Initial open source commit
This commit is contained in:
frikky
@@ -0,0 +1,235 @@
|
||||
components:
|
||||
schemas:
|
||||
tmp0:
|
||||
properties:
|
||||
cb_version:
|
||||
type: string
|
||||
company_name:
|
||||
type: string
|
||||
copied_mod_len:
|
||||
type: string
|
||||
digsig_issuer:
|
||||
type: string
|
||||
digsig_prog_name:
|
||||
type: string
|
||||
digsig_publisher:
|
||||
type: string
|
||||
digsig_result:
|
||||
type: string
|
||||
digsig_result_code:
|
||||
type: string
|
||||
digsig_sign_time:
|
||||
type: string
|
||||
digsig_subject:
|
||||
type: string
|
||||
endpoint:
|
||||
type: string
|
||||
event_partition_id:
|
||||
type: string
|
||||
facet_id:
|
||||
type: string
|
||||
file_desc:
|
||||
type: string
|
||||
file_version:
|
||||
type: string
|
||||
group:
|
||||
type: string
|
||||
host_count:
|
||||
type: string
|
||||
internal_name:
|
||||
type: string
|
||||
is_64bit:
|
||||
type: string
|
||||
is_executable_image:
|
||||
type: string
|
||||
last_seen:
|
||||
type: string
|
||||
legal_copyright:
|
||||
type: string
|
||||
md5:
|
||||
type: string
|
||||
observed_filename:
|
||||
type: string
|
||||
orig_mod_len:
|
||||
type: string
|
||||
original_filename:
|
||||
type: string
|
||||
os_type:
|
||||
type: string
|
||||
product_name:
|
||||
type: string
|
||||
product_version:
|
||||
type: string
|
||||
server_added_timestamp:
|
||||
type: string
|
||||
signed:
|
||||
type: string
|
||||
timestamp:
|
||||
type: string
|
||||
watchlists:
|
||||
type: string
|
||||
type: object
|
||||
tmp1:
|
||||
properties:
|
||||
message:
|
||||
type: string
|
||||
type: object
|
||||
tmp2:
|
||||
properties:
|
||||
childproc_count:
|
||||
type: string
|
||||
cmdline:
|
||||
type: string
|
||||
comms_ip:
|
||||
type: string
|
||||
crossproc_count:
|
||||
type: string
|
||||
emet_config:
|
||||
type: string
|
||||
emet_count:
|
||||
type: string
|
||||
filemod_count:
|
||||
type: string
|
||||
filtering_known_dlls:
|
||||
type: string
|
||||
group:
|
||||
type: string
|
||||
host_type:
|
||||
type: string
|
||||
hostname:
|
||||
type: string
|
||||
id:
|
||||
type: string
|
||||
interface_ip:
|
||||
type: string
|
||||
last_server_update:
|
||||
type: string
|
||||
last_update:
|
||||
type: string
|
||||
modload_count:
|
||||
type: string
|
||||
netconn_count:
|
||||
type: string
|
||||
os_type:
|
||||
type: string
|
||||
parent_id:
|
||||
type: string
|
||||
parent_name:
|
||||
type: string
|
||||
parent_pid:
|
||||
type: string
|
||||
parent_unique_id:
|
||||
type: string
|
||||
path:
|
||||
type: string
|
||||
process_md5:
|
||||
type: string
|
||||
process_name:
|
||||
type: string
|
||||
process_pid:
|
||||
type: string
|
||||
processblock_count:
|
||||
type: string
|
||||
regmod_count:
|
||||
type: string
|
||||
segment_id:
|
||||
type: string
|
||||
sensor_id:
|
||||
type: string
|
||||
start:
|
||||
type: string
|
||||
terminated:
|
||||
type: string
|
||||
unique_id:
|
||||
type: string
|
||||
username:
|
||||
type: string
|
||||
type: object
|
||||
tmp3:
|
||||
properties:
|
||||
message:
|
||||
type: string
|
||||
type: object
|
||||
securitySchemes: {}
|
||||
info:
|
||||
contact:
|
||||
email: frikky@shuffler.io
|
||||
name: '@frikkylikeme'
|
||||
url: https://twitter.com/frikkylikeme
|
||||
description: Automated generation of Carbon Black Response
|
||||
title: Carbon Black Response
|
||||
version: 1.0.0
|
||||
openapi: 3.0.2
|
||||
paths:
|
||||
tmp0:
|
||||
post:
|
||||
description: Carbon Black Response Binary Search
|
||||
parameters:
|
||||
- description: Query
|
||||
in: query
|
||||
name: Query
|
||||
required: true
|
||||
schema:
|
||||
type: string
|
||||
responses:
|
||||
'200':
|
||||
content:
|
||||
application/json:
|
||||
schema:
|
||||
$ref: '#/components/schemas/tmp0'
|
||||
description: Successful request
|
||||
summary: Carbon Black Response Binary Search
|
||||
tmp1:
|
||||
post:
|
||||
description: Carbon Black Response Isolate Sensor
|
||||
parameters:
|
||||
- description: Hostname of a sensor to isolate.
