Fixed app generation from a tag with swimlane
This commit is contained in:
frikky
@@ -1,579 +0,0 @@
|
||||
components:
|
||||
schemas:
|
||||
tmp0:
|
||||
properties:
|
||||
outcome:
|
||||
type: string
|
||||
type: object
|
||||
tmp1:
|
||||
properties:
|
||||
allRansomwareProcessesSuspended:
|
||||
type: string
|
||||
closeTime:
|
||||
type: string
|
||||
closerName:
|
||||
type: string
|
||||
creationTime:
|
||||
type: string
|
||||
customClassification:
|
||||
type: string
|
||||
decisionFeature:
|
||||
type: string
|
||||
detectionType:
|
||||
type: string
|
||||
elementDisplayName:
|
||||
type: string
|
||||
hasRansomwareSuspendedProcesses:
|
||||
type: string
|
||||
isBlocked:
|
||||
type: string
|
||||
malopActivityTypes:
|
||||
type: string
|
||||
malopLastUpdateTime:
|
||||
type: string
|
||||
malopStartTime:
|
||||
type: string
|
||||
managementStatus:
|
||||
type: string
|
||||
rootCauseElementNames:
|
||||
type: string
|
||||
rootCauseElementTypes:
|
||||
type: string
|
||||
type: object
|
||||
tmp2:
|
||||
properties:
|
||||
blocking:
|
||||
type: string
|
||||
direction:
|
||||
type: string
|
||||
domain:
|
||||
type: string
|
||||
ipAddress:
|
||||
type: string
|
||||
ipAddressString:
|
||||
type: string
|
||||
lastUpdated:
|
||||
type: string
|
||||
port:
|
||||
type: string
|
||||
ruleId:
|
||||
type: string
|
||||
type: object
|
||||
tmp3:
|
||||
properties:
|
||||
blacklistClassification:
|
||||
type: string
|
||||
classificationLink:
|
||||
type: string
|
||||
containsTorDomain:
|
||||
type: string
|
||||
domainClassificationSuspicion:
|
||||
type: string
|
||||
domainNameUniqueId:
|
||||
type: string
|
||||
elementDisplayName:
|
||||
type: string
|
||||
everResolvedDomain:
|
||||
type: string
|
||||
everResolvedSecondLevelDomain:
|
||||
type: string
|
||||
extendedDisplayId:
|
||||
type: string
|
||||
federationSegments:
|
||||
type: string
|
||||
getIpDiscoveryDomainList:
|
||||
type: string
|
||||
hasMalops:
|
||||
type: string
|
||||
hasResolvedClassificationEvidence:
|
||||
type: string
|
||||
hasSuspicions:
|
||||
type: string
|
||||
indifferentClassification:
|
||||
type: string
|
||||
isDomainMalicious:
|
||||
type: string
|
||||
isInIpDiscoveryDomainList:
|
||||
type: string
|
||||
isInternalDomain:
|
||||
type: string
|
||||
isInternalDomainByName:
|
||||
type: string
|
||||
isReverseLookup:
|
||||
type: string
|
||||
isTorrentDomain:
|
||||
type: string
|
||||
lookupDomainClassification:
|
||||
type: string
|
||||
maliciousClassification:
|
||||
type: string
|
||||
maliciousClassificationString:
|
||||
type: string
|
||||
maliciousClassificationType:
|
||||
type: string
|
||||
malwareClassification:
|
||||
type: string
|
||||
name:
|
||||
type: string
|
||||
relatedToMalop:
|
||||
type: string
|
||||
rootCauseKey:
|
||||
type: string
|
||||
secondLevelDomain:
|
||||
type: string
|
||||
sinkholedClassification:
|
||||
type: string
|
||||
sinkholedClassificationEvidence:
|
||||
type: string
|
||||
topLevelDomain:
|
||||
type: string
|
||||
unknownClassification:
|
||||
type: string
|
||||
unresolvedClassification:
|
||||
type: string
|
||||
unwantedClassification:
|
||||
type: string
|
||||
whitelistClassification:
|
||||
type: string
|
||||
type: object
|
||||
tmp4:
|
||||
properties:
|
||||
attemptExecutionProcessSuspicion:
|
||||
type: string
|
||||
attributes:
|
||||
type: string
|
||||
blackListClassification:
|
||||
type: string
|
||||
canonizedPath:
|
||||
type: string
|
||||
classificationLink:
|
||||
type: string
|
||||
