automation-PhishLabsPopulateIndicators.yml

commonfields:
  id: PhishLabsPopulateIndicators
  version: -1
name: PhishLabsPopulateIndicators
script: |2-



  from distutils.util import strtobool

  since = demisto.args().get('since')
  delete_false_positive = bool(strtobool(demisto.args().get('delete_false_positive', 'false')))
  limit = demisto.args().get('limit')
  indicator_type = demisto.args().get('indicator_type')
  remove_protocol = demisto.args().get('remove_protocol')
  remove_query = demisto.args().get('remove_query')
  command_args = {}

  if since:
      command_args['since'] = since
  if limit:
      command_args['limit'] = int(limit)
  if indicator_type:
      command_args['indicator_type'] = indicator_type
  if remove_protocol:
      command_args['remove_protocol'] = remove_protocol
  if remove_query:
      command_args['remove_query'] = remove_query
  if delete_false_positive:
      command_args['false_positive'] = 'true'

  entry = demisto.executeCommand('phishlabs-global-feed', command_args)[0]

  if isError(entry):
      demisto.results('Failed getting the global feed from PhishLabs - {}'.format(entry['Contents']))
  else:
      content = entry.get('Contents')
      if not content or not isinstance(content, dict):
          return_error('No indicators found')

      feed = content.get('data', [])

      if delete_false_positive:
          false_positives = list(filter(lambda f: bool(strtobool(str(f.get('falsePositive', 'false')))) is True, feed))
          for false_positive in false_positives:
              delete_res = demisto.executeCommand('deleteIndicators',
                                                  {'query': 'source:"PhishLabs" and value:"{}"'
                                                      .format(false_positive.get('value')),
                                                   'reason': 'Classified as false positive by PhishLabs'})
              if isError(delete_res[0]):
                  return_error('Error deleting PhishLabs indicators - {}'.format(delete_res[0]['Contents']))
      else:
          for indicator in feed:
              indicator_type = indicator.get('type')
              indicator_value = indicator.get('value')
              indicator_timestamp = None
              if indicator.get('createdAt'):
                  indicator_timestamp = datetime.strptime(indicator['createdAt'], '%Y-%m-%dT%H:%M:%SZ')
              if indicator_type == 'Attachment':
                  indicator_type = 'File MD5'
                  file_md5_attribute = list(filter(lambda f: f.get('name') == 'md5', indicator.get('attributes', [])))
                  indicator_value = file_md5_attribute[0].get('value') if file_md5_attribute else ''

              demisto_indicator = {
                  'type': indicator_type,
                  'value': indicator_value,
                  'source': 'PhishLabs',
                  'reputation': 'Bad',
                  'seenNow': 'true',
                  'comment': 'From PhishLabs Global Feed'
              }

              if indicator_timestamp:
                  demisto_indicator['sourceTimeStamp'] = datetime.strftime(indicator_timestamp, '%Y-%m-%dT%H:%M:%SZ')

              indicator_res = demisto.executeCommand('createNewIndicator', demisto_indicator)

              if isError(indicator_res[0]):
                  return_error('Error creating indicator - {}'.format(indicator_res[0]['Contents']))

      demisto.results('Successfully populated indicators')
type: python
tags:
- PhishLabs
comment: Populate indicators by the PhishLabs IOC global feed.
enabled: true
system: true
args:
- name: since
  description: Get indicators updated within this duration (from now).
  defaultValue: 1h
- name: limit
  description: Maximum number of results to return.
- name: delete_false_positive
  auto: PREDEFINED
  predefined:
  - "true"
  - "false"
  description: If true, the indicators that were updated to be false positive will
    be whitelisted in Demisto. No new indicators will be created.
  defaultValue: "false"
- name: indicator_type
  auto: PREDEFINED
  predefined:
  - Domain
  - URL
  - Attachment
  description: Filter by indicator type.
- name: remove_query
  auto: PREDEFINED
  predefined:
  - "true"
  - "false"
  description: Removes the query string part from indicators, when the rules can be
    applied.
  defaultValue: "false"
- name: remove_protocol
  auto: PREDEFINED
  predefined:
  - "true"
  - "false"
  description: Removes the protocol part from indicators, when the rule can be applied.
  defaultValue: "false"
scripttarget: 0
dependson:
  must: []
  should:
  - PhishLabs IOC|||phishlabs-global-feed
timeout: 3.6µs
runonce: false
dockerimage: demisto/python3:3.7.3.221
runas: DBotWeakRole