|
||||
in: query
|
||||
name: Hostname
|
||||
required: true
|
||||
schema:
|
||||
type: string
|
||||
responses:
|
||||
'200':
|
||||
content:
|
||||
application/json:
|
||||
schema:
|
||||
$ref: '#/components/schemas/tmp1'
|
||||
description: Successful request
|
||||
summary: Carbon Black Response Isolate Sensor
|
||||
tmp2:
|
||||
post:
|
||||
description: Carbon Black Response Process Search
|
||||
parameters:
|
||||
- description: Query
|
||||
in: query
|
||||
name: Query
|
||||
required: true
|
||||
schema:
|
||||
type: string
|
||||
responses:
|
||||
'200':
|
||||
content:
|
||||
application/json:
|
||||
schema:
|
||||
$ref: '#/components/schemas/tmp2'
|
||||
description: Successful request
|
||||
summary: Carbon Black Response Process Search
|
||||
tmp3:
|
||||
post:
|
||||
description: Carbon Black Response Unisolate Sensor
|
||||
parameters:
|
||||
- description: Hostname of a sensor to unisolate.
|
||||
in: query
|
||||
name: Hostname
|
||||
required: true
|
||||
schema:
|
||||
type: string
|
||||
responses:
|
||||
'200':
|
||||
content:
|
||||
application/json:
|
||||
schema:
|
||||
$ref: '#/components/schemas/tmp3'
|
||||
description: Successful request
|
||||
summary: Carbon Black Response Unisolate Sensor
|
||||
@@ -0,0 +1,559 @@
|
||||
components:
|
||||
schemas:
|
||||
tmp0:
|
||||
properties:
|
||||
outcome:
|
||||
type: string
|
||||
type: object
|
||||
tmp1:
|
||||
properties:
|
||||
allRansomwareProcessesSuspended:
|
||||
type: string
|
||||
closeTime:
|
||||
type: string
|
||||
closerName:
|
||||
type: string
|
||||
creationTime:
|
||||
type: string
|
||||
customClassification:
|
||||
type: string
|
||||
decisionFeature:
|
||||
type: string
|
||||
detectionType:
|
||||
type: string
|
||||
elementDisplayName:
|
||||
type: string
|
||||
hasRansomwareSuspendedProcesses:
|
||||
type: string
|
||||
isBlocked:
|
||||
type: string
|
||||
malopActivityTypes:
|
||||
type: string
|
||||
malopLastUpdateTime:
|
||||
type: string
|
||||
malopStartTime:
|
||||
type: string
|
||||
managementStatus:
|
||||
type: string
|
||||
rootCauseElementNames:
|
||||
type: string
|
||||
rootCauseElementTypes:
|
||||
type: string
|
||||
type: object
|
||||
tmp2:
|
||||
properties:
|
||||
blocking:
|
||||
type: string
|
||||
direction:
|
||||
type: string
|
||||
domain:
|
||||
type: string
|
||||
ipAddress:
|
||||
type: string
|
||||
ipAddressString:
|
||||
type: string
|
||||
lastUpdated:
|
||||
type: string
|
||||
port:
|
||||
type: string
|
||||
ruleId:
|
||||
type: string
|
||||
type: object
|
||||
tmp3:
|
||||
properties:
|
||||
blacklistClassification:
|
||||
type: string
|
||||
classificationLink:
|
||||
type: string
|
||||
containsTorDomain:
|
||||
type: string
|
||||
domainClassificationSuspicion:
|
||||
type: string
|
||||
domainNameUniqueId:
|
||||
type: string
|
||||
elementDisplayName:
|
||||
type: string
|
||||
everResolvedDomain:
|
||||
type: string
|
||||
everResolvedSecondLevelDomain:
|
||||
type: string
|
||||
extendedDisplayId:
|
||||
type: string
|
||||
federationSegments:
|
||||
type: string
|
||||
getIpDiscoveryDomainList:
|
||||
type: string
|
||||
hasMalops:
|
||||
type: string
|
||||
hasResolvedClassificationEvidence:
|
||||
type: string
|
||||
hasSuspicions:
|
||||
type: string
|
||||
indifferentClassification:
|
||||
type: string
|
||||
isDomainMalicious:
|
||||
type: string
|
||||
isInIpDiscoveryDomainList:
|
||||
type: string
|
||||
isInternalDomain:
|
||||
type: string
|
||||
isInternalDomainByName:
|
||||
type: string
|
||||
isReverseLookup:
|
||||
type: string
|
||||
isTorrentDomain:
|
||||
type: string
|
||||
lookupDomainClassification:
|
||||
type: string
|
||||
maliciousClassification:
|
||||
type: string
|
||||
maliciousClassificationString:
|
||||
type: string
|
||||
maliciousClassificationType:
|
||||
type: string
|
||||
malwareClassification:
|
||||
type: string
|
||||
name:
|
||||
type: string
|
||||
relatedToMalop:
|
||||
type: string
|
||||
rootCauseKey:
|
||||
type: string
|
||||
secondLevelDomain:
|
||||
type: string
|
||||
sinkholedClassification:
|
||||
type: string
|
||||
sinkholedClassificationEvidence:
|
||||
type: string
|
||||
