feat(recorded-future): Recorded Future + ASI integrations
Recorded Future (enrichment): native ConnectAPI v2 (X-RFToken). ip/domain/url/ file/cve risk reputation, full entity intelligence, and alert ingestion (alerts search) with an OCSF mapper and a 'Recorded Future Alert' default type, plus alert lookup and alert-rule search. Recorded Future ASI (enrichment): Attack Surface Intelligence (SecurityTrails API, APIKEY header, project-scoped). Project issue ingestion (project_issues) with an OCSF mapper and a 'Recorded Future ASI Issue' default type, filtered by a configurable minimum severity, plus recent-issues and recent-issues-by-host queries. The XSOAR-gateway packs (alerts/lists) were re-implemented against Recorded Future's native ConnectAPI rather than the XSOAR-coupled gateway protocol. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Guillaume BOURGEOIS
@@ -0,0 +1,3 @@
|
||||
name: "Recorded Future Alert"
|
||||
color: "#e63946"
|
||||
icon: "alert"
|
||||
@@ -0,0 +1,148 @@
|
||||
id: recorded_future
|
||||
name: Recorded Future
|
||||
version: 1.0.0
|
||||
description: "Recorded Future ConnectAPI (v2) — risk reputation for IPs, domains, URLs, file hashes and vulnerabilities, full entity intelligence (risk rules, related entities, threat lists), and alert ingestion (search/lookup/rules)."
|
||||
changelog: "1.0.0 — Initial release: ip/domain/url/file/cve reputation, entity intelligence, alert ingestion (search) with an OCSF mapper, alert lookup and alert-rule search."
|
||||
category: enrichment
|
||||
|
||||
# Per-instance configuration. The ConnectAPI is authenticated with an
|
||||
# Organization API token sent in the X-RFToken header.
|
||||
config_schema:
|
||||
properties:
|
||||
server_url:
|
||||
type: string
|
||||
description: "Recorded Future API base URL"
|
||||
default: https://api.recordedfuture.com
|
||||
api_token:
|
||||
type: string
|
||||
description: "Recorded Future API token"
|
||||
x-soar-sensitive: true
|
||||
required:
|
||||
- api_token
|
||||
|
||||
auth:
|
||||
- id: token
|
||||
type: api_key
|
||||
in: header
|
||||
name: X-RFToken
|
||||
value_template: "{{secret}}"
|
||||
secret_field: api_token
|
||||
|
||||
commands:
|
||||
# ── Reputation ──────────────────────────────────────────────────────────────
|
||||
- id: ip
|
||||
name: recordedfuture-ip
|
||||
description: "Risk reputation for an IP address (risk score, level and triggered risk rules)."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties:
|
||||
ip: { type: string, description: "IP address" }
|
||||
required: [ip]
|
||||
outputs_schema: { properties: {} }
|
||||
|
||||
- id: domain
|
||||
name: recordedfuture-domain
|
||||
description: "Risk reputation for a domain (risk score, level and triggered risk rules)."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties:
|
||||
domain: { type: string, description: "Domain name" }
|
||||
required: [domain]
|
||||
outputs_schema: { properties: {} }
|
||||
|
||||
- id: url
|
||||
name: recordedfuture-url
|
||||
description: "Risk reputation for a URL (risk score, level and triggered risk rules)."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties:
|
||||
url: { type: string, description: "URL" }
|
||||
required: [url]
|
||||
outputs_schema: { properties: {} }
|
||||
|
||||
- id: file
|
||||
name: recordedfuture-file
|
||||
description: "Risk reputation for a file hash (MD5, SHA1, SHA256, SHA512)."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties:
|
||||
file: { type: string, description: "File hash" }
|
||||
required: [file]
|
||||
outputs_schema: { properties: {} }
|
||||
|
||||
- id: cve
|
||||
name: recordedfuture-cve
|
||||
description: "Risk reputation for a vulnerability (CVE)."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties:
|
||||
cve: { type: string, description: "CVE identifier (e.g. CVE-2021-44228)" }
|
||||
required: [cve]
|
||||
outputs_schema: { properties: {} }
|
||||
|
||||
- id: intelligence
|
||||
name: recordedfuture-intelligence
|
||||
