diff --git a/integrations/binaryedge/manifest.yaml b/integrations/binaryedge/manifest.yaml new file mode 100644 index 0000000..7da6c0f --- /dev/null +++ b/integrations/binaryedge/manifest.yaml @@ -0,0 +1,74 @@ +id: binaryedge +name: BinaryEdge +version: 1.0.0 +description: "BinaryEdge (API v2) — internet exposure intelligence: query current and historical open ports/services for an IP, run a search, enumerate a domain's subdomains, check an email against data leaks, and read the subscription quota. API-key authentication; stdlib-only, no extra Python dependencies." +changelog: "1.0.0 — Initial release: host lookup (current/historical), search, domain subdomains, data-leak email check, subscription." +category: enrichment + +# Per-instance configuration. The API key is sent as the 'X-Key' header. +config_schema: + properties: + api_key: + type: string + description: "BinaryEdge API key" + x-soar-sensitive: true + required: + - api_key + +commands: + - id: host + name: binaryedge-host + description: "Get the most recent open ports and services for an IP." + risk: read + inputs_schema: + properties: + ip: { type: string, description: "IP address" } + required: [ip] + outputs_schema: { properties: {} } + - id: host_historical + name: binaryedge-host-historical + description: "Get historical open ports and services for an IP." + risk: read + inputs_schema: + properties: + ip: { type: string, description: "IP address" } + required: [ip] + outputs_schema: { properties: {} } + - id: search + name: binaryedge-search + description: "Search hosts/services by a BinaryEdge query." + risk: read + inputs_schema: + properties: + query: { type: string, description: "BinaryEdge search query (e.g. type:elasticsearch)" } + page: { type: number, description: "Page number (default 1)" } + required: [query] + outputs_schema: { properties: {} } + - id: domain_subdomains + name: binaryedge-domain-subdomains + description: "List a domain's known subdomains." + risk: read + inputs_schema: + properties: + domain: { type: string, description: "Domain name" } + page: { type: number, description: "Page number (default 1)" } + required: [domain] + outputs_schema: { properties: {} } + - id: dataleaks_email + name: binaryedge-dataleaks-email + description: "Check whether an email appears in known data leaks." + risk: read + inputs_schema: + properties: + email: { type: string, description: "Email address" } + required: [email] + outputs_schema: { properties: {} } + + - id: test_connection + name: binaryedge-test-connection + description: "Verify the API key via the subscription endpoint (used by the Test button)." + risk: read + inputs_schema: + properties: {} + required: [] + outputs_schema: { properties: {} } diff --git a/integrations/binaryedge/scripts/dataleaks_email.py b/integrations/binaryedge/scripts/dataleaks_email.py new file mode 100644 index 0000000..2c35059 --- /dev/null +++ b/integrations/binaryedge/scripts/dataleaks_email.py @@ -0,0 +1,47 @@ +import json, os, sys, urllib.parse, urllib.request, urllib.error + +BASE = "https://api.binaryedge.io/v2" + + +def _cfg(): + return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) + + +def _inputs(): + return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def request(path, cfg, params=None): + url = BASE + path + if params: + clean = {k: v for k, v in params.items() if v not in (None, "")} + if clean: + url += "?" + urllib.parse.urlencode(clean) + req = urllib.request.Request(url, headers={"X-Key": str(cfg.get("api_key", "")), "Accept": "application/json"}, method="GET") + with urllib.request.urlopen(req, timeout=60) as r: + raw = r.read() + return json.loads(raw) if raw else {} + + +def _run(fn): + try: + print(json.dumps(fn(_cfg(), _inputs()))) + except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) + except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) + + +q = lambda v: urllib.parse.quote(str(v), safe="") + + +def main(cfg, inputs): + email = inputs.get("email") + if not email: + raise Exception("email is required") + return request("/query/dataleaks/email/" + q(email), cfg) + + +_run(main) diff --git a/integrations/binaryedge/scripts/domain_subdomains.py b/integrations/binaryedge/scripts/domain_subdomains.py new file mode 100644 index 0000000..29e146e --- /dev/null +++ b/integrations/binaryedge/scripts/domain_subdomains.py @@ -0,0 +1,48 @@ +import json, os, sys, urllib.parse, urllib.request, urllib.error + +BASE = "https://api.binaryedge.io/v2" + + +def _cfg(): + return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) + + +def _inputs(): + return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def request(path, cfg, params=None): + url = BASE + path + if params: + clean = {k: v for k, v in params.items() if v not in (None, "")} + if clean: + url += "?" + urllib.parse.urlencode(clean) + req = urllib.request.Request(url, headers={"X-Key": str(cfg.get("api_key", "")), "Accept": "application/json"}, method="GET") + with urllib.request.urlopen(req, timeout=60) as r: + raw = r.read() + return json.loads(raw) if raw else {} + + +def _run(fn): + try: + print(json.dumps(fn(_cfg(), _inputs()))) + except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) + except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) + + +q = lambda v: urllib.parse.quote(str(v), safe="") + + +def main(cfg, inputs): + domain = inputs.get("domain") + if not domain: + raise Exception("domain is required") + page = inputs.get("page") + return