topLevelDomain:
|
||||
type: string
|
||||
unknownClassification:
|
||||
type: string
|
||||
unresolvedClassification:
|
||||
type: string
|
||||
unwantedClassification:
|
||||
type: string
|
||||
whitelistClassification:
|
||||
type: string
|
||||
type: object
|
||||
tmp4:
|
||||
properties:
|
||||
attemptExecutionProcessSuspicion:
|
||||
type: string
|
||||
attributes:
|
||||
type: string
|
||||
blackListClassification:
|
||||
type: string
|
||||
canonizedPath:
|
||||
type: string
|
||||
classificationLink:
|
||||
type: string
|
||||
correctedPath:
|
||||
type: string
|
||||
createdTime:
|
||||
type: string
|
||||
detectionEventData:
|
||||
type: string
|
||||
dualExtensionName:
|
||||
type: string
|
||||
elementDisplayName:
|
||||
type: string
|
||||
extendedDisplayId:
|
||||
type: string
|
||||
extension:
|
||||
type: string
|
||||
extensionRecord:
|
||||
type: string
|
||||
extensionType:
|
||||
type: string
|
||||
externalProductClassification:
|
||||
type: string
|
||||
externalProductClassificationIsSigned:
|
||||
type: string
|
||||
externalProductClassificationSignatureVerificationStatus:
|
||||
type: string
|
||||
externalProductClassificationSignatureVerified:
|
||||
type: string
|
||||
externalProductClassificationSignatureVerifiedByVerificationStatus:
|
||||
type: string
|
||||
externalProductClassificationType:
|
||||
type: string
|
||||
federationSegments:
|
||||
type: string
|
||||
fileHasSystem32SubDirectories:
|
||||
type: string
|
||||
fileHasSystemSubDirectories:
|
||||
type: string
|
||||
fileHashUniqueId:
|
||||
type: string
|
||||
fileInSystemPath:
|
||||
type: string
|
||||
fileReputationSuspicion:
|
||||
type: string
|
||||
fileReputationSuspicionDecision:
|
||||
type: string
|
||||
fileVersionSuspicionDecision:
|
||||
type: string
|
||||
getNetworkScannersNames:
|
||||
type: string
|
||||
getToolsForUnusualNetworkEvidence:
|
||||
type: string
|
||||
hackingToolClassification:
|
||||
type: string
|
||||
hasAutorun:
|
||||
type: string
|
||||
hasClassification:
|
||||
type: string
|
||||
hasInternalName:
|
||||
type: string
|
||||
hasLegitClassification:
|
||||
type: string
|
||||
hasMalops:
|
||||
type: string
|
||||
hasNonLegitClassification:
|
||||
type: string
|
||||
hasNonLegitClassificationEvidence:
|
||||
type: string
|
||||
hasProductClassification:
|
||||
type: string
|
||||
hasRansomwareClassificationSubType:
|
||||
type: string
|
||||
hasSuspicions:
|
||||
type: string
|
||||
identifiedProduct:
|
||||
type: string
|
||||
indifferentClassification:
|
||||
type: string
|
||||
isDocument:
|
||||
type: string
|
||||
isExecutable:
|
||||
type: string
|
||||
isFromRemovableDevice:
|
||||
type: string
|
||||
isFromTemp:
|
||||
type: string
|
||||
isNoTypeFoundClassification:
|
||||
type: string
|
||||
isPEFile:
|
||||
type: string
|
||||
isProcessImageFile:
|
||||
type: string
|
||||
isScreenSaver:
|
||||
type: string
|
||||
isSigned:
|
||||
type: string
|
||||
isSuspicious:
|
||||
type: string
|
||||
lastDetectionEventData:
|
||||
type: string
|
||||
maliciousClassification:
|
||||
type: string
|
||||
maliciousClassificationString:
|
||||
type: string
|
||||
maliciousClassificationType:
|
||||
type: string
|
||||
maliciousToolClassification:
|
||||
type: string
|
||||
malwareClassification:
|
||||
type: string
|
||||
malwareClassificationEvidence:
|
||||
type: string
|
||||
malwareType:
|
||||
type: string
|
||||
md5:
|
||||
type: string
|
||||
md5String:
|
||||
type: string
|
||||
missingInterperterSectionValue:
|
||||
type: string
|
||||
modifiedTime:
|
||||
type: string
|
||||
name:
|
||||
type: string
|
||||
nameWithoutExtension:
|
||||
type: string
|
||||
path:
|
||||
type: string
|
||||
peSignedAndVerified:
|
||||
type: string
|
||||
productClassificationType:
|
||||
type: string
|
||||
productType:
|
||||
type: string
|
||||
profileId:
|
||||
type: string
|
||||
ransomwareClassification:
|
||||
type: string
|
||||
reasonSignatureVerificationStatus:
|
||||
type: string
|
||||
relatedToMalop:
|
||||
type: string
|
||||
reportedByAntiMalwareEvidence:
|
||||
type: string
|
||||
reportedByAntiMalwareSuspicion:
|
||||
type: string
|
||||