correctedPath:
|
||||
type: string
|
||||
createdTime:
|
||||
type: string
|
||||
detectionEventData:
|
||||
type: string
|
||||
dualExtensionName:
|
||||
type: string
|
||||
elementDisplayName:
|
||||
type: string
|
||||
extendedDisplayId:
|
||||
type: string
|
||||
extension:
|
||||
type: string
|
||||
extensionRecord:
|
||||
type: string
|
||||
extensionType:
|
||||
type: string
|
||||
externalProductClassification:
|
||||
type: string
|
||||
externalProductClassificationIsSigned:
|
||||
type: string
|
||||
externalProductClassificationSignatureVerificationStatus:
|
||||
type: string
|
||||
externalProductClassificationSignatureVerified:
|
||||
type: string
|
||||
externalProductClassificationSignatureVerifiedByVerificationStatus:
|
||||
type: string
|
||||
externalProductClassificationType:
|
||||
type: string
|
||||
federationSegments:
|
||||
type: string
|
||||
fileHasSystem32SubDirectories:
|
||||
type: string
|
||||
fileHasSystemSubDirectories:
|
||||
type: string
|
||||
fileHashUniqueId:
|
||||
type: string
|
||||
fileInSystemPath:
|
||||
type: string
|
||||
fileReputationSuspicion:
|
||||
type: string
|
||||
fileReputationSuspicionDecision:
|
||||
type: string
|
||||
fileVersionSuspicionDecision:
|
||||
type: string
|
||||
getNetworkScannersNames:
|
||||
type: string
|
||||
getToolsForUnusualNetworkEvidence:
|
||||
type: string
|
||||
hackingToolClassification:
|
||||
type: string
|
||||
hasAutorun:
|
||||
type: string
|
||||
hasClassification:
|
||||
type: string
|
||||
hasInternalName:
|
||||
type: string
|
||||
hasLegitClassification:
|
||||
type: string
|
||||
hasMalops:
|
||||
type: string
|
||||
hasNonLegitClassification:
|
||||
type: string
|
||||
hasNonLegitClassificationEvidence:
|
||||
type: string
|
||||
hasProductClassification:
|
||||
type: string
|
||||
hasRansomwareClassificationSubType:
|
||||
type: string
|
||||
hasSuspicions:
|
||||
type: string
|
||||
identifiedProduct:
|
||||
type: string
|
||||
indifferentClassification:
|
||||
type: string
|
||||
isDocument:
|
||||
type: string
|
||||
isExecutable:
|
||||
type: string
|
||||
isFromRemovableDevice:
|
||||
type: string
|
||||
isFromTemp:
|
||||
type: string
|
||||
isNoTypeFoundClassification:
|
||||
type: string
|
||||
isPEFile:
|
||||
type: string
|
||||
isProcessImageFile:
|
||||
type: string
|
||||
isScreenSaver:
|
||||
type: string
|
||||
isSigned:
|
||||
type: string
|
||||
isSuspicious:
|
||||
type: string
|
||||
lastDetectionEventData:
|
||||
type: string
|
||||
maliciousClassification:
|
||||
type: string
|
||||
maliciousClassificationString:
|
||||
type: string
|
||||
maliciousClassificationType:
|
||||
type: string
|
||||
maliciousToolClassification:
|
||||
type: string
|
||||
malwareClassification:
|
||||
type: string
|
||||
malwareClassificationEvidence:
|
||||
type: string
|
||||
malwareType:
|
||||
type: string
|
||||
md5:
|
||||
type: string
|
||||
md5String:
|
||||
type: string
|
||||
missingInterperterSectionValue:
|
||||
type: string
|
||||
modifiedTime:
|
||||
type: string
|
||||
name:
|
||||
type: string
|
||||
nameWithoutExtension:
|
||||
type: string
|
||||
path:
|
||||
type: string
|
||||
peSignedAndVerified:
|
||||
type: string
|
||||
productClassificationType:
|
||||
type: string
|
||||
productType:
|
||||
type: string
|
||||
profileId:
|
||||
type: string
|
||||
ransomwareClassification:
|
||||
type: string
|
||||
reasonSignatureVerificationStatus:
|
||||
type: string
|
||||
relatedToMalop:
|
||||
type: string
|
||||
reportedByAntiMalwareEvidence:
|
||||
type: string
