-
Notifications
You must be signed in to change notification settings - Fork 100
/
wise.go
95 lines (80 loc) · 2.26 KB
/
wise.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
// Copyright (c) 2018 PT Defender Nusa Semesta and contributors, All rights reserved.
//
// This file is part of Dsiem.
//
// Dsiem is free software: you can redistribute it and/or modify
// it under the terms of the GNU General Public License as published by
// the Free Software Foundation version 3 of the License.
//
// Dsiem is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU General Public License for more details.
//
// You should have received a copy of the GNU General Public License
// along with Dsiem. If not, see <https://www.gnu.org/licenses/>.
package wise
import (
"context"
"encoding/json"
"io"
"net/http"
"strings"
"github.com/defenxor/dsiem/pkg/intel"
)
func init() {
intel.RegisterExtension(new(Wise), "Wise")
}
// Wise is an intel plugin
type Wise struct {
Cfg Config `json:"cfg"`
}
// Config defins
type Config struct {
URL string `json:"url"`
}
type wiseResult struct {
Field string `json:"field"`
Len int `json:"len"`
Value string `json:"value"`
}
// Initialize implement iface
func (w *Wise) Initialize(b []byte) error {
return json.Unmarshal(b, &w.Cfg)
}
// CheckIP implement iface
func (w Wise) CheckIP(ctx context.Context, ip string) (found bool, results []intel.Result, err error) {
url := strings.Replace(w.Cfg.URL, "${ip}", ip, 1)
c := http.Client{}
req, _ := http.NewRequest(http.MethodGet, url, nil)
req = req.WithContext(ctx)
res, err := c.Do(req)
if err != nil {
return
}
body, err := io.ReadAll(res.Body)
if err != nil {
return
}
defer res.Body.Close()
// convert Wise JS object literal to valid JSON
s := strings.Replace(string(body), "field:", `"field":`, -1)
s = strings.Replace(s, "len:", `"len":`, -1)
s = strings.Replace(s, "value:", `"value":`, -1)
result := []wiseResult{}
err = json.Unmarshal([]byte(s), &result)
if err != nil {
return
}
for _, r := range result {
// len < 5 is ID or metadata, not the actual result text
if r.Len < 5 {
continue
}
// Example {field:value} returned is:
// alienvault.activity:Malicious Host
results = append(results, intel.Result{Provider: "Wise", Term: ip, Result: r.Field + ": " + r.Value})
found = true
}
return
}