rootCauseKey:
|
||||
type: string
|
||||
sha1:
|
||||
type: string
|
||||
sha1String:
|
||||
type: string
|
||||
signatureVerified:
|
||||
type: string
|
||||
signatureVerifiedByVerificationStatus:
|
||||
type: string
|
||||
signatureVerifiedInternalOrExternal:
|
||||
type: string
|
||||
signedByApple:
|
||||
type: string
|
||||
signedByLinux:
|
||||
type: string
|
||||
signedByMicrosoft:
|
||||
type: string
|
||||
signedByOperatingSystem:
|
||||
type: string
|
||||
signedInternalOrExternal:
|
||||
type: string
|
||||
size:
|
||||
type: string
|
||||
suspiciousClassification:
|
||||
type: string
|
||||
suspiciousScreenSaverCondition:
|
||||
type: string
|
||||
unknownClassification:
|
||||
type: string
|
||||
unsignedPeFileEvidence:
|
||||
type: string
|
||||
unwantedClassification:
|
||||
type: string
|
||||
whitelistClassification:
|
||||
type: string
|
||||
type: object
|
||||
tmp5:
|
||||
properties:
|
||||
address:
|
||||
type: string
|
||||
addressInternalExternalLocal:
|
||||
type: string
|
||||
addressString:
|
||||
type: string
|
||||
blackListClassification:
|
||||
type: string
|
||||
countryCode:
|
||||
type: string
|
||||
countryName:
|
||||
type: string
|
||||
countryNameOrNotExternalType:
|
||||
type: string
|
||||
elementDisplayName:
|
||||
type: string
|
||||
extendedDisplayId:
|
||||
type: string
|
||||
federationSegments:
|
||||
type: string
|
||||
geolocationLookup:
|
||||
type: string
|
||||
hasMalops:
|
||||
type: string
|
||||
hasSuspicions:
|
||||
type: string
|
||||
isDynamicConfiguration:
|
||||
type: string
|
||||
isExternalAddress:
|
||||
type: string
|
||||
isInternalAddress:
|
||||
type: string
|
||||
isLocalAddress:
|
||||
type: string
|
||||
latitude:
|
||||
type: string
|
||||
longitude:
|
||||
type: string
|
||||
lookupIpClassification:
|
||||
type: string
|
||||
maliciousClassification:
|
||||
type: string
|
||||
maliciousClassificationType:
|
||||
type: string
|
||||
rootCauseKey:
|
||||
type: string
|
||||
uniqueIpAddressHash:
|
||||
type: string
|
||||
version:
|
||||
type: string
|
||||
whiteListClassification:
|
||||
type: string
|
||||
type: object
|
||||
securitySchemes: {}
|
||||
info:
|
||||
contact:
|
||||
email: frikky@shuffler.io
|
||||
name: '@frikkylikeme'
|
||||
url: https://twitter.com/frikkylikeme
|
||||
description: Automated generation of Cyberreason
|
||||
title: Cyberreason
|
||||
version: 1.0.0
|
||||
openapi: 3.0.2
|
||||
paths:
|
||||
tmp0:
|
||||
post:
|
||||
description: CyberReason Block or Unblock an Item
|
||||
parameters:
|
||||
- description: Either 'blacklist' or 'whitelist'
|
||||
in: query
|
||||
name: Action
|
||||
required: true
|
||||
schema:
|
||||
type: string
|
||||
- description: IP, Domain, or Hash CSV values to blacklist or whitelist
|
||||
in: query
|
||||
name: Values
|
||||
required: true
|
||||
schema:
|
||||
type: string
|
||||
responses:
|
||||
'200':
|
||||
content:
|
||||
application/json:
|
||||
schema:
|
||||
$ref: '#/components/schemas/tmp0'
|
||||
description: Successful request
|
||||
summary: CyberReason Block Item
|
||||
tmp1:
|
||||
post:
|
||||
description: CyberReason get alerts from MalOps
|
||||
parameters: []
|
||||
responses:
|
||||
'200':
|
||||
content:
|
||||
application/json:
|
||||
schema:
|
||||
$ref: '#/components/schemas/tmp1'
|
||||
description: Successful request
|
||||
summary: CyberReason Get MalOps Alerts
|
||||
tmp2:
|
||||
post:
|
||||
description: CyberReason isolate a host by port
|
||||
parameters:
|
||||
- description: IP to block
|
||||
in: query
|
||||
name: IP
|
||||
required: true
|
||||
schema:
|
||||
type: string
|
||||
- description: Direction to block traffic, one of 'ALL', 'INCOMING', 'OUTGOING'
|
||||
in: query
|
||||
name: Direction to block
|
||||
required: true
|
||||
schema:
|
||||
type: string
|
||||
- description: Port to block
|
||||
in: query
|
||||
name: Port
|
||||
required: true
|
||||
schema:
|
||||
type: string
|
||||
- description: If true will isolate, false will remove from isolation
|
||||
in: query
|
||||
name: Block
|
||||
required: true
|
||||
schema:
|
||||
type: string
|
||||
responses:
|
||||
'200':
|
||||
content:
|
||||
application/json:
