From b137e49be4bd5626c45fb12438ec33fa75ecbbfb Mon Sep 17 00:00:00 2001 From: Guillaume BOURGEOIS Date: Sun, 12 Jul 2026 14:58:08 +0200 Subject: [PATCH] feat(yaraify): new YARAify file/YARA-intel integration YARAify (abuse.ch) API v1, 4 commands: lookup hash, get YARA rule, recent matches. Auth-Key auth, stdlib-only. Co-Authored-By: Claude Opus 4.8 (1M context) --- integrations/yaraify/manifest.yaml | 53 +++++++++++++++++++ integrations/yaraify/scripts/get_yara_rule.py | 46 ++++++++++++++++ integrations/yaraify/scripts/lookup_hash.py | 46 ++++++++++++++++ .../yaraify/scripts/recent_matches.py | 42 +++++++++++++++ .../yaraify/scripts/test_connection.py | 43 +++++++++++++++ 5 files changed, 230 insertions(+) create mode 100644 integrations/yaraify/manifest.yaml create mode 100644 integrations/yaraify/scripts/get_yara_rule.py create mode 100644 integrations/yaraify/scripts/lookup_hash.py create mode 100644 integrations/yaraify/scripts/recent_matches.py create mode 100644 integrations/yaraify/scripts/test_connection.py diff --git a/integrations/yaraify/manifest.yaml b/integrations/yaraify/manifest.yaml new file mode 100644 index 0000000..93a8055 --- /dev/null +++ b/integrations/yaraify/manifest.yaml @@ -0,0 +1,53 @@ +id: yaraify +name: YARAify +version: 1.0.0 +description: "YARAify by abuse.ch (API v1) — YARA/file intelligence: look up a file by hash, fetch a YARA rule's text, and list recently matched files. Auth-Key authentication; stdlib-only, no extra Python dependencies." +changelog: "1.0.0 — Initial release: lookup hash, get YARA rule, recent matches." +category: enrichment + +# Per-instance configuration. abuse.ch requires an Auth-Key header. +config_schema: + properties: + auth_key: + type: string + description: "abuse.ch Auth-Key" + x-soar-sensitive: true + required: + - auth_key + +commands: + - id: lookup_hash + name: yaraify-lookup-hash + description: "Look up a file by hash and get its YARA/ClamAV matches." + risk: read + inputs_schema: + properties: + hash: { type: string, description: "MD5, SHA-1, or SHA-256 hash" } + required: [hash] + outputs_schema: { properties: {} } + - id: get_yara_rule + name: yaraify-get-yara-rule + description: "Fetch the text of a YARA rule by name." + risk: read + inputs_schema: + properties: + rule_name: { type: string, description: "YARA rule name" } + required: [rule_name] + outputs_schema: { properties: {} } + - id: recent_matches + name: yaraify-recent-matches + description: "List recently matched files." + risk: read + inputs_schema: + properties: {} + required: [] + outputs_schema: { properties: {} } + + - id: test_connection + name: yaraify-test-connection + description: "Verify the Auth-Key (used by the Test button)." + risk: read + inputs_schema: + properties: {} + required: [] + outputs_schema: { properties: {} } diff --git a/integrations/yaraify/scripts/get_yara_rule.py b/integrations/yaraify/scripts/get_yara_rule.py new file mode 100644 index 0000000..fe77141 --- /dev/null +++ b/integrations/yaraify/scripts/get_yara_rule.py @@ -0,0 +1,46 @@ +import json, os, sys, urllib.request, urllib.error + +API = "https://yaraify-api.abuse.ch/api/v1/" + + +def _cfg(): + return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) + + +def _inputs(): + return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def query(cfg, body): + data = json.dumps(body).encode("utf-8") + headers = { + "Auth-Key": str(cfg.get("auth_key", "")), + "Content-Type": "application/json", + "Accept": "application/json", + } + req = urllib.request.Request(API, data=data, headers=headers, method="POST") + with urllib.request.urlopen(req, timeout=60) as r: + raw = r.read() + return json.loads(raw) if raw else {} + + +def _run(fn): + try: + print(json.dumps(fn(_cfg(), _inputs()))) + except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) + except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) + + +def