description: "Full intelligence for a single entity: risk, triggered rules, related entities, metrics and threat lists."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties:
|
||||
entity_type: { type: string, description: "Entity type: ip, domain, url, file or cve" }
|
||||
entity: { type: string, description: "Entity value (IP, domain, URL, hash or CVE)" }
|
||||
required: [entity_type, entity]
|
||||
outputs_schema: { properties: {} }
|
||||
|
||||
# ── Alert ingestion ─────────────────────────────────────────────────────────
|
||||
- id: alerts
|
||||
name: recordedfuture-alerts
|
||||
description: "Search alerts. Used for ingestion: results path = data.results. Filter by triggered time, status and alert rule."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties:
|
||||
triggered: { type: string, description: "Triggered-time filter. A bare timestamp/relative value is treated as the lower bound ('[<value>,]'); a range '[from,to]' is passed through. Incremental fetch watermark." }
|
||||
status: { type: string, description: "Review status (unassigned, assigned, pending, actionable, no-action, tuning)" }
|
||||
alert_rule: { type: string, description: "Alert rule ID to filter by" }
|
||||
freetext: { type: string, description: "Free-text search" }
|
||||
direction: { type: string, description: "Sort direction (asc, desc). Default desc." }
|
||||
limit: { type: number, description: "Maximum number of alerts (default 50)" }
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
ingest:
|
||||
results_path: data.results
|
||||
dedup_key: id
|
||||
incremental_field: triggered
|
||||
|
||||
- id: alert_lookup
|
||||
name: recordedfuture-alert-lookup
|
||||
description: "Look up a single alert by ID."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties:
|
||||
alert_id: { type: string, description: "Alert ID" }
|
||||
required: [alert_id]
|
||||
outputs_schema: { properties: {} }
|
||||
|
||||
- id: alert_rules
|
||||
name: recordedfuture-alert-rules
|
||||
description: "Search alert rule IDs by name."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties:
|
||||
rule_name: { type: string, description: "Rule name to search (partial allowed)" }
|
||||
limit: { type: number, description: "Maximum number of rules (default 10)" }
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
|
||||
# ── Connectivity test ─────────────────────────────────────────────────────
|
||||
- id: test_connection
|
||||
name: recordedfuture-test-connection
|
||||
description: "Verify connectivity and credentials (used by the Test button)."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties: {}
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
|
||||
ingestion:
|
||||
command: alerts
|
||||
mapper: alerts
|
||||
default_incident_type: "Recorded Future Alert"
|
||||
@@ -0,0 +1,19 @@
|
||||
name: "Recorded Future Alerts → OCSF"
|
||||
description: "Maps a Recorded Future alert (/v2/alert/search, results_path = data.results) to OCSF Detection Finding fields. Alerts are generated by alerting rules over Recorded Future intelligence."
|
||||
field_mappings:
|
||||
title: "title"
|
||||
# results_path = data.results; source_path is JSONata over ONE alert object.
|
||||
# Paths absent from a given alert return nothing and are skipped.
|
||||
ocsf:
|
||||
# ── Finding ───────────────────────────────────────────────────────
|
||||
- { source_path: "id", ocsf_field: "finding_info.uid" }
|
||||
- { source_path: "title", ocsf_field: "finding_info.title" }
|
||||
- { source_path: "triggered", ocsf_field: "finding_info.created_time" }
|
||||
- { source_path: "url", ocsf_field: "finding_info.src_url" }
|
||||
# ── Triggering rule (analytic) ────────────────────────────────────
|
||||
- { source_path: "rule.name", ocsf_field: "finding_info.analytic.name" }
|
||||
- { source_path: "rule.id", ocsf_field: "finding_info.analytic.uid" }
|
||||
# ── Incident state ────────────────────────────────────────────────
|
||||
- { source_path: "review.status", ocsf_field: "status" }
|
||||
- { source_path: "type", ocsf_field: "activity_name" }
|
||||
