Quick POC

This is a POC of usage of shuffle webhook as entry for a responder for thehive.

I am going to add extra layer to it later but this may help others to create some quick responders. I see for example an use in things like EDR not yet supported by cortex but included in Shuffle.

functions/extensions/cortex-responders/Shuffle_Webhook/requirements.txt

@@ -0,0 +1,2 @@
+cortexutils
+requests

functions/extensions/cortex-responders/Shuffle_Webhook/shuffle_webhook.json

@@ -0,0 +1,35 @@
+{
+  "name": "Shuffle_webhook",
+  "version": "1.0",
+  "author": "@azgaviperr",
+  "url": "https://github.com/frikky/shuffle",
+  "license": "AGPL-V3",
+  "description": "Execute a webhook in Shuffle",
+  "dataTypeList": ["thehive:case", "thehive:alert", "thehive:case_artifact"],
+  "command": "Shuffle_Webhook/shuffle_webhook.py",
+  "baseConfig": "Shuffle_Webhook",
+  "configurationItems": [
+    {
+      "name": "webhook_url",
+      "description": "The URL to your shuffle instance",
+      "type": "string",
+      "multi": false,
+      "required": true
+    },
+		{
+      "name": "api_key",
+      "description": "The API key to your Shuffle user",
+      "type": "string",
+      "multi": false,
+      "required": true
+    },
+    {
+      "name": "verifyssl",
+      "description": "Verify SSL certificate",
+      "type": "boolean",
+      "multi": false,
+      "required": true,
+      "defaultValue": true
+    }
+  ]
+}

functions/extensions/cortex-responders/Shuffle_Webhook/shuffle_webhook.py

@@ -0,0 +1,29 @@
+#!/usr/bin/env python3
+#encoding: utf-8
+
+from cortexutils.responder import Responder
+import requests
+
+class Shuffle(Responder):
+   def __init__(self):
+      Responder.__init__(self)
+      self.api_key = self.get_param("config.api_key", "")
+      self.webhook_url = self.get_param("config.webhook_url", "")
+      self.webhook_id = self.get_param("config.webhook_id", "")
+      self.verify = self.get_param('config.verifyssl', True, None)
+      self.data = self.get_param('data')
+
+   def run(self):
+      Responder.run(self)
+      headers = {
+         "Authorization": "Bearer %s"  % self.api_key,
+         "Content-Type": "application/json",
+         "Accept": "application/json",
+         "User-Agent": "Cortex-Analyzer"
+      }
+      requests.post(self.webhook_url, headers=headers,verify=self.verify, json=self.data)
+
+      self.report({'message': 'message sent'})
+
+if __name__ == '__main__':
+    Shuffle().run()