AbuseIPDB analyzer creation

[mlodic]

Request Type

Analyzer

Description

AbuseIPDB analyzer to determine whether an IP was reported or not as malicious by AbuseIPDB -> https://www.abuseipdb.com/

Possible Solutions

I'm working on the creation of the analyzer

[ilyaglow]

Any updates? That would be a great addition.

[mlodic]

Sorry for coming late, I have just sent a pull request few moments ago #400

[Tux-Panik]

Oh shit... I was working on it :-/

[Tux-Panik]

@mlodic,
I just tested your code and it doesn't work on my side.
I reach the following "failure" status in Cortex:

{
  "errorMessage": "Invalid output\n",
  "input": null,
  "success": false
}

Do it works for you?

Moreover, would it be relevant to play with the "abuseConfidenceScore" filed present in the output to improve the Analyzer's answer?

[nadouani]

@mlodic yes, I think that the logging statements is the reason why the analyzer output is not a valid json.

[mlodic]

I have just pushed a little change to improve error handling cases, tell me if it's better now.

About the "abuseConfidenceScore", I think that it should not change the "summary" result in any way. You risk to miss interesting reports if you set a threshold. Most people who send reports to AbuseIPDB does not move that score at all.
However that is questionable: for this reason, that field is available in the "full" section. This means that, if you want, you can take advantage of that field to perform further processing.

[Tux-Panik]

I'm sorry, I can't see any change.
Latest commit 'e13f956d49f3c45ed28b593156626f2b7492f372' 1 day ago...

Thanks for your feedback,
Regards,
Julien

[mlodic]

I don't know where you get that hash, go through this pull request #400

[Tux-Panik]

I directly went to the forked repository:
https://github.com/mlodic/Cortex-Analyzers/tree/master/analyzers/AbuseIPDB

However, using the PR #400 (here) I still have the same issue:

{
  "errorMessage": "Invalid output\n",
  "input": null,
  "success": false
}

Let me know if you need additinal tests!
Thanks,
Regards,

[mlodic]

My commits are in the "develop" branch, not in the "master", that was the cause you didn't reach changes.

Could you provide some context on your error message, because on my side I cannot replicate your issue. Try/except clauses should manage all cases.

If you can, try this commit a20ce52f683acd67705743c13aca431944a40c81 and let me know.
Thanks

[Tux-Panik]

OK, I'll try this change: https://github.com/TheHive-Project/Cortex-Analyzers/tree/a20ce52f683acd67705743c13aca431944a40c81/analyzers/AbuseIPDB

and I let you know.
Thanks.

[Tux-Panik]

Dear,
As promise, below a feedback:

• Cortex version: 2.1.3-1 (Docker)
• python3 version: Python 3.4.9
• pwd: /opt/cortex/Cortex-Analyzers/analyzers/AbuseIPDB
• hash values: md5sum *
  cbea15927277b6f6b2a401bbdf9f25ab AbuseIPDB.json
9ecf5e8e50a9a93091c1d1229f5cf5b7 abuseipdb.py
57bf4fd7812a6a5f58a16db373c64c43 requirements.txt

It works!

Thanks and congratulations...
Regards,

[mlodic]

Thanks for your help!

[Tux-Panik]

@nadouani Any chance to add this new analyzer to the existing ones?
Thanks.

[jeromeleonard]

template is ready, see #425