InternetDB.yml

commonfields:
  id: InternetDB
  version: -1
vcShouldKeepItemLegacyProdMachine: false
name: InternetDB
display: InternetDB
category: Utilities
description: InternetDB IP reputation & open port check
detaileddescription: "### InternetDB API ( free Shodan )\n\n[Link](https://internetdb.shodan.io/)\n\n####
  Integration Author: dbiesecke\n\nThe InternetDB API provides a fast way to see the
  open ports for an IP address. It gives a quick, at-a-glance view of the type of
  device that is running behind an IP address to help you make decisions based on
  the open ports.\n\n***\n## Config\n\n- nothing to configure\n\n## internetdb-info-ip-get\n
  \n - `ip` (string)\n - `threeshold`\n\n\n---\n[Link](https://internetdb.shodan.io/)\n"
configuration:
- section: Connect
  advanced: true
  display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- section: Connect
  advanced: true
  display: Use system proxy settings
  name: proxy
  type: 8
  required: false
script:
  script: |
    register_module_line('InternetDB', 'start', __line__())
    ### pack version: 3.0.9



    """InternetDB Integration for Cortex XSOAR (aka Demisto)

    Entry Point
    -----------

    This is the integration code entry point. It checks whether the ``__name__``
    variable is ``__main__`` , ``__builtin__`` (for Python 2) or ``builtins`` (for
    Python 3) and then calls the ``main()`` function. Just keep this convention.

    """
    import json
    from typing import Any

    import dateparser




    ''' CONSTANTS '''
    LOG_LINE = 'InternetDBDebugLog: '  # Make sure to use a line easily to search and read in logs.
    DATE_FORMAT = '%Y-%m-%dT%H:%M:%SZ'
    MAX_ALERTS_TO_FETCH = 50
    DEFAULT_INDICATORS_THRESHOLD = 65
    InternetDB_SEVERITIES = ['Low', 'Medium', 'High', 'Critical']
    LIMIT = 10
    DEFAULT_PAGE_SIZE = 5
    DUMMY_API_KEY = 'dummy-key'
    API_URL = 'https://internetdb.shodan.io'
    ITEM_TEMPLATE = '"id": {id}, "name": "XSOAR Test Alert #{id}", "severity": "{severity}", "date": "{date}", "status": "{status}"'
    ''' CLIENT CLASS '''


    class Client(BaseClient):
        def __init__(self, server_url, verify, proxy, headers, auth):
            super().__init__(base_url=server_url, verify=verify, proxy=proxy, headers=headers, auth=auth)

        def info_ip_get_request(self, ip):
            headers = self._headers

            response = self._http_request('get', f'{ip}', headers=headers)

            return response


    def info_ip_get_command(client: Client, args: Dict[str, Any]) -> CommandResults:
        ip = str(args.get('ip', ''))

        response = client.info_ip_get_request(ip)
        command_results = CommandResults(
            outputs_prefix='InternetDB.Host',
            outputs_key_field='',
            outputs=response,
            raw_response=response
        )

        return command_results


    def test_module(client: Client) -> None:
        # Test functions here
        return_results('ok')


    def main() -> None:

        params: Dict[str, Any] = demisto.params()
        args: Dict[str, Any] = demisto.args()
        url = API_URL
        verify_certificate: bool = not params.get('insecure', False)
        proxy = params.get('proxy', False)
        headers = {}
        #headers['Authorization'] = params['api_key']

        command = demisto.command()
        demisto.debug(f'Command being called is {command}')

        try:
            requests.packages.urllib3.disable_warnings()
            client: Client = Client(urljoin(url, ''), verify_certificate, proxy, headers=headers, auth=None)

            commands = {
                'internetdb-info-ip-get': info_ip_get_command,
            }

            if command == 'test-module':
                test_module(client)
            elif command in commands:
                return_results(commands[command](client, args))
            else:
                raise NotImplementedError(f'{command} command is not implemented.')

