import json, os, sys, urllib.request, urllib.parse, urllib.error def request(method, url, headers, body=None): data = json.dumps(body).encode("utf-8") if body is not None else None req = urllib.request.Request(url, data=data, headers=headers, method=method) with urllib.request.urlopen(req, timeout=60) as resp: raw = resp.read() return json.loads(raw) if raw else {} def qs(params): clean = {} for k, v in params.items(): if v is None or v == "" or v == []: continue if isinstance(v, bool): v = "true" if v else "false" clean[k] = v return ("?" + urllib.parse.urlencode(clean)) if clean else "" def csv(v): return [x.strip() for x in str(v or "").split(",") if x.strip()] def main(): secrets = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) base = secrets.get("url", "").rstrip("/") headers = { "Authorization": "Token " + secrets.get("api_token", ""), "Accept": "application/json", "Content-Type": "application/json", } size = None if inputs.get("filesize"): size = int(inputs.get("filesize")) elif inputs.get("hash_filesize"): size = int(inputs.get("hash_filesize")) values = [] if inputs.get("filename"): values.append({"global": False, "size": size, "type": "filename", "value": inputs.get("filename")}) if inputs.get("filepath"): values.append({"global": False, "type": "filepath", "value": inputs.get("filepath")}) if inputs.get("hash"): values.append({"global": False, "size": size, "type": "hash", "value": inputs.get("hash")}) if inputs.get("registry"): values.append({"global": False, "type": "registry", "value": inputs.get("registry")}) if inputs.get("filepath_regex"): values.append({"global": False, "type": "regex", "value": inputs.get("filepath_regex")}) if values and inputs.get("search_in_path"): values.append({"global": True, "type": "path", "value": inputs.get("search_in_path")}) PARAMS = {"values": values} body = {"targets": {"agents": [inputs.get("agent_id")]}, "actions": [{"value": "IOCScan", "params": PARAMS}]} print(json.dumps(request("POST", base + "/api/data/Job/", headers, body))) try: main() except urllib.error.HTTPError as e: print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) sys.exit(1) except Exception as e: print(json.dumps({"error": str(e)})) sys.exit(1)