|
||||
schema:
|
||||
$ref: '#/components/schemas/tmp2'
|
||||
description: Successful request
|
||||
summary: CyberReason Isolate Host
|
||||
tmp3:
|
||||
post:
|
||||
description: Check CyberReason for a domain
|
||||
parameters:
|
||||
- description: Limit of results to return
|
||||
in: body
|
||||
name: Limit
|
||||
required: false
|
||||
schema:
|
||||
type: string
|
||||
- description: Timeout
|
||||
in: body
|
||||
name: Timeout (ms)
|
||||
required: false
|
||||
schema:
|
||||
type: string
|
||||
- description: Domain to search for
|
||||
in: query
|
||||
name: Domain
|
||||
required: true
|
||||
schema:
|
||||
type: string
|
||||
responses:
|
||||
'200':
|
||||
content:
|
||||
application/json:
|
||||
schema:
|
||||
$ref: '#/components/schemas/tmp3'
|
||||
description: Successful request
|
||||
summary: CyberReason Query for Domain
|
||||
tmp4:
|
||||
post:
|
||||
description: Check CyberReason for a hash
|
||||
parameters:
|
||||
- description: Limit of results to return
|
||||
in: body
|
||||
name: Limit
|
||||
required: false
|
||||
schema:
|
||||
type: string
|
||||
- description: Timeout
|
||||
in: body
|
||||
name: Timeout (ms)
|
||||
required: false
|
||||
schema:
|
||||
type: string
|
||||
- description: Hash to search for
|
||||
in: query
|
||||
name: Hash
|
||||
required: true
|
||||
schema:
|
||||
type: string
|
||||
responses:
|
||||
'200':
|
||||
content:
|
||||
application/json:
|
||||
schema:
|
||||
$ref: '#/components/schemas/tmp4'
|
||||
description: Successful request
|
||||
summary: CyberReason Query for Hash
|
||||
tmp5:
|
||||
post:
|
||||
description: Check CyberReason for a IP
|
||||
parameters:
|
||||
- description: Limit of results to return
|
||||
in: body
|
||||
name: Limit
|
||||
required: false
|
||||
schema:
|
||||
type: string
|
||||
- description: Timeout
|
||||
in: body
|
||||
name: Timeout (ms)
|
||||
required: false
|
||||
schema:
|
||||
type: string
|
||||
- description: IP to search for
|
||||
in: query
|
||||
name: IP
|
||||
required: true
|
||||
schema:
|
||||
type: string
|
||||
responses:
|
||||
'200':
|
||||
content:
|
||||
application/json:
|
||||
schema:
|
||||
$ref: '#/components/schemas/tmp5'
|
||||
description: Successful request
|
||||
summary: CyberReason Query for IP
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,166 @@
|
||||
components:
|
||||
schemas:
|
||||
tmp0:
|
||||
properties:
|
||||
bid:
|
||||
type: string
|
||||
cve:
|
||||
type: string
|
||||
description:
|
||||
type: string
|
||||
msb:
|
||||
type: string
|
||||
osvdb:
|
||||
type: string
|
||||
source:
|
||||
type: string
|
||||
type: object
|
||||
tmp1:
|
||||
properties:
|
||||
data:
|
||||
type: string
|
||||
domains:
|
||||
type: string
|
||||
hostnames:
|
||||
type: string
|
||||
ip:
|
||||
type: string
|
||||
location.area_code:
|
||||
type: string
|
||||
location.city:
|
||||
type: string
|
||||
location.country_code:
|
||||
type: string
|
||||
location.country_name:
|
||||
type: string
|
||||
location.dma_code:
|
||||
type: string
|
||||
location.latitude:
|
||||
type: string
|
||||
location.longitude:
|
||||
type: string
|
||||
location.postal_code:
|
||||
type: string
|
||||
location.region_code:
|
||||
type: string
|
||||
org:
|
||||
type: string
|
||||
os:
|
||||
type: string
|
||||
port:
|
||||
type: string
|
||||
transport:
|
||||
type: string
|
||||
type: object
|
||||
tmp2:
|
||||
properties:
|
||||
devicetype:
|
||||
type: string
|
||||
domains:
|
||||
type: string
|
||||
hostnames:
|
||||
type: string
|
||||
ip_str:
|
||||
type: string
|
||||
isp:
|
||||
type: string
|
||||
location.area_code:
|
||||
type: string
|
||||
location.city:
|
||||
type: string
|
||||
location.country_code:
|
||||
type: string
|
||||
location.country_name:
|
||||
type: string
|
||||
location.dma_code:
|
||||
type: string
|
||||
location.latitude:
|
||||
type: string
|
||||
location.longitude:
|
||||
type: string
|
||||
location.postal_code:
|
||||
type: string
|
||||
org:
|
||||
type: string
|
||||
os:
|
||||
type: string
|
||||
port:
|
||||
type: string
|
||||
product:
|
||||
type: string
|
||||
timestamp:
|
||||
type: string
|
||||
title:
