Merge pull request #366 from azgaviperr/thehive_responder

Cortex responder

.env

@@ -8,15 +8,15 @@ SHUFFLE_DOWNLOAD_WORKFLOW_USERNAME=
 SHUFFLE_DOWNLOAD_WORKFLOW_PASSWORD=
 SHUFFLE_DOWNLOAD_WORKFLOW_BRANCH=
 
-SHUFFLE_APP_DOWNLOAD_LOCATION=https://github.com/frikky/shuffle-apps 
+SHUFFLE_APP_DOWNLOAD_LOCATION=https://github.com/frikky/shuffle-apps
 SHUFFLE_DOWNLOAD_AUTH_USERNAME=
 SHUFFLE_DOWNLOAD_AUTH_PASSWORD=
 SHUFFLE_DOWNLOAD_AUTH_BRANCH=
 SHUFFLE_APP_FORCE_UPDATE=false
 
 # User config for first load. Username & PW: min length 3
-SHUFFLE_DEFAULT_USERNAME=
-SHUFFLE_DEFAULT_PASSWORD=
+SHUFFLE_DEFAULT_USERNAME=shuffle
+SHUFFLE_DEFAULT_PASSWORD==Fr1kky1sN0t@D0g
 SHUFFLE_DEFAULT_APIKEY=
 
 # Local location of your app directory. Can't use ~/
@@ -33,7 +33,7 @@ OUTER_HOSTNAME=shuffle-backend
 DB_LOCATION=./shuffle-database
 
 # Proxy configurations. SHUFFLE_PASS_WORKER_PROXY must be FALSE to not pass the proxy information to sub-apps.
-# PS: It will skip proxy for 
+# PS: It will skip proxy for
 SHUFFLE_HTTP_PROXY=
 SHUFFLE_HTTPS_PROXY=
 SHUFFLE_PASS_WORKER_PROXY=TRUE

.github/install-guide.md

@@ -7,7 +7,8 @@ The Docker setup is done with docker-compose and is a single command to get set
 **PS: if you're setting up Shuffle on Windows, go to the next step (Windows Docker setup)**
 
 1. Make sure you have Docker and [docker-compose](https://docs.docker.com/compose/install/) installed.
-2. Run docker-compose.
+2. Adapt the .env file to your convenience.
+3. Run docker-compose.
 ```
 git clone https://github.com/frikky/Shuffle
 cd Shuffle
@@ -16,7 +17,7 @@ docker-compose up -d
 
 When you're done, skip to the "After installation" step below.
 
-## Windows Docker setup 
+## Windows Docker setup
 This step is for setting up with Docker on windows from scratch.
 
 1. Make sure you have [Docker](https://docs.docker.com/docker-for-windows/install/) and [docker-compose](https://docs.docker.com/compose/install/) installed. WSL2 may be required.
@@ -34,7 +35,7 @@ docker-compose up -d
 ### Configurations (proxies, default users etc.)
 https://shuffler.io/docs/configuration
 
-### After installation 
+### After installation
 1. After installation, go to http://localhost:3001/adminsetup (or your servername)
 
 2. Now set up your admin account (username & password). Shuffle doesn't have a default username and password.
@@ -82,14 +83,14 @@ docker-compose up
 
 Related issue: #47
 
-# Local development installation 
+# Local development installation
 Local development is pretty straight forward with **ReactJS** and **Golang**. This part is intended to help you run the code for development purposes.
 
 **PS: You have to stop the Backend Docker container to get this one working**
 **PPS: Use the "Launch" branch when developing to get it set up easier**
 
 ## Frontend - ReactJS /w cytoscape
-http://localhost:3000 - Requires [npm](https://nodejs.org/en/download/)/[yarn](https://yarnpkg.com/lang/en/docs/install/#debian-stable)/your preferred manager. Runs independently from backend. 
+http://localhost:3000 - Requires [npm](https://nodejs.org/en/download/)/[yarn](https://yarnpkg.com/lang/en/docs/install/#debian-stable)/your preferred manager. Runs independently from backend.
 ```bash
 cd frontend
 npm i
@@ -97,7 +98,7 @@ npm start
 ```
 
 ## Backend - Golang
-http://localhost:5001 - REST API - requires [>=go1.13](https://golang.org/dl/) 
+http://localhost:5001 - REST API - requires [>=go1.13](https://golang.org/dl/)
 ```bash
 export DATASTORE_EMULATOR_HOST=0.0.0.0:8000
 cd backend/go-app
@@ -114,7 +115,7 @@ docker run -p 8000:8000 google/cloud-sdk gcloud beta emulators datastore start -
 
