Merge pull request #366 from azgaviperr/thehive_responder

Cortex responder

.env

@@ -15,8 +15,8 @@ SHUFFLE_DOWNLOAD_AUTH_BRANCH=
 SHUFFLE_APP_FORCE_UPDATE=false
 
 # User config for first load. Username & PW: min length 3
-SHUFFLE_DEFAULT_USERNAME=
-SHUFFLE_DEFAULT_PASSWORD=
+SHUFFLE_DEFAULT_USERNAME=shuffle
+SHUFFLE_DEFAULT_PASSWORD==Fr1kky1sN0t@D0g
 SHUFFLE_DEFAULT_APIKEY=
 
 # Local location of your app directory. Can't use ~/

.github/install-guide.md

@@ -7,7 +7,8 @@ The Docker setup is done with docker-compose and is a single command to get set
 **PS: if you're setting up Shuffle on Windows, go to the next step (Windows Docker setup)**
 
 1. Make sure you have Docker and [docker-compose](https://docs.docker.com/compose/install/) installed.
-2. Run docker-compose.
+2. Adapt the .env file to your convenience.
+3. Run docker-compose.
 ```
 git clone https://github.com/frikky/Shuffle
 cd Shuffle

functions/extensions/cortex-responders/Shuffle/requirements.txt

@@ -0,0 +1,2 @@
+cortexutils
+requests

functions/extensions/cortex-responders/Shuffle/shuffle.json

@@ -5,7 +5,7 @@
   "url": "https://github.com/frikky/shuffle",
   "license": "AGPL-V3",
   "description": "Execute a workflow in Shuffle",
-  "dataTypeList": ["thehive:case", "thehive:alert"],
+  "dataTypeList": ["thehive:case", "thehive:alert", "thehive:case_artifact"],
   "command": "Shuffle/shuffle.py",
   "baseConfig": "Shuffle",
   "configurationItems": [
@@ -24,6 +24,14 @@
       "multi": false,
       "required": true
     },
+    {
+      "name": "verifyssl",
+      "description": "Verify SSL certificate",
+      "type": "boolean",
+      "multi": false,
+      "required": true,
+      "defaultValue": true
+    },
     {
       "name": "workflow_id",
       "description": "The ID of the workflow to execute",

functions/extensions/cortex-responders/Shuffle/shuffle.py

@@ -1,5 +1,4 @@
-
-#!/usr/bin/env python
+#!/usr/bin/env python3
 #encoding: utf-8
 
 from cortexutils.responder import Responder
@@ -11,18 +10,18 @@ class Shuffle(Responder):
       self.api_key = self.get_param("config.api_key", "")
       self.url = self.get_param("config.url", "")
       self.workflow_id = self.get_param("config.workflow_id", "")
+      self.verify = self.get_param('config.verifyssl', True, None)
 
    def run(self):
       Responder.run(self)
-
       parsed_url = "%s/api/v1/workflows/%s/execute" % (self.url, self.workflow_id)
       headers = {
-            "Authorization": "Bearer %s"  % self.api_key
+         "Authorization": "Bearer %s"  % self.api_key,
+         "User-Agent": "Cortex-Analyzer"
       }
-        requests.post(parsed_url, headers=headers)
+      requests.post(parsed_url, headers=headers,verify=self.verify)
 
       self.report({'message': 'message sent'})
 
 if __name__ == '__main__':
     Shuffle().run()
-

functions/extensions/cortex-responders/Shuffle_Webhook/requirements.txt

@@ -0,0 +1,2 @@
+cortexutils
+requests

functions/extensions/cortex-responders/Shuffle_Webhook/shuffle_webhook.json

@@ -0,0 +1,28 @@
+{
+  "name": "Shuffle_webhook",
+  "version": "1.0",
+  "author": "@azgaviperr",
+  "url": "https://github.com/frikky/shuffle",
+  "license": "AGPL-V3",
+  "description": "Execute a webhook in Shuffle",
+  "dataTypeList": ["thehive:case", "thehive:alert", "thehive:case_artifact"],
+  "command": "Shuffle_Webhook/shuffle_webhook.py",
+  "baseConfig": "Shuffle_Webhook",
+  "configurationItems": [
+    {
+      "name": "webhook_url",
+      "description": "The URL to your shuffle instance",
+      "type": "string",
+      "multi": false,
+      "required": true
+    },
+		{
+      "name": "verifyssl",
+      "description": "Verify SSL certificate",
+      "type": "boolean",
+      "multi": false,
+      "required": true,
+      "defaultValue": true
+    }
+  ]
+}

functions/extensions/cortex-responders/Shuffle_Webhook/shuffle_webhook.py

@@ -0,0 +1,28 @@
+#!/usr/bin/env python3
+#encoding: utf-8
+
+from cortexutils.responder import Responder
+import requests
+
+class Shuffle(Responder):
+   def __init__(self):
+      Responder.__init__(self)
+      self.api_key = self.get_param("config.api_key", "")
+      self.webhook_url = self.get_param("config.webhook_url", "")
+      self.webhook_id = self.get_param("config.webhook_id", "")
+      self.verify = self.get_param('config.verifyssl', True, None)
+      self.data = self.get_param('data')
+
+   def run(self):
+      Responder.run(self)
+      headers = {
+         "Content-Type": "application/json",
+         "Accept": "application/json",
+         "User-Agent": "Cortex-Analyzer"
+      }
+      requests.post(self.webhook_url, headers=headers,verify=self.verify, json=self.data)
+
+      self.report({'message': 'message sent'})
+
+if __name__ == '__main__':
+    Shuffle().run()