- { source_path: "review.assignee", ocsf_field: "assignee.name" }
|
||||
@@ -0,0 +1,35 @@
|
||||
import json, os, sys, urllib.request, urllib.parse, urllib.error
|
||||
|
||||
|
||||
def _cfg():
|
||||
s = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
|
||||
base = str(s.get("server_url") or "https://api.recordedfuture.com").rstrip("/")
|
||||
headers = {"X-RFToken": s.get("api_token", ""), "Accept": "application/json"}
|
||||
return base, headers
|
||||
|
||||
|
||||
def _inputs():
|
||||
return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
|
||||
|
||||
|
||||
def request(path):
|
||||
base, headers = _cfg()
|
||||
req = urllib.request.Request(base + "/" + path.lstrip("/"), headers=headers, method="GET")
|
||||
with urllib.request.urlopen(req, timeout=90) as r:
|
||||
raw = r.read()
|
||||
return json.loads(raw) if raw else {}
|
||||
|
||||
|
||||
def run():
|
||||
alert_id = urllib.parse.quote(str(_inputs().get("alert_id", "")), safe="")
|
||||
print(json.dumps(request("/v2/alert/" + alert_id)))
|
||||
|
||||
|
||||
try:
|
||||
run()
|
||||
except urllib.error.HTTPError as e:
|
||||
print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
|
||||
sys.exit(1)
|
||||
except Exception as e:
|
||||
print(json.dumps({"error": str(e)}))
|
||||
sys.exit(1)
|
||||
@@ -0,0 +1,38 @@
|
||||
import json, os, sys, urllib.request, urllib.parse, urllib.error
|
||||
|
||||
|
||||
def _cfg():
|
||||
s = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
|
||||
base = str(s.get("server_url") or "https://api.recordedfuture.com").rstrip("/")
|
||||
headers = {"X-RFToken": s.get("api_token", ""), "Accept": "application/json"}
|
||||
return base, headers
|
||||
|
||||
|
||||
def _inputs():
|
||||
return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
|
||||
|
||||
|
||||
def request(path, params):
|
||||
base, headers = _cfg()
|
||||
clean = {k: v for k, v in params.items() if v not in (None, "")}
|
||||
url = base + "/" + path.lstrip("/") + ("?" + urllib.parse.urlencode(clean, doseq=True) if clean else "")
|
||||
req = urllib.request.Request(url, headers=headers, method="GET")
|
||||
with urllib.request.urlopen(req, timeout=90) as r:
|
||||
raw = r.read()
|
||||
return json.loads(raw) if raw else {}
|
||||
|
||||
|
||||
def run():
|
||||
inp = _inputs()
|
||||
params = {"freetext": inp.get("rule_name"), "limit": inp.get("limit") or 10}
|
||||
print(json.dumps(request("/v2/alert/rule", params)))
|
||||
|
||||
|
||||
try:
|
||||
run()
|
||||
except urllib.error.HTTPError as e:
|
||||
print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
|
||||
sys.exit(1)
|
||||
except Exception as e:
|
||||
print(json.dumps({"error": str(e)}))
|
||||
sys.exit(1)
|
||||
@@ -0,0 +1,50 @@
|
||||
import json, os, sys, urllib.request, urllib.parse, urllib.error
|
||||
|
||||
|
||||
def _cfg():
|
||||
s = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
|
||||
base = str(s.get("server_url") or "https://api.recordedfuture.com").rstrip("/")
|
||||
headers = {"X-RFToken": s.get("api_token", ""), "Accept": "application/json"}
|
||||
return base, headers
|
||||
|
||||
|
||||
def _inputs():
|
||||
return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
|
||||
|
||||
|
||||
def request(path, params):
|
||||
base, headers = _cfg()
|
||||
clean = {k: v for k, v in params.items() if v not in (None, "")}
|
||||
url = base + "/" + path.lstrip("/") + ("?" + urllib.parse.urlencode(clean, doseq=True) if clean else "")
|
||||
req = urllib.request.Request(url, headers=headers, method="GET")
|
||||
with urllib.request.urlopen(req, timeout=90) as r:
|
||||
raw = r.read()
|
||||
return json.loads(raw) if raw else {}
|
||||
|
||||
|
||||
def run():
|
||||
inp = _inputs()
|
||||
params = {
|
||||
"limit": inp.get("limit") or 50,
|
||||
"orderby": "triggered",
|
||||
"direction": inp.get("direction") or "desc",
|
||||
"status": inp.get("status"),
|
||||
"alertRule": inp.get("alert_rule"),
|
||||
"freetext": inp.get("freetext"),
|
||||
}
|
||||
trig = inp.get("triggered")
|
||||
if trig:
|
||||
t = str(trig)
