censys-platform/Censys_search.json @@ -8,6 +8,7 @@ "dataTypeList": ["other","ip","domain"], "baseConfig": "Censys Platform", "command": "Censys-platform/censys_search.py", + "dockerImage": "censys-platform:1.0", "configurationItems": [ { "name": "oid", diff --git a/analyzers/Censys-platform/Dockerfile b/analyzers/Censys-platform/Dockerfile new file mode 100644 index 000000000..ead23ac1b --- /dev/null +++ b/analyzers/Censys-platform/Dockerfile @@ -0,0 +1,8 @@ +FROM python:3.14-slim + +WORKDIR /worker +COPY . Censys-platform + +RUN pip install --no-cache-dir -r Censys-platform/requirements.txt + +ENTRYPOINT Censys-platform/censys_search.py diff --git a/analyzers/Censys-platform/requirements.txt b/analyzers/Censys-platform/requirements.txt index aecd1cbd9..b0e721351 100644 --- a/analyzers/Censys-platform/requirements.txt +++ b/analyzers/Censys-platform/requirements.txt @@ -1,2 +1,2 @@ -cortexutils -censys-platform +cortexutils==2.2.1 +censys-platform==0.16.1 diff --git a/analyzers/CustomProxy/CustomProxy.json b/analyzers/CustomProxy/CustomProxy.json index 6cbc9793b..8b9f6b2bc 100644 --- a/analyzers/CustomProxy/CustomProxy.json +++ b/analyzers/CustomProxy/CustomProxy.json @@ -10,6 +10,7 @@ "description": "Query a custom proxy", "dataTypeList": ["url"], "command": "CustomProxy/custom_proxy.py", + "dockerImage": "customproxy:1.0", "configurationItems": [ { "name": "base_url", diff --git a/analyzers/CustomProxy/Dockerfile b/analyzers/CustomProxy/Dockerfile new file mode 100644 index 000000000..afee91ba0 --- /dev/null +++ b/analyzers/CustomProxy/Dockerfile @@ -0,0 +1,8 @@ +FROM python:3.14-slim + +WORKDIR /worker +COPY . CustomProxy + +RUN pip install --no-cache-dir -r CustomProxy/requirements.txt + +ENTRYPOINT CustomProxy/custom_proxy.py diff --git a/analyzers/CustomProxy/custom_proxy.py b/analyzers/CustomProxy/custom_proxy.py index a24254ba3..80a2bc286 100755 --- a/analyzers/CustomProxy/custom_proxy.py +++ b/analyzers/CustomProxy/custom_proxy.py @@ -17,6 +17,10 @@ def __init__(self): None, "No base URL configuration in Cortex.", ) + # the request url is built by plain concatenation below, so tolerate a + # base url configured without its trailing slash + if not self.base_url.endswith("/"): + self.base_url += "/" def do_request(self, method, module, url, headers, post_data, post_data_hex): try: diff --git a/analyzers/CustomProxy/requirements.txt b/analyzers/CustomProxy/requirements.txt index 655e90ed6..7a91a7ea9 100644 --- a/analyzers/CustomProxy/requirements.txt +++ b/analyzers/CustomProxy/requirements.txt @@ -1,3 +1,2 @@ -cortexutils -requests - +cortexutils==2.2.1 +requests==2.34.2 diff --git a/analyzers/PublicWWW/Dockerfile b/analyzers/PublicWWW/Dockerfile new file mode 100644 index 000000000..3f06b1978 --- /dev/null +++ b/analyzers/PublicWWW/Dockerfile @@ -0,0 +1,8 @@ +FROM python:3.14-slim + +WORKDIR /worker +COPY . PublicWWW + +RUN pip install --no-cache-dir -r PublicWWW/requirements.txt + +ENTRYPOINT PublicWWW/publicwww_analyzer.py diff --git a/analyzers/PublicWWW/PublicWWW_Search.json b/analyzers/PublicWWW/PublicWWW_Search.json index 42d2eeaf4..2b6a31259 100644 --- a/analyzers/PublicWWW/PublicWWW_Search.json +++ b/analyzers/PublicWWW/PublicWWW_Search.json @@ -8,6 +8,7 @@ "description": "Search pattern on publicWWW", "dataTypeList": ["other"], "command": "PublicWWW/publicwww_analyzer.py", + "dockerImage": "publicwww:0.1.1", "configurationItems": [ { "name": "api_key", diff --git a/analyzers/PublicWWW/requirements.txt b/analyzers/PublicWWW/requirements.txt index 8875f1972..7a91a7ea9 100644 --- a/analyzers/PublicWWW/requirements.txt +++ b/analyzers/PublicWWW/requirements.txt @@ -1,3 +1,2 @@ -cortexutils -requests -import urllib \ No newline at end of file +cortexutils==2.2.1 +requests==2.34.2 diff --git a/analyzers/Shodan/Dockerfile b/analyzers/Shodan/Dockerfile new file mode 100644 index 000000000..52c5d94a7 --- /dev/null +++ b/analyzers/Shodan/Dockerfile @@ -0,0 +1,8 @@ +FROM python:3.14-slim + +WORKDIR /worker +COPY . Shodan + +RUN pip install --no-cache-dir -r Shodan/requirements.txt + +ENTRYPOINT Shodan/shodan_analyzer.py diff --git a/analyzers/Shodan/Shodan_DNSResolve.json b/analyzers/Shodan/Shodan_DNSResolve.json index 511deb285..d8222474d 100644 --- a/analyzers/Shodan/Shodan_DNSResolve.json +++ b/analyzers/Shodan/Shodan_DNSResolve.json @@ -7,6 +7,7 @@ "description": "Retrieve domain resolutions on Shodan.", "dataTypeList": ["domain", "fqdn"], "command": "Shodan/shodan_analyzer.py", + "dockerImage": "shodan:1.0", "baseConfig": "Shodan", "config": { "service": "dns_resolve" diff --git a/analyzers/Shodan/Shodan_Host.json b/analyzers/Shodan/Shodan_Host.json index f6e54bf2c..442539ec8 100644 --- a/analyzers/Shodan/Shodan_Host.json +++ b/analyzers/Shodan/Shodan_Host.json @@ -7,6 +7,7 @@ "description": "Retrieve key Shodan information on an IP address.", "dataTypeList": ["ip"], "command": "Shodan/shodan_analyzer.py", + "dockerImage": "shodan:1.0", "baseConfig": "Shodan", "config": { "service": "host" diff --git a/analyzers/Shodan/Shodan_Host_History.json b/analyzers/Shodan/Shodan_Host_History.json index 2547903f1..ad81dfead 100644 --- a/analyzers/Shodan/Shodan_Host_History.json +++ b/analyzers/Shodan/Shodan_Host_History.json @@ -7,6 +7,7 @@ "description": "Retrieve Shodan history scan results for an IP address.", "dataTypeList": ["ip"], "command": "Shodan/shodan_analyzer.py", + "dockerImage": "shodan:1.0", "baseConfig": "Shodan", "config": { "service": "host_history" diff --git a/analyzers/Shodan/Shodan_InfoDomain.json b/analyzers/Shodan/Shodan_InfoDomain.json index b8161891a..029a82661 100644 --- a/analyzers/Shodan/Shodan_InfoDomain.json +++ b/analyzers/Shodan/Shodan_InfoDomain.json @@ -7,6 +7,7 @@ "description": "Retrieve key Shodan information on a domain.", "dataTypeList": ["domain", "fqdn"], "command": "Shodan/shodan_analyzer.py", + "dockerImage": "shodan:1.0", "baseConfig": "Shodan", "config": { "service": "info_domain" diff --git a/analyzers/Shodan/Shodan_ReverseDNS.json b/analyzers/Shodan/Shodan_ReverseDNS.json index bfb3360fc..a7319dd3b 100644 --- a/analyzers/Shodan/Shodan_ReverseDNS.json +++ b/analyzers/Shodan/Shodan_ReverseDNS.json @@ -7,6 +7,7 @@ "description": "Retrieve ip reverse DNS resolutions on Shodan.", "dataTypeList": ["ip"], "command": "Shodan/shodan_analyzer.py", + "dockerImage": "shodan:1.0", "baseConfig": "Shodan", "config": { "service": "reverse_dns" diff --git a/analyzers/Shodan/Shodan_Search.json b/analyzers/Shodan/Shodan_Search.json index ba90ad75b..db00b307e 100644 --- a/analyzers/Shodan/Shodan_Search.json +++ b/analyzers/Shodan/Shodan_Search.json @@ -7,6 +7,7 @@ "description": "Search query on Shodan", "dataTypeList": ["other"], "command": "Shodan/shodan_analyzer.py", + "dockerImage": "shodan:2.0", "baseConfig": "Shodan", "config": { "service": "search" diff --git a/analyzers/Shodan/requirements.txt b/analyzers/Shodan/requirements.txt index 66f340913..64df4541c 100644 --- a/analyzers/Shodan/requirements.txt +++ b/analyzers/Shodan/requirements.txt @@ -1,3 +1,3 @@ -shodan -cortexutils -requests \ No newline at end of file +shodan==1.31.0 +cortexutils==2.2.1 +requests==2.34.2 diff --git a/analyzers/Urlscan.io/Dockerfile b/analyzers/Urlscan.io/Dockerfile new file mode 100644 index 000000000..ec08a82f8 --- /dev/null +++ b/analyzers/Urlscan.io/Dockerfile @@ -0,0 +1,8 @@ +FROM python:3.14-slim + +WORKDIR /worker +COPY . Urlscan.io + +RUN pip install --no-cache-dir -r Urlscan.io/requirements.txt + +ENTRYPOINT Urlscan.io/urlscan_analyzer.py diff --git a/analyzers/Urlscan.io/Urlscan_Scan.json b/analyzers/Urlscan.io/Urlscan_Scan.json index f34ce9af1..b05f9e151 100644 --- a/analyzers/Urlscan.io/Urlscan_Scan.json +++ b/analyzers/Urlscan.io/Urlscan_Scan.json @@ -7,6 +7,7 @@ "description": "Scan URLs on urlscan.io", "dataTypeList": ["url", "domain", "fqdn"], "command": "Urlscan.io/urlscan_analyzer.py", + "dockerImage": "urlscan.io:0.1.0", "baseConfig": "Urlscan.io", "config": { "service":"scan" diff --git a/analyzers/Urlscan.io/Urlscan_Search.json b/analyzers/Urlscan.io/Urlscan_Search.json index 3aa152c87..5dfae2a3d 100644 --- a/analyzers/Urlscan.io/Urlscan_Search.json +++ b/analyzers/Urlscan.io/Urlscan_Search.json @@ -8,6 +8,7 @@ "description": "Search IPs, domains, hashes or URLs on urlscan.io", "dataTypeList": ["ip", "domain", "hash", "url", "other"], "command": "Urlscan.io/urlscan_analyzer.py", + "dockerImage": "urlscan.io:0.1.2", "config": { "service":"search" }, diff --git a/analyzers/Urlscan.io/Urlscan_SearchSubrequests.json b/analyzers/Urlscan.io/Urlscan_SearchSubrequests.json index cd509caa5..01d109205 100644 --- a/analyzers/Urlscan.io/Urlscan_SearchSubrequests.json +++ b/analyzers/Urlscan.io/Urlscan_SearchSubrequests.json @@ -8,6 +8,7 @@ "description": "Search a filter in subrequests", "dataTypeList": ["other"], "command": "Urlscan.io/urlscan_analyzer.py", + "dockerImage": "urlscan.io:0.1", "config": { "service":"search_subrequests" }, diff --git a/analyzers/Urlscan.io/requirements.txt b/analyzers/Urlscan.io/requirements.txt index a4ecc1005..8bce07497 100644 --- a/analyzers/Urlscan.io/requirements.txt +++ b/analyzers/Urlscan.io/requirements.txt @@ -1,4 +1,3 @@ -cortexutils -requests -pyopenssl -jmespath \ No newline at end of file +cortexutils==2.2.1 +requests==2.34.2 +jmespath==1.1.0 diff --git a/analyzers/VirusTotal/Dockerfile b/analyzers/VirusTotal/Dockerfile index 16ef1becf..5bcb716a6 100644 --- a/analyzers/VirusTotal/Dockerfile +++ b/analyzers/VirusTotal/Dockerfile @@ -1,11 +1,8 @@ -FROM python:3.9 +FROM python:3.14-slim WORKDIR /worker COPY . VirusTotal -RUN apt update -RUN apt install -y -q libimage-exiftool-perl && \ - rm -rf /var/lib/apt/lists/* RUN pip install --no-cache-dir -r VirusTotal/requirements.txt -ENTRYPOINT VirusTotal/virustotal.py \ No newline at end of file +ENTRYPOINT VirusTotal/virustotal.py diff --git a/analyzers/VirusTotal/VirusTotal_DownloadSample.json b/analyzers/VirusTotal/VirusTotal_DownloadSample.json index cd28c02b3..45d1302f9 100644 --- a/analyzers/VirusTotal/VirusTotal_DownloadSample.json +++ b/analyzers/VirusTotal/VirusTotal_DownloadSample.json @@ -26,5 +26,6 @@ "path": "assets/virustotal-logo.png", "caption": "logo" }, - "command": "VirusTotal/virustotal.py" + "command": "VirusTotal/virustotal.py", + "dockerImage": "virustotal:3.1" } diff --git a/analyzers/VirusTotal/VirusTotal_File_Relationships.json b/analyzers/VirusTotal/VirusTotal_File_Relationships.json index d8b1053a4..cf4ff9245 100644 --- a/analyzers/VirusTotal/VirusTotal_File_Relationships.json +++ b/analyzers/VirusTotal/VirusTotal_File_Relationships.json @@ -19,5 +19,6 @@ "required": true } ], - "command": "VirusTotal/virustotal.py" + "command": "VirusTotal/virustotal.py", + "dockerImage": "virustotal:1.0" } diff --git a/analyzers/VirusTotal/VirusTotal_GetReport.json b/analyzers/VirusTotal/VirusTotal_GetReport.json index 6ef470fc9..a9ed9e52b 100644 --- a/analyzers/VirusTotal/VirusTotal_GetReport.json +++ b/analyzers/VirusTotal/VirusTotal_GetReport.json @@ -7,6 +7,7 @@ "description": "Get the latest VirusTotal report for a file, hash, domain or an IP address.", "dataTypeList": ["file", "hash", "domain", "fqdn", "ip", "url"], "command": "VirusTotal/virustotal.py", + "dockerImage": "virustotal:3.1", "baseConfig": "VirusTotal", "config": { "service": "get" diff --git a/analyzers/VirusTotal/VirusTotal_Rescan.json b/analyzers/VirusTotal/VirusTotal_Rescan.json index 7266c5d8c..0f61e8539 100644 --- a/analyzers/VirusTotal/VirusTotal_Rescan.json +++ b/analyzers/VirusTotal/VirusTotal_Rescan.json @@ -55,5 +55,6 @@ "path": "assets/virustotal-logo.png", "caption": "logo" }, - "command": "VirusTotal/virustotal.py" + "command": "VirusTotal/virustotal.py", + "dockerImage": "virustotal:3.1" } diff --git a/analyzers/VirusTotal/VirusTotal_Scan.json b/analyzers/VirusTotal/VirusTotal_Scan.json index 9b855d633..46b33ca9f 100644 --- a/analyzers/VirusTotal/VirusTotal_Scan.json +++ b/analyzers/VirusTotal/VirusTotal_Scan.json @@ -41,5 +41,6 @@ "path": "assets/virustotal-logo.png", "caption": "logo" }, - "command": "VirusTotal/virustotal.py" + "command": "VirusTotal/virustotal.py", + "dockerImage": "virustotal:3.1" } diff --git a/analyzers/VirusTotal/VirusTotal_Search.json b/analyzers/VirusTotal/VirusTotal_Search.json index 2a7bd4fac..20af07b4b 100644 --- a/analyzers/VirusTotal/VirusTotal_Search.json +++ b/analyzers/VirusTotal/VirusTotal_Search.json @@ -19,5 +19,6 @@ "required": true } ], - "command": "VirusTotal/virustotal.py" + "command": "VirusTotal/virustotal.py", + "dockerImage": "virustotal:1.0" } diff --git a/analyzers/VirusTotal/requirements.txt b/analyzers/VirusTotal/requirements.txt index 6a1612f9c..f871e7ddc 100644 --- a/analyzers/VirusTotal/requirements.txt +++ b/analyzers/VirusTotal/requirements.txt @@ -1,6 +1,3 @@ -cortexutils -future -requests -vt-py -python-magic -filetype +cortexutils==2.2.1 +requests==2.34.2 +virustotal-api==1.1.11 diff --git a/analyzers/catalog.json b/analyzers/catalog.json index a8b9e4951..b27e9f58c 100644 --- a/analyzers/catalog.json +++ b/analyzers/catalog.json @@ -269,6 +269,39 @@ "dockerImage": "cortexneurons/censys:1" } , +{ + "name": "Censys_platform_search", + "author": "Marc Nebout, SEKOIA", + "version": "1.0", + "license": "AGPL-V3", + "url": "https://github.com/CTIMarc/Cortex-Analyzers/tree/master/analyzers/Censys-platform", + "description": "Search pattern in Censys platform", + "dataTypeList": [ + "other", + "ip", + "domain" + ], + "baseConfig": "Censys Platform", + "command": "Censys-platform/censys_search.py", + "dockerImage": "censys-platform:1.0", + "configurationItems": [ + { + "name": "oid", + "description": "Organization ID in Censys", + "type": "string", + "multi": false, + "required": true + }, + { + "name": "key", + "description": "API key", + "type": "string", + "multi": false, + "required": true + } + ] +} +, { "name": "Crt_sh_Transparency_Logs", "author": "crackytsi", @@ -378,6 +411,31 @@ "dockerImage": "cortexneurons/cuckoosandbox_url_analysis:1" } , +{ + "name": "CustomProxy", + "author": "CTIMarc", + "license": "AGPL-V3", + "url": "https://github.com/CTIMarc/Cortex-Analyzers", + "version": "1.0", + "baseConfig": "CustomProxy", + "config": {}, + "description": "Query a custom proxy", + "dataTypeList": [ + "url" + ], + "command": "CustomProxy/custom_proxy.py", + "dockerImage": "customproxy:1.0", + "configurationItems": [ + { + "name": "base_url", + "description": "Base url of the proxy", + "type": "string", + "multi": false, + "required": true + } + ] +} +, { "name": "CyberCrime-Tracker", "author": "ph34tur3", @@ -2799,6 +2857,30 @@ "dockerImage": "cortexneurons/proofpoint_lookup:1" } , +{ + "name": "PublicWWW_Search", + "author": "CTI_Marc", + "license": "MIT", + "url": "https://github.com/CTIMarc/Cortex-Analyzers", + "version": "0.1.1", + "baseConfig": "PublicWWW", + "description": "Search pattern on publicWWW", + "dataTypeList": [ + "other" + ], + "command": "PublicWWW/publicwww_analyzer.py", + "dockerImage": "publicwww:0.1.1", + "configurationItems": [ + { + "name": "api_key", + "description": "API Key", + "type": "string", + "multi": false, + "required": true + } + ] +} +, { "name": "Pulsedive_GetIndicator", "version": "1.0", @@ -2962,8 +3044,11 @@ "license": "AGPL-V3", "description": "Retrieve domain resolutions on Shodan.", "dataTypeList": [ - "domain" + "domain", + "fqdn" ], + "command": "Shodan/shodan_analyzer.py", + "dockerImage": "shodan:1.0", "baseConfig": "Shodan", "config": { "service": "dns_resolve" @@ -2976,8 +3061,7 @@ "multi": false, "required": true } - ], - "dockerImage": "cortexneurons/shodan_dnsresolve:1" + ] } , { @@ -2990,6 +3074,8 @@ "dataTypeList": [ "ip" ], + "command": "Shodan/shodan_analyzer.py", + "dockerImage": "shodan:1.0", "baseConfig": "Shodan", "config": { "service": "host" @@ -3002,8 +3088,7 @@ "multi": false, "required": true } - ], - "dockerImage": "cortexneurons/shodan_host:1" + ] } , { @@ -3016,6 +3101,8 @@ "dataTypeList": [ "ip" ], + "command": "Shodan/shodan_analyzer.py", + "dockerImage": "shodan:1.0", "baseConfig": "Shodan", "config": { "service": "host_history" @@ -3028,8 +3115,7 @@ "multi": false, "required": true } - ], - "dockerImage": "cortexneurons/shodan_host_history:1" + ] } , { @@ -3040,8 +3126,11 @@ "license": "AGPL-V3", "description": "Retrieve key Shodan information on a domain.", "dataTypeList": [ - "domain" + "domain", + "fqdn" ], + "command": "Shodan/shodan_analyzer.py", + "dockerImage": "shodan:1.0", "baseConfig": "Shodan", "config": { "service": "info_domain" @@ -3054,8 +3143,7 @@ "multi": false, "required": true } - ], - "dockerImage": "cortexneurons/shodan_infodomain:1" + ] } , { @@ -3068,6 +3156,8 @@ "dataTypeList": [ "ip" ], + "command": "Shodan/shodan_analyzer.py", + "dockerImage": "shodan:1.0", "baseConfig": "Shodan", "config": { "service": "reverse_dns" @@ -3080,8 +3170,7 @@ "multi": false, "required": true } - ], - "dockerImage": "cortexneurons/shodan_reversedns:1" + ] } , { @@ -3094,6 +3183,8 @@ "dataTypeList": [ "other" ], + "command": "Shodan/shodan_analyzer.py", + "dockerImage": "shodan:2.0", "baseConfig": "Shodan", "config": { "service": "search" @@ -3106,8 +3197,7 @@ "multi": false, "required": true } - ], - "dockerImage": "cortexneurons/shodan_search:2" + ] } , { @@ -3482,20 +3572,91 @@ "dockerImage": "cortexneurons/unshortenlink:1" } , +{ + "name": "Urlscan.io_Scan", + "author": "ninoseki, Kyle Parrish (@arnydo)", + "license": "MIT", + "url": "https://github.com/arnydo/Cortex-Analyzers", + "version": "0.1.0", + "description": "Scan URLs on urlscan.io", + "dataTypeList": [ + "url", + "domain", + "fqdn" + ], + "command": "Urlscan.io/urlscan_analyzer.py", + "dockerImage": "urlscan.io:0.1.0", + "baseConfig": "Urlscan.io", + "config": { + "service": "scan" + }, + "configurationItems": [ + { + "name": "key", + "description": "API key for Urlscan.io", + "type": "string", + "multi": false, + "required": true + } + ] +} +, { "name": "Urlscan.io_Search", - "author": "ninoseki", + "author": "ninoseki, CTI_Marc", "license": "MIT", "url": "https://github.com/ninoseki/cortex_urlscan_analyzer", - "version": "0.1.0", + "version": "0.1.2", + "baseConfig": "Urlscan.io", "description": "Search IPs, domains, hashes or URLs on urlscan.io", "dataTypeList": [ "ip", "domain", "hash", - "url" + "url", + "other" + ], + "command": "Urlscan.io/urlscan_analyzer.py", + "dockerImage": "urlscan.io:0.1.2", + "config": { + "service": "search" + }, + "configurationItems": [ + { + "name": "key", + "description": "Api Key", + "type": "string", + "multi": false, + "required": true + } + ] +} +, +{ + "name": "Urlscan.io_Search_Subrequests", + "author": "CTI_Marc", + "license": "MIT", + "url": "https://github.com/CTIMarc/Cortex-Analyzers", + "version": "0.1", + "baseConfig": "Urlscan.io", + "description": "Search a filter in subrequests", + "dataTypeList": [ + "other" ], - "dockerImage": "cortexneurons/urlscan.io_search:0" + "command": "Urlscan.io/urlscan_analyzer.py", + "dockerImage": "urlscan.io:0.1", + "config": { + "service": "search_subrequests" + }, + "configurationItems": [ + { + "name": "key", + "description": "Api Key", + "type": "string", + "multi": false, + "required": true + } + ] } , { @@ -3552,10 +3713,71 @@ "dockerImage": "cortexneurons/vmray:3" } , +{ + "name": "VirusTotal_DownloadSample", + "version": "3.1", + "author": "LDO-CERT", + "url": "https://github.com/TheHive-Project/Cortex-Analyzers", + "license": "AGPL-V3", + "description": "Use VirusTotal to download the original file for an hash.", + "dataTypeList": [ + "hash" + ], + "baseConfig": "VirusTotal", + "config": { + "service": "download" + }, + "configurationItems": [ + { + "name": "key", + "description": "API private key for Virustotal", + "type": "string", + "multi": false, + "required": true + } + ], + "registration_required": true, + "subscription_required": true, + "service_homepage": "https://www.virustotal.com/", + "service_logo": { + "path": "assets/virustotal-logo.png", + "caption": "logo" + }, + "command": "VirusTotal/virustotal.py", + "dockerImage": "virustotal:3.1" +} +, +{ + "name": "VirusTotal_File_Relationship", + "version": "1.0", + "author": "CTI_Marc", + "url": "https://github.com/TheHive-Project/Cortex-Analyzers", + "license": "AGPL-V3", + "description": "Use VirusTotal to get File Relationships", + "dataTypeList": [ + "hash" + ], + "baseConfig": "VirusTotal", + "config": { + "service": "relationships" + }, + "configurationItems": [ + { + "name": "key", + "description": "API key for Virustotal", + "type": "string", + "multi": false, + "required": true + } + ], + "command": "VirusTotal/virustotal.py", + "dockerImage": "virustotal:1.0" +} +, { "name": "VirusTotal_GetReport", - "version": "3.0", - "author": "CERT-BDF", + "version": "3.1", + "author": "CERT-BDF, StrangeBee", "url": "https://github.com/TheHive-Project/Cortex-Analyzers", "license": "AGPL-V3", "description": "Get the latest VirusTotal report for a file, hash, domain or an IP address.", @@ -3563,9 +3785,12 @@ "file", "hash", "domain", + "fqdn", "ip", "url" ], + "command": "VirusTotal/virustotal.py", + "dockerImage": "virustotal:3.1", "baseConfig": "VirusTotal", "config": { "service": "get" @@ -3585,15 +3810,119 @@ "multi": false, "required": false, "defaultValue": 60 + }, + { + "name": "rescan_hash_older_than_days", + "description": "Rescan hash observable if report is older than selected days", + "type": "number", + "multi": false, + "required": false, + "defaultValue": 30 + }, + { + "name": "highlighted_antivirus", + "description": "Add taxonomy if selected AV don't recognize observable", + "type": "string", + "multi": true, + "required": false + }, + { + "name": "download_sample", + "description": "Download automatically sample as observable when looking for hash", + "type": "boolean", + "multi": false, + "required": false + }, + { + "name": "download_sample_if_highlighted", + "description": "Download automatically sample as observable if highlighted antivirus didn't recognize", + "type": "boolean", + "multi": false, + "required": false + } + ], + "registration_required": true, + "subscription_required": false, + "service_homepage": "https://www.virustotal.com/", + "service_logo": { + "path": "assets/virustotal-logo.png", + "caption": "logo" + }, + "screenshots": [ + { + "path": "assets/virustotal-scan.png", + "caption": "VirusTotal: long report" + } + ] +} +, +{ + "name": "VirusTotal_Rescan", + "version": "3.1", + "author": "CERT-LDO", + "url": "https://github.com/TheHive-Project/Cortex-Analyzers", + "license": "AGPL-V3", + "description": "Use VirusTotal to run new analysis on hash.", + "dataTypeList": [ + "hash" + ], + "baseConfig": "VirusTotal", + "config": { + "service": "rescan" + }, + "configurationItems": [ + { + "name": "key", + "description": "API key for Virustotal", + "type": "string", + "multi": false, + "required": true + }, + { + "name": "polling_interval", + "description": "Define time interval between two requests attempts for the report", + "type": "number", + "multi": false, + "required": false, + "defaultValue": 60 + }, + { + "name": "highlighted_antivirus", + "description": "Add taxonomy if selected AV don't recognize observable", + "type": "string", + "multi": true, + "required": false + }, + { + "name": "download_sample", + "description": "Download automatically sample as observable when looking for hash", + "type": "boolean", + "multi": false, + "required": false + }, + { + "name": "download_sample_if_highlighted", + "description": "Download automatically sample as observable if highlighted antivirus didn't recognize", + "type": "boolean", + "multi": false, + "required": false } ], - "dockerImage": "cortexneurons/virustotal_getreport:3" + "registration_required": true, + "subscription_required": true, + "service_homepage": "https://www.virustotal.com/", + "service_logo": { + "path": "assets/virustotal-logo.png", + "caption": "logo" + }, + "command": "VirusTotal/virustotal.py", + "dockerImage": "virustotal:3.1" } , { "name": "VirusTotal_Scan", - "version": "3.0", - "author": "CERT-BDF", + "version": "3.1", + "author": "CERT-BDF, StrangeBee", "url": "https://github.com/TheHive-Project/Cortex-Analyzers", "license": "AGPL-V3", "description": "Use VirusTotal to scan a file or URL.", @@ -3620,9 +3949,51 @@ "multi": false, "required": false, "defaultValue": 60 + }, + { + "name": "highlighted_antivirus", + "description": "Add taxonomy if selected AV don't recognize observable", + "type": "string", + "multi": true, + "required": false + } + ], + "registration_required": true, + "subscription_required": false, + "service_homepage": "https://www.virustotal.com/", + "service_logo": { + "path": "assets/virustotal-logo.png", + "caption": "logo" + }, + "command": "VirusTotal/virustotal.py", + "dockerImage": "virustotal:3.1" +} +, +{ + "name": "VirusTotal_Search", + "version": "1.0", + "author": "CTI_Marc", + "url": "https://github.com/TheHive-Project/Cortex-Analyzers", + "license": "AGPL-V3", + "description": "Use VirusTotal to search.", + "dataTypeList": [ + "other" + ], + "baseConfig": "VirusTotal", + "config": { + "service": "search" + }, + "configurationItems": [ + { + "name": "key", + "description": "API key for Virustotal", + "type": "string", + "multi": false, + "required": true } ], - "dockerImage": "cortexneurons/virustotal_scan:3" + "command": "VirusTotal/virustotal.py", + "dockerImage": "virustotal:1.0" } , {