|
||||
type: string
|
||||
type: object
|
||||
securitySchemes: {}
|
||||
info:
|
||||
contact:
|
||||
email: frikky@shuffler.io
|
||||
name: '@frikkylikeme'
|
||||
url: https://twitter.com/frikkylikeme
|
||||
description: Automated generation of Shodan
|
||||
title: Shodan
|
||||
version: 1.0.0
|
||||
openapi: 3.0.2
|
||||
paths:
|
||||
tmp0:
|
||||
post:
|
||||
description: Search across a variety of data sources for exploits
|
||||
parameters:
|
||||
- description: Search query used to search the database of known exploits
|
||||
in: query
|
||||
name: Query
|
||||
required: true
|
||||
schema:
|
||||
type: string
|
||||
responses:
|
||||
'200':
|
||||
content:
|
||||
application/json:
|
||||
schema:
|
||||
$ref: '#/components/schemas/tmp0'
|
||||
description: Successful request
|
||||
summary: Shodan Exploit Search
|
||||
tmp1:
|
||||
post:
|
||||
description: Search all services that have been found on the given host IP
|
||||
parameters:
|
||||
- description: Host IP address
|
||||
in: query
|
||||
name: IP
|
||||
required: true
|
||||
schema:
|
||||
type: string
|
||||
responses:
|
||||
'200':
|
||||
content:
|
||||
application/json:
|
||||
schema:
|
||||
$ref: '#/components/schemas/tmp1'
|
||||
description: Successful request
|
||||
summary: Shodan Host
|
||||
tmp2:
|
||||
post:
|
||||
description: Search the SHODAN database
|
||||
parameters:
|
||||
- description: Keyword to search Shodan for
|
||||
in: query
|
||||
name: Query
|
||||
required: true
|
||||
schema:
|
||||
type: string
|
||||
- description: 'Max number of results to return. Default: ''Infinite'''
|
||||
in: body
|
||||
name: Limit
|
||||
required: false
|
||||
schema:
|
||||
type: string
|
||||
responses:
|
||||
'200':
|
||||
content:
|
||||
application/json:
|
||||
schema:
|
||||
$ref: '#/components/schemas/tmp2'
|
||||
description: Successful request
|
||||
summary: Shodan Search
|
||||
@@ -0,0 +1,149 @@
|
||||
components:
|
||||
schemas:
|
||||
tmp0:
|
||||
properties:
|
||||
bios_uuid:
|
||||
type: string
|
||||
fqdn:
|
||||
type: string
|
||||
hostname:
|
||||
type: string
|
||||
id:
|
||||
type: string
|
||||
ipv4:
|
||||
type: string
|
||||
ipv6:
|
||||
type: string
|
||||
mac_address:
|
||||
type: string
|
||||
netbios_name:
|
||||
type: string
|
||||
operating_system:
|
||||
type: string
|
||||
ssh_fingerprint:
|
||||
type: string
|
||||
system_type:
|
||||
type: string
|
||||
type: object
|
||||
tmp1:
|
||||
properties:
|
||||
agent_name:
|
||||
type: string
|
||||
fqdn:
|
||||
type: string
|
||||
id:
|
||||
type: string
|
||||
ipv4:
|
||||
type: string
|
||||
ipv6:
|
||||
type: string
|
||||
last_seen:
|
||||
type: string
|
||||
mac_address:
|
||||
type: string
|
||||
operating_system:
|
||||
type: string
|
||||
type: object
|
||||
tmp2:
|
||||
properties:
|
||||
hostcount:
|
||||
type: string
|
||||
name:
|
||||
type: string
|
||||
owner:
|
||||
type: string
|
||||
policy:
|
||||
type: string
|
||||
scan_end:
|
||||
type: string
|
||||
scan_start:
|
||||
type: string
|
||||
status:
|
||||
type: string
|
||||
targets:
|
||||
type: string
|
||||
uuid:
|
||||
type: string
|
||||
type: object
|
||||
tmp4:
|
||||
properties:
|
||||
count:
|
||||
type: string
|
||||
plugin_family:
|
||||
type: string
|
||||
plugin_name:
|
||||
type: string
|
||||
severity:
|
||||
type: string
|
||||
vulnerability_state:
|
||||
type: string
|
||||
type: object
|
||||
securitySchemes: {}
|
||||
info:
|
||||
contact:
|
||||
email: frikky@shuffler.io
|
||||
name: '@frikkylikeme'
|
||||
url: https://twitter.com/frikkylikeme
|
||||
description: Automated generation of Tenable Tenable.io
|
||||
title: Tenable Tenable.io
|
||||
version: 1.0.0
|
||||
openapi: 3.0.2
|
||||
paths:
|
||||
tmp0:
|
||||
post:
|
||||
description: Returns information about the specified asset.
|
||||
parameters:
|
||||
- description: The UUID of the asset.
|
||||
in: query
|
||||
name: Asset UUID
|
||||
required: true
|
||||
schema:
|
||||
type: string
|
||||
responses:
|
||||
'200':
|
||||
description: Successful request
|
||||
summary: Tenable.io Asset Info
|
||||
tmp1:
|
||||
post:
|
||||
description: Returns a list of up to 5000 assets.