|
||||
reportedByAntiMalwareSuspicion:
|
||||
type: string
|
||||
rootCauseKey:
|
||||
type: string
|
||||
sha1:
|
||||
type: string
|
||||
sha1String:
|
||||
type: string
|
||||
signatureVerified:
|
||||
type: string
|
||||
signatureVerifiedByVerificationStatus:
|
||||
type: string
|
||||
signatureVerifiedInternalOrExternal:
|
||||
type: string
|
||||
signedByApple:
|
||||
type: string
|
||||
signedByLinux:
|
||||
type: string
|
||||
signedByMicrosoft:
|
||||
type: string
|
||||
signedByOperatingSystem:
|
||||
type: string
|
||||
signedInternalOrExternal:
|
||||
type: string
|
||||
size:
|
||||
type: string
|
||||
suspiciousClassification:
|
||||
type: string
|
||||
suspiciousScreenSaverCondition:
|
||||
type: string
|
||||
unknownClassification:
|
||||
type: string
|
||||
unsignedPeFileEvidence:
|
||||
type: string
|
||||
unwantedClassification:
|
||||
type: string
|
||||
whitelistClassification:
|
||||
type: string
|
||||
type: object
|
||||
tmp5:
|
||||
properties:
|
||||
address:
|
||||
type: string
|
||||
addressInternalExternalLocal:
|
||||
type: string
|
||||
addressString:
|
||||
type: string
|
||||
blackListClassification:
|
||||
type: string
|
||||
countryCode:
|
||||
type: string
|
||||
countryName:
|
||||
type: string
|
||||
countryNameOrNotExternalType:
|
||||
type: string
|
||||
elementDisplayName:
|
||||
type: string
|
||||
extendedDisplayId:
|
||||
type: string
|
||||
federationSegments:
|
||||
type: string
|
||||
geolocationLookup:
|
||||
type: string
|
||||
hasMalops:
|
||||
type: string
|
||||
hasSuspicions:
|
||||
type: string
|
||||
isDynamicConfiguration:
|
||||
type: string
|
||||
isExternalAddress:
|
||||
type: string
|
||||
isInternalAddress:
|
||||
type: string
|
||||
isLocalAddress:
|
||||
type: string
|
||||
latitude:
|
||||
type: string
|
||||
longitude:
|
||||
type: string
|
||||
lookupIpClassification:
|
||||
type: string
|
||||
maliciousClassification:
|
||||
type: string
|
||||
maliciousClassificationType:
|
||||
type: string
|
||||
rootCauseKey:
|
||||
type: string
|
||||
uniqueIpAddressHash:
|
||||
type: string
|
||||
version:
|
||||
type: string
|
||||
whiteListClassification:
|
||||
type: string
|
||||
type: object
|
||||
securitySchemes:
|
||||
BasicAuth:
|
||||
scheme: basic
|
||||
type: http
|
||||
info:
|
||||
contact:
|
||||
email: frikky@shuffler.io
|
||||
name: '@frikkylikeme'
|
||||
url: https://twitter.com/frikkylikeme
|
||||
description: Automated generation of Cyberreason Cyberreason
|
||||
title: Cyberreason Cyberreason
|
||||
version: 1.0.0
|
||||
openapi: 3.0.2
|
||||
paths:
|
||||
tmp0:
|
||||
post:
|
||||
description: CyberReason Block or Unblock an Item
|
||||
parameters:
|
||||
- description: IP, Domain, or Hash CSV values to blacklist or whitelist
|
||||
example: ''
|
||||
in: query
|
||||
name: Values
|
||||
required: true
|
||||
schema:
|
||||
type: string
|
||||
- description: Either 'blacklist' or 'whitelist'
|
||||
example: ''
|
||||
in: query
|
||||
name: Action
|
||||
required: true
|
||||
schema:
|
||||
type: string
|
||||
responses:
|
||||
'200':
|
||||
content:
|
||||
application/json:
|
||||
schema:
|
||||
$ref: '#/components/schemas/tmp0'
|
||||
description: Successful request
|
||||
summary: CyberReason Block Item
|
||||
tmp1:
|
||||
post:
|
||||
description: CyberReason get alerts from MalOps
|
||||
parameters: []
|
||||
responses:
|
||||
'200':
|
||||
content:
|
||||
application/json:
|
||||
schema:
|
||||
$ref: '#/components/schemas/tmp1'
|
||||
description: Successful request
|
||||
