From e83017121ad305fb0f17960bd5444f453cf43045 Mon Sep 17 00:00:00 2001
From: azgaviperr <bryce.simon@gmail.com>
Date: Tue, 4 May 2021 23:50:01 +0200
Subject: [PATCH] Quick POC

This is a POC of usage of shuffle webhook as entry for a responder for thehive.

I am going to add extra layer to it later but this may help others to create some quick responders. I see for example an use in things like EDR not yet supported by cortex but included in Shuffle.
---
 .../Shuffle_Webhook/requirements.txt          |  2 ++
 .../Shuffle_Webhook/shuffle_webhook.json      | 35 +++++++++++++++++++
 .../Shuffle_Webhook/shuffle_webhook.py        | 29 +++++++++++++++
 3 files changed, 66 insertions(+)
 create mode 100644 functions/extensions/cortex-responders/Shuffle_Webhook/requirements.txt
 create mode 100644 functions/extensions/cortex-responders/Shuffle_Webhook/shuffle_webhook.json
 create mode 100644 functions/extensions/cortex-responders/Shuffle_Webhook/shuffle_webhook.py

diff --git a/functions/extensions/cortex-responders/Shuffle_Webhook/requirements.txt b/functions/extensions/cortex-responders/Shuffle_Webhook/requirements.txt
new file mode 100644
index 00000000..6aabc3cf
--- /dev/null
+++ b/functions/extensions/cortex-responders/Shuffle_Webhook/requirements.txt
@@ -0,0 +1,2 @@
+cortexutils
+requests
diff --git a/functions/extensions/cortex-responders/Shuffle_Webhook/shuffle_webhook.json b/functions/extensions/cortex-responders/Shuffle_Webhook/shuffle_webhook.json
new file mode 100644
index 00000000..b77f1026
--- /dev/null
+++ b/functions/extensions/cortex-responders/Shuffle_Webhook/shuffle_webhook.json
@@ -0,0 +1,35 @@
+{
+  "name": "Shuffle_webhook",
+  "version": "1.0",
+  "author": "@azgaviperr",
+  "url": "https://github.com/frikky/shuffle",
+  "license": "AGPL-V3",
+  "description": "Execute a webhook in Shuffle",
+  "dataTypeList": ["thehive:case", "thehive:alert", "thehive:case_artifact"],
+  "command": "Shuffle_Webhook/shuffle_webhook.py",
+  "baseConfig": "Shuffle_Webhook",
+  "configurationItems": [
+    {
+      "name": "webhook_url",
+      "description": "The URL to your shuffle instance",
+      "type": "string",
+      "multi": false,
+      "required": true
+    },
+		{
+      "name": "api_key",
+      "description": "The API key to your Shuffle user",
+      "type": "string",
+      "multi": false,
+      "required": true
+    },
+    {
+      "name": "verifyssl",
+      "description": "Verify SSL certificate",
+      "type": "boolean",
+      "multi": false,
+      "required": true,
+      "defaultValue": true
+    }
+  ]
+}
diff --git a/functions/extensions/cortex-responders/Shuffle_Webhook/shuffle_webhook.py b/functions/extensions/cortex-responders/Shuffle_Webhook/shuffle_webhook.py
new file mode 100644
index 00000000..f7f254ff
--- /dev/null
+++ b/functions/extensions/cortex-responders/Shuffle_Webhook/shuffle_webhook.py
@@ -0,0 +1,29 @@
+#!/usr/bin/env python3
+#encoding: utf-8
+
+from cortexutils.responder import Responder
+import requests
+
+class Shuffle(Responder):
+   def __init__(self):
+      Responder.__init__(self)
+      self.api_key = self.get_param("config.api_key", "")
+      self.webhook_url = self.get_param("config.webhook_url", "")
+      self.webhook_id = self.get_param("config.webhook_id", "")
+      self.verify = self.get_param('config.verifyssl', True, None)
+      self.data = self.get_param('data')
+
+   def run(self):
+      Responder.run(self)
+      headers = {
+         "Authorization": "Bearer %s"  % self.api_key,
+         "Content-Type": "application/json",
+         "Accept": "application/json",
+         "User-Agent": "Cortex-Analyzer"
+      }
+      requests.post(self.webhook_url, headers=headers,verify=self.verify, json=self.data)
+
+      self.report({'message': 'message sent'})
+
+if __name__ == '__main__':
+    Shuffle().run()