|
||||
parameters: []
|
||||
responses:
|
||||
'200':
|
||||
description: Successful request
|
||||
summary: Tenable.io List Assets
|
||||
tmp2:
|
||||
post:
|
||||
description: Returns details for the given scan.
|
||||
parameters:
|
||||
- description: The ID of the scan.
|
||||
in: query
|
||||
name: Scan ID
|
||||
required: true
|
||||
schema:
|
||||
type: string
|
||||
responses:
|
||||
'200':
|
||||
description: Successful request
|
||||
summary: Tenable.io Scan Details
|
||||
tmp3:
|
||||
post:
|
||||
description: Launches a scan.
|
||||
parameters:
|
||||
- description: The ID of the scan.
|
||||
in: body
|
||||
name: Scan ID
|
||||
required: true
|
||||
schema:
|
||||
type: string
|
||||
responses:
|
||||
'200':
|
||||
description: Successful request
|
||||
summary: Tenable.io Scan Launch
|
||||
tmp4:
|
||||
post:
|
||||
description: Retrieves a list of recorded vulnerabilities.
|
||||
parameters: []
|
||||
responses:
|
||||
'200':
|
||||
description: Successful request
|
||||
summary: Tenable.io Vulnerabilities
|
||||
@@ -0,0 +1,109 @@
|
||||
import json
|
||||
import yaml
|
||||
|
||||
items = []
|
||||
|
||||
openapi = {
|
||||
"openapi": "3.0.2",
|
||||
"info": {
|
||||
"title": "MISP",
|
||||
"description": "MISP API generated from the misp book: https://github.com/MISP/misp-book/blob/master/automation/README.md",
|
||||
"version": "1.0.0",
|
||||
"contact": {
|
||||
"name": "@frikkylikeme",
|
||||
"url": "https://twitter.com/frikkylikeme",
|
||||
"email": "frikky@shuffler.io"
|
||||
}
|
||||
},
|
||||
"paths": {},
|
||||
"components": {
|
||||
"schemas": {},
|
||||
"securitySchemes": {
|
||||
"ApiKeyAuth": {
|
||||
"type": "apikey",
|
||||
"in": "header",
|
||||
"name": "Authorization",
|
||||
}
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
with open("misp.txt", "r") as tmp:
|
||||
newitem = {}
|
||||
recorditem = False
|
||||
|
||||
counter = 0
|
||||
itemsplit = tmp.read().split("\n")
|
||||
for item in itemsplit:
|
||||
counter += 1
|
||||
if item.startswith("### ") and "/" in item:
|
||||
try:
|
||||
path = item.split(" ")[2]
|
||||
method = item.split(" ")[1].lower()
|
||||
newitem = {
|
||||
"path": path,
|
||||
"method": method,
|
||||
}
|
||||
|
||||
try:
|
||||
openapi["paths"][path][method] = {}
|
||||
except KeyError:
|
||||
openapi["paths"][path] = {}
|
||||
openapi["paths"][path][method] = {}
|
||||
|
||||
except IndexError:
|
||||
newitem = {}
|
||||
continue
|
||||
|
||||
recorditem = True
|
||||
#print(newitem)
|
||||
|
||||
if not recorditem:
|
||||
continue
|
||||
|
||||
if "Description" in item:
|
||||
openapi["paths"][newitem["path"]][newitem["method"]]["description"] = itemsplit[counter+1]
|
||||
elif "URL Arguments" in item:
|
||||
parameters = []
|
||||
innercnt = 0
|
||||
|
||||
openapi["paths"][newitem["path"]][newitem["method"]]["parameters"] = []
|
||||
while True:
|
||||
curline = itemsplit[counter+1+innercnt]
|
||||
if "#" in curline:
|
||||
break
|
||||
|
||||
innercnt += 1
|
||||
if not curline:
|
||||
continue
|
||||
|
||||
print(curline)
|
||||
parameters.append({
|
||||
"description": curline.split(" ")[1],
|
||||
"in": "query",
|
||||
"name": curline.split(" ")[1],
|
||||
"required": True,
|
||||
"schema": {"type": "string"},
|
||||
})
|
||||
|
||||
openapi["paths"][newitem["path"]][newitem["method"]]["parameters"] = parameters
|
||||
elif "Output" in item:
|
||||
# FIXME
|
||||
innercnt = 0
|
||||
while True:
|
||||
curline = itemsplit[counter+1+innercnt]
|
||||
|
||||
if "#" in curline:
|
||||
break
|
||||
|
||||
innercnt += 1
|
||||
if "json" in curline:
|
||||
continue
|
||||
#print(curline)
|
||||
|
||||
print(json.dumps(openapi, indent=4))
|
||||
|
||||
|
||||
generatedfile = "generated/misp.yaml"
|
||||
with open(generatedfile, "w+") as tmp:
|
||||
tmp.write(yaml.dump(openapi))
|
||||
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
@@ -0,0 +1,131 @@
|
||||
import requests
|
||||
import yaml
|
||||
|