|
||||
# A bare timestamp/relative value becomes the lower bound of a range.
|
||||
params["triggered"] = t if ("[" in t or "," in t) else ("[" + t + ",]")
|
||||
print(json.dumps(request("/v2/alert/search", params)))
|
||||
|
||||
|
||||
try:
|
||||
run()
|
||||
except urllib.error.HTTPError as e:
|
||||
print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
|
||||
sys.exit(1)
|
||||
except Exception as e:
|
||||
print(json.dumps({"error": str(e)}))
|
||||
sys.exit(1)
|
||||
@@ -0,0 +1,39 @@
|
||||
import json, os, sys, urllib.request, urllib.parse, urllib.error
|
||||
|
||||
|
||||
def _cfg():
|
||||
s = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
|
||||
base = str(s.get("server_url") or "https://api.recordedfuture.com").rstrip("/")
|
||||
headers = {"X-RFToken": s.get("api_token", ""), "Accept": "application/json"}
|
||||
return base, headers
|
||||
|
||||
|
||||
def _inputs():
|
||||
return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
|
||||
|
||||
|
||||
def request(path, params):
|
||||
base, headers = _cfg()
|
||||
clean = {k: v for k, v in params.items() if v not in (None, "")}
|
||||
url = base + "/" + path.lstrip("/") + ("?" + urllib.parse.urlencode(clean, doseq=True) if clean else "")
|
||||
req = urllib.request.Request(url, headers=headers, method="GET")
|
||||
with urllib.request.urlopen(req, timeout=90) as r:
|
||||
raw = r.read()
|
||||
return json.loads(raw) if raw else {}
|
||||
|
||||
|
||||
def run():
|
||||
value = str(_inputs().get("cve", ""))
|
||||
out = request("/v2/vulnerability/" + urllib.parse.quote(value, safe=""),
|
||||
{"fields": "risk,entity,timestamps,intelCard,cvssv3,nvdDescription"})
|
||||
print(json.dumps(out))
|
||||
|
||||
|
||||
try:
|
||||
run()
|
||||
except urllib.error.HTTPError as e:
|
||||
print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
|
||||
sys.exit(1)
|
||||
except Exception as e:
|
||||
print(json.dumps({"error": str(e)}))
|
||||
sys.exit(1)
|
||||
@@ -0,0 +1,39 @@
|
||||
import json, os, sys, urllib.request, urllib.parse, urllib.error
|
||||
|
||||
|
||||
def _cfg():
|
||||
s = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
|
||||
base = str(s.get("server_url") or "https://api.recordedfuture.com").rstrip("/")
|
||||
headers = {"X-RFToken": s.get("api_token", ""), "Accept": "application/json"}
|
||||
return base, headers
|
||||
|
||||
|
||||
def _inputs():
|
||||
return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
|
||||
|
||||
|
||||
def request(path, params):
|
||||
base, headers = _cfg()
|
||||
clean = {k: v for k, v in params.items() if v not in (None, "")}
|
||||
url = base + "/" + path.lstrip("/") + ("?" + urllib.parse.urlencode(clean, doseq=True) if clean else "")
|
||||
req = urllib.request.Request(url, headers=headers, method="GET")
|
||||
with urllib.request.urlopen(req, timeout=90) as r:
|
||||
raw = r.read()
|
||||
return json.loads(raw) if raw else {}
|
||||
|
||||
|
||||
def run():
|
||||
value = str(_inputs().get("domain", ""))
|
||||
out = request("/v2/domain/" + urllib.parse.quote(value, safe=""),
|
||||
{"fields": "risk,entity,timestamps,intelCard"})
|
||||
print(json.dumps(out))
|
||||
|
||||
|
||||
try:
|
||||
run()
|
||||
except urllib.error.HTTPError as e:
|
||||
print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
|
||||
sys.exit(1)
|
||||
except Exception as e:
|
||||
print(json.dumps({"error": str(e)}))
|
||||
sys.exit(1)
|
||||
@@ -0,0 +1,39 @@
|
||||
import json, os, sys, urllib.request, urllib.parse, urllib.error
|
||||
|
||||
|
||||
def _cfg():
|
||||
s = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
|
||||
base = str(s.get("server_url") or "https://api.recordedfuture.com").rstrip("/")
|
||||
headers = {"X-RFToken": s.get("api_token", ""), "Accept": "application/json"}