summary: CyberReason Get MalOps Alerts
|
||||
tmp2:
|
||||
post:
|
||||
description: CyberReason isolate a host by port
|
||||
parameters:
|
||||
- description: IP to block
|
||||
example: ''
|
||||
in: query
|
||||
name: IP
|
||||
required: true
|
||||
schema:
|
||||
type: string
|
||||
- description: Port to block
|
||||
example: ''
|
||||
in: query
|
||||
name: Port
|
||||
required: true
|
||||
schema:
|
||||
type: string
|
||||
- description: Direction to block traffic, one of 'ALL', 'INCOMING', 'OUTGOING'
|
||||
example: ''
|
||||
in: query
|
||||
name: Direction to block
|
||||
required: true
|
||||
schema:
|
||||
type: string
|
||||
- description: If true will isolate, false will remove from isolation
|
||||
example: ''
|
||||
in: query
|
||||
name: Block
|
||||
required: true
|
||||
schema:
|
||||
type: string
|
||||
responses:
|
||||
'200':
|
||||
content:
|
||||
application/json:
|
||||
schema:
|
||||
$ref: '#/components/schemas/tmp2'
|
||||
description: Successful request
|
||||
summary: CyberReason Isolate Host
|
||||
tmp3:
|
||||
post:
|
||||
description: Check CyberReason for a domain
|
||||
parameters:
|
||||
- description: Domain to search for
|
||||
example: ''
|
||||
in: query
|
||||
name: Domain
|
||||
required: true
|
||||
schema:
|
||||
type: string
|
||||
- description: Limit of results to return
|
||||
example: ''
|
||||
in: body
|
||||
name: Limit
|
||||
required: false
|
||||
schema:
|
||||
type: string
|
||||
- description: Timeout
|
||||
example: '12000'
|
||||
in: body
|
||||
name: Timeout (ms)
|
||||
required: false
|
||||
schema:
|
||||
type: string
|
||||
responses:
|
||||
'200':
|
||||
content:
|
||||
application/json:
|
||||
schema:
|
||||
$ref: '#/components/schemas/tmp3'
|
||||
description: Successful request
|
||||
summary: CyberReason Query for Domain
|
||||
tmp4:
|
||||
post:
|
||||
description: Check CyberReason for a hash
|
||||
parameters:
|
||||
- description: Hash to search for
|
||||
example: ''
|
||||
in: query
|
||||
name: Hash
|
||||
required: true
|
||||
schema:
|
||||
type: string
|
||||
- description: Limit of results to return
|
||||
example: ''
|
||||
in: body
|
||||
name: Limit
|
||||
required: false
|
||||
schema:
|
||||
type: string
|
||||
- description: Timeout
|
||||
example: '12000'
|
||||
in: body
|
||||
name: Timeout (ms)
|
||||
required: false
|
||||
schema:
|
||||
type: string
|
||||
responses:
|
||||
'200':
|
||||
content:
|
||||
application/json:
|
||||
schema:
|
||||
$ref: '#/components/schemas/tmp4'
|
||||
description: Successful request
|
||||
summary: CyberReason Query for Hash
|
||||
tmp5:
|
||||
post:
|
||||
description: Check CyberReason for a IP
|
||||
parameters:
|
||||
- description: IP to search for
|
||||
example: ''
|
||||
in: query
|
||||
name: IP
|
||||
required: true
|
||||
schema:
|
||||
type: string
|
||||
- description: Limit of results to return
|
||||
example: ''
|
||||
in: body
|
||||
name: Limit
|
||||
required: false
|
||||
schema:
|
||||
type: string
|
||||
- description: Timeout
|
||||
example: '12000'
|
||||
in: body
|
||||
name: Timeout (ms)
|
||||
required: false
|
||||
schema:
|
||||
type: string
|
||||
responses:
|
||||
'200':
|
||||
content:
|
||||
application/json:
|
||||
schema:
|
||||
$ref: '#/components/schemas/tmp5'
|
||||
description: Successful request
|
||||
summary: CyberReason Query for IP
|
||||
tags:
|
||||
- Endpoint Security & Management
|
||||
@@ -1,6 +1,7 @@
|
||||
import requests
|
||||
import yaml
|
||||
import json
|
||||
import os
|
||||
|
||||
# USAGE:
|