||||
def parse_data(data):
|
||||
openapi = {
|
||||
"openapi": "3.0.2",
|
||||
"info": {
|
||||
"title": "",
|
||||
"description": "",
|
||||
"version": "1.0.0",
|
||||
"contact": {
|
||||
"name": "@frikkylikeme",
|
||||
"url": "https://twitter.com/frikkylikeme",
|
||||
"email": "frikky@shuffler.io"
|
||||
}
|
||||
},
|
||||
"paths": {},
|
||||
"components": {
|
||||
"schemas": {},
|
||||
"securitySchemes": {},
|
||||
}
|
||||
}
|
||||
|
||||
category = data["category"]
|
||||
|
||||
filename = "%s.yaml" % data["title"].replace(" ", "_").lower()
|
||||
openapi["info"]["title"] = data["title"]
|
||||
openapi["info"]["description"] = "Automated generation of %s" % data["title"]
|
||||
# data["description"]
|
||||
|
||||
cnt = 0
|
||||
for task in data["tasks"]:
|
||||
method = "post"
|
||||
|
||||
openapi["paths"]["tmp%d" % cnt] = {}
|
||||
openapi["paths"]["tmp%d" % cnt][method] = {
|
||||
"summary": task["name"],
|
||||
"description": task["description"],
|
||||
"parameters": [],
|
||||
"responses": {
|
||||
"200": {
|
||||
"description": "Successful request",
|
||||
|
||||
}
|
||||
},
|
||||
}
|
||||
|
||||
#taskname = task["name"]
|
||||
#taskdescription = task["description"]
|
||||
taskcategory = task["family"]
|
||||
|
||||
# This doesn't really do much except build the return value structures
|
||||
for parameter in task["input_parameters"]:
|
||||
example = parameter["example"]
|
||||
|
||||
inVar = "query"
|
||||
|
||||
if parameter["type"] == 6:
|
||||
inVar = "body"
|
||||
|
||||
schema = "string"
|
||||
schemaset = False
|
||||
if parameter["type"] != 1:
|
||||
if (parameter["type"] == 7):
|
||||
schema = "boolean"
|
||||
schemaset = True
|
||||
|
||||
if schema == "string" and schemaset:
|
||||
print("Should change type: %d" % parameter["type"])
|
||||
print(task["name"])
|
||||
print(parameter["name"])
|
||||
print()
|
||||
|
||||
|
||||
if len(example) == 1:
|
||||
print("Change to number?")
|
||||
if example.startswith("{"):
|
||||
print("Change to json object?")
|
||||
if example.startswith("["):
|
||||
print("Change to array object?")
|
||||
|
||||
# Not sure how to tackle this
|
||||
openapi["paths"]["tmp%d" % cnt][method]["parameters"].append({
|
||||
"in": inVar,
|
||||
"name": parameter["name"],
|
||||
"required": parameter["required"],
|
||||
"description": parameter["description"],
|
||||
"schema": {"type": schema}
|
||||
})
|
||||
|
||||
if len(task["available_output_variables"]) > 0:
|
||||
openapi["paths"]["tmp%d" % cnt][method]["responses"]["200"]["content"]: {
|
||||
"application/json": {
|
||||
"schema": {
|
||||
"$ref": "#/components/schemas/tmp%d" % cnt
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
openapi["components"]["schemas"]["tmp%d" % cnt] = {
|
||||
"type": "object",
|
||||
"properties": {},
|
||||
}
|
||||
|
||||
for output in task["available_output_variables"]:
|
||||
openapi["components"]["schemas"]["tmp%d" % cnt]["properties"][output["key"]] = {"type": "string"}
|
||||
|
||||
|
||||
cnt += 1
|
||||
|
||||
#print(openapi)
|
||||
#print(filename)
|
||||
|
||||
return filename, openapi
|
||||
|
||||
def dump_data(filename, openapi):
|
||||
generatedfile = "generated/%s" % filename
|
||||
with open(generatedfile, "w+") as tmp:
|
||||
tmp.write(yaml.dump(openapi))
|
||||
|
||||
print("Generated %s" % generatedfile)
|
||||
|
||||
if __name__ == "__main__":
|
||||
url = "https://apphub.swimlane.com/api/v1/bundles/cjuspytpz00rh0hpjo5chqg10"
|
||||
url = "https://apphub.swimlane.com/api/v1/bundles/cjyoy62ch04920lr26id5sr0e"
|
||||
url = "https://apphub.swimlane.com/api/v1/bundles/cjqrdc2yr02rs0fli6jrosiqb"
|
||||
url = "https://apphub.swimlane.com/api/v1/bundles/cjqrdat0u01ux0flipb68a0a0"
|
||||
url = "https://apphub.swimlane.com/api/v1/bundles/cjqrdhbwp07nf0fli23lyb52h"
|
||||
data = requests.get(url).json()
|
||||
filename, openapi = parse_data(data)
|
||||
dump_data(filename, openapi)
|
||||
Reference in New Issue
Block a user