request("/query/domains/subdomain/" + q(domain), cfg, params={"page": int(page or 1)}) + + +_run(main) diff --git a/integrations/binaryedge/scripts/host.py b/integrations/binaryedge/scripts/host.py new file mode 100644 index 0000000..c6ff846 --- /dev/null +++ b/integrations/binaryedge/scripts/host.py @@ -0,0 +1,47 @@ +import json, os, sys, urllib.parse, urllib.request, urllib.error + +BASE = "https://api.binaryedge.io/v2" + + +def _cfg(): + return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) + + +def _inputs(): + return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def request(path, cfg, params=None): + url = BASE + path + if params: + clean = {k: v for k, v in params.items() if v not in (None, "")} + if clean: + url += "?" + urllib.parse.urlencode(clean) + req = urllib.request.Request(url, headers={"X-Key": str(cfg.get("api_key", "")), "Accept": "application/json"}, method="GET") + with urllib.request.urlopen(req, timeout=60) as r: + raw = r.read() + return json.loads(raw) if raw else {} + + +def _run(fn): + try: + print(json.dumps(fn(_cfg(), _inputs()))) + except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) + except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) + + +q = lambda v: urllib.parse.quote(str(v), safe="") + + +def main(cfg, inputs): + ip = inputs.get("ip") + if not ip: + raise Exception("ip is required") + return request("/query/ip/" + q(ip), cfg) + + +_run(main) diff --git a/integrations/binaryedge/scripts/host_historical.py b/integrations/binaryedge/scripts/host_historical.py new file mode 100644 index 0000000..b460cb3 --- /dev/null +++ b/integrations/binaryedge/scripts/host_historical.py @@ -0,0 +1,47 @@ +import json, os, sys, urllib.parse, urllib.request, urllib.error + +BASE = "https://api.binaryedge.io/v2" + + +def _cfg(): + return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) + + +def _inputs(): + return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def request(path, cfg, params=None): + url = BASE + path + if params: + clean = {k: v for k, v in params.items() if v not in (None, "")} + if clean: + url += "?" + urllib.parse.urlencode(clean) + req = urllib.request.Request(url, headers={"X-Key": str(cfg.get("api_key", "")), "Accept": "application/json"}, method="GET") + with urllib.request.urlopen(req, timeout=60) as r: + raw = r.read() + return json.loads(raw) if raw else {} + + +def _run(fn): + try: + print(json.dumps(fn(_cfg(), _inputs()))) + except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) + except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) + + +q = lambda v: urllib.parse.quote(str(v), safe="") + + +def main(cfg, inputs): + ip = inputs.get("ip") + if not ip: + raise Exception("ip is required") + return request("/query/ip/historical/" + q(ip), cfg) + + +_run(main) diff --git a/integrations/binaryedge/scripts/search.py b/integrations/binaryedge/scripts/search.py new file mode 100644 index 0000000..153f1b2 --- /dev/null +++ b/integrations/binaryedge/scripts/search.py @@ -0,0 +1,48 @@ +import json, os, sys, urllib.parse, urllib.request, urllib.error + +BASE = "https://api.binaryedge.io/v2" + + +def _cfg(): + return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) + + +def _inputs(): + return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def request(path, cfg, params=None): + url = BASE + path + if params: + clean = {k: v for k, v in params.items() if v not in (None, "")} + if clean: + url += "?" + urllib.parse.urlencode(clean) + req = urllib.request.Request(url, headers={"X-Key": str(cfg.get("api_key", "")), "Accept": "application/json"}, method="GET") + with urllib.request.urlopen(req, timeout=60) as r: + raw = r.read() + return json.loads(raw) if raw else {} + + +def _run(fn): + try: + print(json.dumps(fn(_cfg(), _inputs()))) + except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) + except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) + + +q = lambda v: urllib.parse.quote(str(v), safe="") + + +def main(cfg, inputs): + query = inputs.get("query") + if not query: + raise Exception("query is required") + page = inputs.get("page") + return request("/query/search", cfg, params={"query": query, "page": int(page or 1)}) + + +_run(main) diff --git a/integrations/binaryedge/scripts/test_connection.py b/integrations/binaryedge/scripts/test_connection.py new file mode 100644 index 0000000..e297405 --- /dev/null +++ b/integrations/binaryedge/scripts/test_connection.py @@ -0,0 +1,45 @@ +import json, os, sys, urllib.parse, urllib.request, urllib.error + +BASE = "https://api.binaryedge.io/v2" + + +def _cfg(): + return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) + + +def _inputs(): + return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def request(path, cfg, params=None): + url = BASE + path + if params: + clean = {k: v for k, v in params.items() if v not in (None, "")} + if clean: + url += "?" + urllib.parse.urlencode(clean) + req = urllib.request.Request(url, headers={"X-Key": str(cfg.get("api_key", "")), "Accept": "application/json"}, method="GET") + with urllib.request.urlopen(req, timeout=60) as r: + raw = r.read() + return json.loads(raw) if raw else {} + + +def _run(fn): + try: + print(json.dumps(fn(_cfg(), _inputs()))) + except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) + except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) + + +q = lambda v: urllib.parse.quote(str(v), safe="") + + +def main(cfg, inputs): + request("/user/subscription", cfg) + return {"ok": True} + + +_run(main)