|
||||
return base, headers
|
||||
|
||||
|
||||
def _inputs():
|
||||
return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
|
||||
|
||||
|
||||
def request(path, params):
|
||||
base, headers = _cfg()
|
||||
clean = {k: v for k, v in params.items() if v not in (None, "")}
|
||||
url = base + "/" + path.lstrip("/") + ("?" + urllib.parse.urlencode(clean, doseq=True) if clean else "")
|
||||
req = urllib.request.Request(url, headers=headers, method="GET")
|
||||
with urllib.request.urlopen(req, timeout=90) as r:
|
||||
raw = r.read()
|
||||
return json.loads(raw) if raw else {}
|
||||
|
||||
|
||||
def run():
|
||||
value = str(_inputs().get("file", ""))
|
||||
out = request("/v2/hash/" + urllib.parse.quote(value, safe=""),
|
||||
{"fields": "risk,entity,timestamps,intelCard,hashAlgorithm"})
|
||||
print(json.dumps(out))
|
||||
|
||||
|
||||
try:
|
||||
run()
|
||||
except urllib.error.HTTPError as e:
|
||||
print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
|
||||
sys.exit(1)
|
||||
except Exception as e:
|
||||
print(json.dumps({"error": str(e)}))
|
||||
sys.exit(1)
|
||||
@@ -0,0 +1,47 @@
|
||||
import json, os, sys, urllib.request, urllib.parse, urllib.error
|
||||
|
||||
# Map a user-facing entity type to the ConnectAPI path segment.
|
||||
TYPE_MAP = {"ip": "ip", "domain": "domain", "url": "url", "file": "hash", "hash": "hash", "cve": "vulnerability", "vulnerability": "vulnerability"}
|
||||
|
||||
|
||||
def _cfg():
|
||||
s = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
|
||||
base = str(s.get("server_url") or "https://api.recordedfuture.com").rstrip("/")
|
||||
headers = {"X-RFToken": s.get("api_token", ""), "Accept": "application/json"}
|
||||
return base, headers
|
||||
|
||||
|
||||
def _inputs():
|
||||
return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
|
||||
|
||||
|
||||
def request(path, params):
|
||||
base, headers = _cfg()
|
||||
clean = {k: v for k, v in params.items() if v not in (None, "")}
|
||||
url = base + "/" + path.lstrip("/") + ("?" + urllib.parse.urlencode(clean, doseq=True) if clean else "")
|
||||
req = urllib.request.Request(url, headers=headers, method="GET")
|
||||
with urllib.request.urlopen(req, timeout=90) as r:
|
||||
raw = r.read()
|
||||
return json.loads(raw) if raw else {}
|
||||
|
||||
|
||||
def run():
|
||||
inp = _inputs()
|
||||
rf_type = TYPE_MAP.get(str(inp.get("entity_type", "")).lower())
|
||||
if not rf_type:
|
||||
print(json.dumps({"error": "Unsupported entity_type. Use ip, domain, url, file or cve."}))
|
||||
sys.exit(1)
|
||||
value = str(inp.get("entity", ""))
|
||||
out = request("/v2/" + rf_type + "/" + urllib.parse.quote(value, safe=""),
|
||||
{"fields": "risk,entity,timestamps,intelCard,relatedEntities,metrics,threatLists"})
|
||||
print(json.dumps(out))
|
||||
|
||||
|
||||
try:
|
||||
run()
|
||||
except urllib.error.HTTPError as e:
|
||||
print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
|
||||
sys.exit(1)
|
||||
except Exception as e:
|
||||
print(json.dumps({"error": str(e)}))
|
||||
sys.exit(1)
|
||||
@@ -0,0 +1,39 @@
|
||||
import json, os, sys, urllib.request, urllib.parse, urllib.error
|
||||
|
||||
|
||||
def _cfg():
|
||||
s = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
|
||||
base = str(s.get("server_url") or "https://api.recordedfuture.com").rstrip("/")
|
||||
headers = {"X-RFToken": s.get("api_token", ""), "Accept": "application/json"}
|
||||
return base, headers
|
||||
|
||||
|
||||
def _inputs():
|
||||
return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
|
||||
|
||||
|
||||
def request(path, params):
|
||||
base, headers = _cfg()
|
||||
clean = {k: v for k, v in params.items() if v not in (None, "")}
|
||||