 ## Orborus
 Execution of Workflows:
-PS: This requires some specific environment variables 
+PS: This requires some specific environment variables
 ```
 cd functions/onprem/orborus
 go run orborus.go

functions/extensions/cortex-responders/Shuffle/requirements.txt

@@ -0,0 +1,2 @@
+cortexutils
+requests

functions/extensions/cortex-responders/Shuffle/shuffle.json

@@ -5,7 +5,7 @@
   "url": "https://github.com/frikky/shuffle",
   "license": "AGPL-V3",
   "description": "Execute a workflow in Shuffle",
-  "dataTypeList": ["thehive:case", "thehive:alert"],
+  "dataTypeList": ["thehive:case", "thehive:alert", "thehive:case_artifact"],
   "command": "Shuffle/shuffle.py",
   "baseConfig": "Shuffle",
   "configurationItems": [
@@ -24,6 +24,14 @@
       "multi": false,
       "required": true
     },
+    {
+      "name": "verifyssl",
+      "description": "Verify SSL certificate",
+      "type": "boolean",
+      "multi": false,
+      "required": true,
+      "defaultValue": true
+    },
     {
       "name": "workflow_id",
       "description": "The ID of the workflow to execute",

functions/extensions/cortex-responders/Shuffle/shuffle.py

@@ -1,28 +1,27 @@
-
-#!/usr/bin/env python
-# encoding: utf-8
+#!/usr/bin/env python3
+#encoding: utf-8
 
 from cortexutils.responder import Responder
 import requests
 
 class Shuffle(Responder):
-    def __init__(self):
-        Responder.__init__(self)
-        self.api_key = self.get_param("config.api_key", "")
-        self.url = self.get_param("config.url", "")
-        self.workflow_id = self.get_param("config.workflow_id", "")
+   def __init__(self):
+      Responder.__init__(self)
+      self.api_key = self.get_param("config.api_key", "")
+      self.url = self.get_param("config.url", "")
+      self.workflow_id = self.get_param("config.workflow_id", "")
+      self.verify = self.get_param('config.verifyssl', True, None)
 
-    def run(self):
-        Responder.run(self)
+   def run(self):
+      Responder.run(self)
+      parsed_url = "%s/api/v1/workflows/%s/execute" % (self.url, self.workflow_id)
+      headers = {
+         "Authorization": "Bearer %s"  % self.api_key,
+         "User-Agent": "Cortex-Analyzer"
+      }
+      requests.post(parsed_url, headers=headers,verify=self.verify)
 
-        parsed_url = "%s/api/v1/workflows/%s/execute" % (self.url, self.workflow_id)
-        headers = {
-            "Authorization": "Bearer %s"  % self.api_key
-        }
-        requests.post(parsed_url, headers=headers)
-
-        self.report({'message': 'message sent'})
+      self.report({'message': 'message sent'})
 
 if __name__ == '__main__':
     Shuffle().run()
-

functions/extensions/cortex-responders/Shuffle_Webhook/requirements.txt

@@ -0,0 +1,2 @@
+cortexutils
+requests

functions/extensions/cortex-responders/Shuffle_Webhook/shuffle_webhook.json

@@ -0,0 +1,28 @@
+{
+  "name": "Shuffle_webhook",
+  "version": "1.0",
+  "author": "@azgaviperr",
+  "url": "https://github.com/frikky/shuffle",
+  "license": "AGPL-V3",
+  "description": "Execute a webhook in Shuffle",
+  "dataTypeList": ["thehive:case", "thehive:alert", "thehive:case_artifact"],
+  "command": "Shuffle_Webhook/shuffle_webhook.py",
+  "baseConfig": "Shuffle_Webhook",
+  "configurationItems": [
+    {
+      "name": "webhook_url",
+      "description": "The URL to your shuffle instance",
+      "type": "string",
+      "multi": false,
+      "required": true
+    },
+		{
+      "name": "verifyssl",
+      "description": "Verify SSL certificate",
+      "type": "boolean",
+      "multi": false,
+      "required": true,
+      "defaultValue": true
+    }
+  ]
+}

functions/extensions/cortex-responders/Shuffle_Webhook/shuffle_webhook.py

@@ -0,0 +1,28 @@
+#!/usr/bin/env python3
+#encoding: utf-8
+
+from cortexutils.responder import Responder
+import requests
+
+class Shuffle(Responder):
+   def __init__(self):
+      Responder.__init__(self)
+      self.api_key = self.get_param("config.api_key", "")
+      self.webhook_url = self.get_param("config.webhook_url", "")
+      self.webhook_id = self.get_param("config.webhook_id", "")
+      self.verify = self.get_param('config.verifyssl', True, None)
+      self.data = self.get_param('data')
+
+   def run(self):
+      Responder.run(self)
+      headers = {
+         "Content-Type": "application/json",
+         "Accept": "application/json",
+         "User-Agent": "Cortex-Analyzer"
+      }
+      requests.post(self.webhook_url, headers=headers,verify=self.verify, json=self.data)
+
+      self.report({'message': 'message sent'})
+
+if __name__ == '__main__':
+    Shuffle().run()