||||
# 1. Find the item here:
|
||||
@@ -77,8 +78,8 @@ def parse_data(data):
|
||||
except KeyError as e:
|
||||
pass
|
||||
|
||||
if not authset:
|
||||
print("AUTH NOT SET: %s" % inputparams)
|
||||
#if not authset:
|
||||
# print("AUTH NOT SET: %s" % inputparams)
|
||||
|
||||
except KeyError as e:
|
||||
print("KeyError asset: %s" % e)
|
||||
@@ -135,10 +136,16 @@ def parse_data(data):
|
||||
description = value["description"]
|
||||
except KeyError:
|
||||
pass
|
||||
|
||||
required = False
|
||||
try:
|
||||
required = value["required"]
|
||||
except KeyError:
|
||||
pass
|
||||
|
||||
openapi["paths"]["tmp%d" % cnt][method]["parameters"].append({
|
||||
"name": value["name"],
|
||||
"required": value["required"],
|
||||
"required": required,
|
||||
"example": example,
|
||||
"description": description,
|
||||
"schema": {"type": schema},
|
||||
@@ -181,25 +188,44 @@ def parse_data(data):
|
||||
|
||||
return filename, openapi
|
||||
|
||||
def dump_data(filename, openapi):
|
||||
generatedfile = "generated/%s" % filename
|
||||
def dump_data(filename, openapi, category):
|
||||
generatedfile = "generated/%s/%s" % (category, filename)
|
||||
try:
|
||||
with open(generatedfile, "w+") as tmp:
|
||||
tmp.write(yaml.dump(openapi))
|
||||
except FileNotFoundError:
|
||||
os.mkdir("generated/%s" % category)
|
||||
|
||||
with open(generatedfile, "w+") as tmp:
|
||||
tmp.write(yaml.dump(openapi))
|
||||
|
||||
print("Generated %s" % generatedfile)
|
||||
|
||||
if __name__ == "__main__":
|
||||
#url = "https://apphub.swimlane.com/api/v1/bundles/cjuspytpz00rh0hpjo5chqg10"
|
||||
#url = "https://apphub.swimlane.com/api/v1/bundles/cjyoy62ch04920lr26id5sr0e"
|
||||
#url = "https://apphub.swimlane.com/api/v1/bundles/cjqrdc2yr02rs0fli6jrosiqb"
|
||||
#url = "https://apphub.swimlane.com/api/v1/bundles/cjqrdat0u01ux0flipb68a0a0"
|
||||
#url = "https://apphub.swimlane.com/api/v1/bundles/cjqrdhbwp07nf0fli23lyb52h"
|
||||
number = 1
|
||||
#https://apphub.swimlane.com/
|
||||
categories = [
|
||||
"Endpoint Security & Management",
|
||||
"SIEM & Log Management",
|
||||
"Ticket Management",
|
||||
]
|
||||
|
||||
url = "https://apphub.swimlane.io/api/swimbundles/swimlane/sw_alienvault_threatcrowd"
|
||||
url = "https://apphub.swimlane.com/api/swimbundles/swimlane/sw_anomali_threatstream"
|
||||
search_category = categories[2]
|
||||
total = 0
|
||||
while(True):
|
||||
url = "https://apphub.swimlane.io/api/search/swimbundles?page=%d" % number
|
||||
|
||||
json = {"fields": {"family": search_category}}
|
||||
ret = requests.post(
|
||||
url,
|
||||
json=json,
|
||||
)
|
||||
|
||||
with open("swimlane_urls.json", "r") as tmp:
|
||||
parsed = json.loads(tmp.read())
|
||||
if ret.status_code != 201:
|
||||
print("RET NOT 201: %d" % ret.status_code)
|
||||
break
|
||||
|
||||
parsed = ret.json()
|
||||
try:
|
||||
category = parsed["data"][0]["swimbundleMeta"]["family"][0]
|
||||
except KeyError:
|
||||
@@ -207,9 +233,15 @@ if __name__ == "__main__":
|
||||
except IndexError:
|
||||
category = ""
|
||||
|
||||
print("CATEGORY: %s" % category)
|
||||
if category == "":
|
||||
break
|
||||
|
||||
for data in parsed["data"]:
|
||||
filename, openapi = parse_data(data)
|
||||
openapi["tags"] = [category]
|
||||
dump_data(filename, openapi)
|
||||
dump_data(filename, openapi, category)
|
||||
total += 1
|
||||
|
||||
number += 1
|
||||
|
||||
print("Created %d openapi specs from Swimlane with category %s" % (total, search_category))
|
||||
|
||||
Reference in New Issue
Block a user