        except Exception as e:
            return_error(str(e))


    if __name__ in ['__main__', 'builtin', 'builtins']:
        main()
  type: python
  commands:
  - name: internetdb-info-ip-get
    arguments:
    - name: ip
      required: true
      default: true
      description: A comma-separated list of IPs.
      isArray: true
    - name: threshold
      description: If the IP has a reputation above the threshold, then the IP is
        defined as malicious. If a threshold not set, then threshold from the instance
        configuration is used.
      defaultValue: "65"
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: InternetDB.IP.asn
      description: The autonomous system name for the IP address.
      type: String
    - contextPath: InternetDB.IP.asn_cidr
      description: The ASN CIDR.
      type: String
    - contextPath: InternetDB.IP.asn_country_code
      description: The ASN country code.
      type: String
    - contextPath: InternetDB.IP.asn_date
      description: The date on which the ASN was assigned.
      type: Date
    - contextPath: InternetDB.IP.asn_description
      description: The ASN description.
      type: String
    - contextPath: InternetDB.IP.asn_registry
      description: The registry the ASN belongs to.
      type: String
    - contextPath: InternetDB.IP.entities
      description: Entities associated to the IP.
      type: String
    - contextPath: InternetDB.IP.ip
      description: The actual IP address.
      type: String
    - contextPath: InternetDB.IP.network.cidr
      description: Network CIDR for the IP address.
      type: String
    - contextPath: InternetDB.IP.network.country
      description: The country of the IP address.
      type: Unknown
    - contextPath: InternetDB.IP.network.end_address
      description: The last IP address of the CIDR.
      type: String
    - contextPath: InternetDB.IP.network.events.action
      description: The action that happened on the event.
      type: String
    - contextPath: InternetDB.IP.network.events.actor
      description: The actor that performed the action on the event.
      type: Unknown
    - contextPath: InternetDB.IP.network.events.timestamp
      description: The timestamp when the event occurred.
      type: String
    - contextPath: InternetDB.IP.network.handle
      description: The handle of the network.
      type: String
    - contextPath: InternetDB.IP.network.ip_version
      description: The IP address version.
      type: String
    - contextPath: InternetDB.IP.network.links
      description: Links associated to the IP address.
      type: String
    - contextPath: InternetDB.IP.network.name
      description: The name of the network.
      type: String
    - contextPath: InternetDB.IP.network.notices.description
      description: The description of the notice.
      type: String
    - contextPath: InternetDB.IP.network.notices.links
      description: Links associated with the notice.
      type: Unknown
    - contextPath: InternetDB.IP.network.notices.title
      description: Title of the notice.
      type: String
    - contextPath: InternetDB.IP.network.parent_handle
      description: Handle of the parent network.
      type: String
    - contextPath: InternetDB.IP.network.raw
      description: Additional raw data for the network.
      type: Unknown
    - contextPath: InternetDB.IP.network.remarks
      description: Additional remarks for the network.
      type: Unknown
    - contextPath: InternetDB.IP.network.start_address
      description: The first IP address of the CIDR.
      type: String
    - contextPath: InternetDB.IP.network.status
      description: Status of the network.
      type: String
    - contextPath: InternetDB.IP.network.type
      description: The type of the network.
      type: String
    - contextPath: InternetDB.IP.query
      description: IP address that was queried.
      type: String
    - contextPath: InternetDB.IP.raw
      description: Additional raw data for the IP address.
      type: Unknown
    - contextPath: InternetDB.IP.score
      description: Reputation score from InternetDB for this IP (0 to 100, where higher
        is worse).
      type: Number
    - contextPath: IP.Address
      description: IP address.
      type: String
    - contextPath: IP.Malicious.Vendor
      description: The vendor reporting the IP address as malicious.
      type: String
    - contextPath: IP.Malicious.Description
      description: A description explaining why the IP address was reported as malicious.
      type: String
    - contextPath: IP.ASN
      description: The autonomous system name for the IP address.
      type: String
    - contextPath: IP.Relationships.EntityA
      description: The source of the relationship.
      type: string
    - contextPath: IP.Relationships.EntityB
      description: The destination of the relationship.
      type: string
    - contextPath: IP.Relationships.Relationship
      description: The name of the relationship.
      type: string
    - contextPath: IP.Relationships.EntityAType
      description: The type of the source of the relationship.
      type: string
    - contextPath: IP.Relationships.EntityBType
      description: The type of the destination of the relationship.
      type: string
    description: Return IP information and reputation.
  dockerimage: demisto/python3:3.10.13.89009
  runonce: false
  subtype: python3