main(cfg, inputs): + rule_name = inputs.get("rule_name") + if not rule_name: + raise Exception("rule_name is required") + + return query(cfg, {"query": "get_yara", "yara_rule": rule_name}) + + +_run(main) diff --git a/integrations/yaraify/scripts/lookup_hash.py b/integrations/yaraify/scripts/lookup_hash.py new file mode 100644 index 0000000..758c350 --- /dev/null +++ b/integrations/yaraify/scripts/lookup_hash.py @@ -0,0 +1,46 @@ +import json, os, sys, urllib.request, urllib.error + +API = "https://yaraify-api.abuse.ch/api/v1/" + + +def _cfg(): + return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) + + +def _inputs(): + return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def query(cfg, body): + data = json.dumps(body).encode("utf-8") + headers = { + "Auth-Key": str(cfg.get("auth_key", "")), + "Content-Type": "application/json", + "Accept": "application/json", + } + req = urllib.request.Request(API, data=data, headers=headers, method="POST") + with urllib.request.urlopen(req, timeout=60) as r: + raw = r.read() + return json.loads(raw) if raw else {} + + +def _run(fn): + try: + print(json.dumps(fn(_cfg(), _inputs()))) + except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) + except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) + + +def main(cfg, inputs): + hash_value = inputs.get("hash") + if not hash_value: + raise Exception("hash is required") + + return query(cfg, {"query": "lookup_hash", "search_term": hash_value}) + + +_run(main) diff --git a/integrations/yaraify/scripts/recent_matches.py b/integrations/yaraify/scripts/recent_matches.py new file mode 100644 index 0000000..c19ba85 --- /dev/null +++ b/integrations/yaraify/scripts/recent_matches.py @@ -0,0 +1,42 @@ +import json, os, sys, urllib.request, urllib.error + +API = "https://yaraify-api.abuse.ch/api/v1/" + + +def _cfg(): + return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) + + +def _inputs(): + return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def query(cfg, body): + data = json.dumps(body).encode("utf-8") + headers = { + "Auth-Key": str(cfg.get("auth_key", "")), + "Content-Type": "application/json", + "Accept": "application/json", + } + req = urllib.request.Request(API, data=data, headers=headers, method="POST") + with urllib.request.urlopen(req, timeout=60) as r: + raw = r.read() + return json.loads(raw) if raw else {} + + +def _run(fn): + try: + print(json.dumps(fn(_cfg(), _inputs()))) + except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) + except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) + + +def main(cfg, inputs): + return query(cfg, {"query": "recent"}) + + +_run(main) diff --git a/integrations/yaraify/scripts/test_connection.py b/integrations/yaraify/scripts/test_connection.py new file mode 100644 index 0000000..5df0355 --- /dev/null +++ b/integrations/yaraify/scripts/test_connection.py @@ -0,0 +1,43 @@ +import json, os, sys, urllib.request, urllib.error + +API = "https://yaraify-api.abuse.ch/api/v1/" + + +def _cfg(): + return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) + + +def _inputs(): + return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def query(cfg, body): + data = json.dumps(body).encode("utf-8") + headers = { + "Auth-Key": str(cfg.get("auth_key", "")), + "Content-Type": "application/json", + "Accept": "application/json", + } + req = urllib.request.Request(API, data=data, headers=headers, method="POST") + with urllib.request.urlopen(req, timeout=60) as r: + raw = r.read() + return json.loads(raw) if raw else {} + + +def _run(fn): + try: + print(json.dumps(fn(_cfg(), _inputs()))) + except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) + except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) + + +def main(cfg, inputs): + query(cfg, {"query": "recent"}) + return {"ok": True} + + +_run(main)