url = base + "/" + path.lstrip("/") + ("?" + urllib.parse.urlencode(clean, doseq=True) if clean else "")
|
||||
req = urllib.request.Request(url, headers=headers, method="GET")
|
||||
with urllib.request.urlopen(req, timeout=90) as r:
|
||||
raw = r.read()
|
||||
return json.loads(raw) if raw else {}
|
||||
|
||||
|
||||
def run():
|
||||
value = str(_inputs().get("ip", ""))
|
||||
out = request("/v2/ip/" + urllib.parse.quote(value, safe=""),
|
||||
{"fields": "risk,entity,timestamps,intelCard,location,riskyCIDRIPs"})
|
||||
print(json.dumps(out))
|
||||
|
||||
|
||||
try:
|
||||
run()
|
||||
except urllib.error.HTTPError as e:
|
||||
print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
|
||||
sys.exit(1)
|
||||
except Exception as e:
|
||||
print(json.dumps({"error": str(e)}))
|
||||
sys.exit(1)
|
||||
@@ -0,0 +1,36 @@
|
||||
import json, os, sys, urllib.request, urllib.parse, urllib.error
|
||||
|
||||
|
||||
def _cfg():
|
||||
s = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
|
||||
base = str(s.get("server_url") or "https://api.recordedfuture.com").rstrip("/")
|
||||
headers = {"X-RFToken": s.get("api_token", ""), "Accept": "application/json"}
|
||||
return base, headers
|
||||
|
||||
|
||||
def request(path, params):
|
||||
base, headers = _cfg()
|
||||
clean = {k: v for k, v in params.items() if v not in (None, "")}
|
||||
url = base + "/" + path.lstrip("/") + ("?" + urllib.parse.urlencode(clean, doseq=True) if clean else "")
|
||||
req = urllib.request.Request(url, headers=headers, method="GET")
|
||||
with urllib.request.urlopen(req, timeout=60) as r:
|
||||
raw = r.read()
|
||||
return json.loads(raw) if raw else {}
|
||||
|
||||
|
||||
def run():
|
||||
# A minimal entity lookup validates both connectivity and the token.
|
||||
request("/v2/ip/8.8.8.8", {"fields": "entity"})
|
||||
print(json.dumps({"ok": True}))
|
||||
|
||||
|
||||
try:
|
||||
run()
|
||||
except urllib.error.HTTPError as e:
|
||||
detail = e.read().decode("utf-8", "replace")
|
||||
msg = "API token is not valid." if e.code in (401, 403) else "HTTP " + str(e.code)
|
||||
print(json.dumps({"ok": False, "error": msg, "detail": detail}))
|
||||
sys.exit(1)
|
||||
except Exception as e:
|
||||
print(json.dumps({"ok": False, "error": str(e)}))
|
||||
sys.exit(1)
|
||||
@@ -0,0 +1,39 @@
|
||||
import json, os, sys, urllib.request, urllib.parse, urllib.error
|
||||
|
||||
|
||||
def _cfg():
|
||||
s = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
|
||||
base = str(s.get("server_url") or "https://api.recordedfuture.com").rstrip("/")
|
||||
headers = {"X-RFToken": s.get("api_token", ""), "Accept": "application/json"}
|
||||
return base, headers
|
||||
|
||||
|
||||
def _inputs():
|
||||
return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
|
||||
|
||||
|
||||
def request(path, params):
|
||||
base, headers = _cfg()
|
||||
clean = {k: v for k, v in params.items() if v not in (None, "")}
|
||||
url = base + "/" + path.lstrip("/") + ("?" + urllib.parse.urlencode(clean, doseq=True) if clean else "")
|
||||
req = urllib.request.Request(url, headers=headers, method="GET")
|
||||
with urllib.request.urlopen(req, timeout=90) as r:
|
||||
raw = r.read()
|
||||
return json.loads(raw) if raw else {}
|
||||
|
||||
|
||||
def run():
|
||||
value = str(_inputs().get("url", ""))
|
||||
out = request("/v2/url/" + urllib.parse.quote(value, safe=""),
|
||||
{"fields": "risk,entity,timestamps"})
|
||||
print(json.dumps(out))
|
||||
|
||||
|
||||
try:
|
||||
run()
|
||||
except urllib.error.HTTPError as e:
|
||||
print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
|
||||
sys.exit(1)
|
||||
except Exception as e:
|
||||
print(json.dumps({"error": str(e)}))
|
||||
sys.exit(1)
|
||||
Reference in New Issue
Block a user