From 30968575273f0587d18c988cd85c9d28abe70ba0 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 5 Jul 2018 16:45:16 +0200 Subject: [PATCH 1/2] Adding Google Vision API --- .../GoogleVisionAPI_WebDetection.json | 30 +++++++ .../GoogleVisionAPI_WebDetection.py | 80 +++++++++++++++++++ analyzers/GoogleVisionAPI/requirements.txt | 2 + .../long.html | 72 +++++++++++++++++ .../short.html | 6 ++ 5 files changed, 190 insertions(+) create mode 100644 analyzers/GoogleVisionAPI/GoogleVisionAPI_WebDetection.json create mode 100755 analyzers/GoogleVisionAPI/GoogleVisionAPI_WebDetection.py create mode 100644 analyzers/GoogleVisionAPI/requirements.txt create mode 100644 thehive-templates/GoogleVisionAPI_WebDetection_1_0_0/long.html create mode 100644 thehive-templates/GoogleVisionAPI_WebDetection_1_0_0/short.html diff --git a/analyzers/GoogleVisionAPI/GoogleVisionAPI_WebDetection.json b/analyzers/GoogleVisionAPI/GoogleVisionAPI_WebDetection.json new file mode 100644 index 000000000..50be28a33 --- /dev/null +++ b/analyzers/GoogleVisionAPI/GoogleVisionAPI_WebDetection.json @@ -0,0 +1,30 @@ +{ + "name": "GoogleVisionAPI_WebDetection", + "version": "1.0.0", + "author": "CERT-LaPoste", + "url": "https://github.com/TheHive-Project/Cortex-Analyzers", + "license": "AGPL-V3", + "description": "Find look alike image via Google Cloud Vision API using the Web_Detection service ", + "dataTypeList": ["file", "url"], + "command": "GoogleVisionAPI/GoogleVisionAPI_WebDetection.py", + "baseConfig": "Vision", + "config": { + "service": "get" + }, + "configurationItems": [ + { + "name": "api_key", + "description": "API key for this service", + "type": "string", + "multi": false, + "required": true + }, + { + "name": "max_Result", + "description": "Maximum number of url to fetch", + "type": "string", + "multi": false, + "required": false + } + ] +} diff --git a/analyzers/GoogleVisionAPI/GoogleVisionAPI_WebDetection.py b/analyzers/GoogleVisionAPI/GoogleVisionAPI_WebDetection.py new file mode 100755 index 000000000..66ae947e3 --- /dev/null +++ b/analyzers/GoogleVisionAPI/GoogleVisionAPI_WebDetection.py @@ -0,0 +1,80 @@ +#!/usr/bin/python3 +#coding:utf-8 + +from cortexutils.analyzer import Analyzer +from requests import post +from json import dumps, loads +from base64 import b64encode + +class GoogleAPI_Vision(Analyzer): + + def __init__(self): + Analyzer.__init__(self) + self.api_endpoint = "https://vision.googleapis.com/v1/images:annotate" + + def make_api_call(self, url: str, query: str, api_key: str, https_proxy: str, maxResults: int, datatype: str, file=None) -> dict: + + header = { + "Content-Type" : "application/json" + } + + data = { + "requests": [{ + "image": { + "source": { + "imageUri": query + } + }, + "features": [{ + "type": "WEB_DETECTION", + "maxResults": maxResults + }] + }] + } + + if datatype == "file": + try: + query = b64encode(open(file, "rb").read()).decode("utf-8") + except FileNotFoundError: + self.error("Error while reading provided file") + else: + del data["requests"][0]["image"]["source"] + data["requests"][0]["image"]["content"] = query + + try: + api_answser = loads(post(url + "?key=" + api_key, data=dumps(data), headers=header, proxies=https_proxy).text) + except ValueError: + self.error("Cannot parse JSON answer from server") + else: + return api_answser + + def get_artifacts(self, google_results: str) -> list: + return [ item["url"] for item in google_results['responses'][0]["webDetection"]["pagesWithMatchingImages"]] + + def run(self): + query = self.getData() + + if query is None: + self.error("You must provide a file or a valid url to this image") + + api_key = self.getParam("config.api_key") + if api_key is None: + self.error("You need an API key for Google Vision API") + + https_proxy = { "https" : self.getParam("config.proxy_https") } + maxResults = self.getParam("config.max_Result") + maxResults = maxResults if maxResults is not None else 100 + + answer = self.make_api_call(self.api_endpoint, query, api_key, https_proxy, maxResults, self.data_type, file=self.getParam("file")) + self.report({ 'api_full_report' : answer }) + + def summary(self, raw): + + number_of_image_found = self.build_taxonomy("info", "GoogleVisionAPI", "pagesWithMatchingImages", str(len(raw["api_full_report"]["responses"][0]["webDetection"]["pagesWithMatchingImages"]))) + number_of_look_alike = self.build_taxonomy("info", "GoogleVisionAPI", "visuallySimilarImages", str(len(raw["api_full_report"]["responses"][0]["webDetection"]["visuallySimilarImages"]))) + + return { "taxonomies" : [number_of_look_alike, number_of_image_found] } + + +if __name__ == "__main__": + GoogleAPI_Vision().run() diff --git a/analyzers/GoogleVisionAPI/requirements.txt b/analyzers/GoogleVisionAPI/requirements.txt new file mode 100644 index 000000000..6aabc3cfa --- /dev/null +++ b/analyzers/GoogleVisionAPI/requirements.txt @@ -0,0 +1,2 @@ +cortexutils +requests diff --git a/thehive-templates/GoogleVisionAPI_WebDetection_1_0_0/long.html b/thehive-templates/GoogleVisionAPI_WebDetection_1_0_0/long.html new file mode 100644 index 000000000..b8acbd395 --- /dev/null +++ b/thehive-templates/GoogleVisionAPI_WebDetection_1_0_0/long.html @@ -0,0 +1,72 @@ + +
+
+ Pages with matching images +
+
+
+ Number of pages found : {{ content.api_full_report.responses[0].webDetection.pagesWithMatchingImages.length }} +
+ +
+
+
+
+ +
+
+ Visually Similar Images +
+
+
+ Number of similar image found : {{ content.api_full_report.responses[0].webDetection.visuallySimilarImages.length }} +
+ +
+
+
+
+ +
+
+ Web Entities +
+
+
+
+ {{ entities.description }} : {{ entities.score }} +
+
+
+
+ + +
+
+ An error occured +
+
+
+
{{ content.api_full_report.error.status }} :
+
{{content.api_full_report.error.message}}
+
+
+
+ +
+
+ An error occured +
+
+
+
{{ content.errorMessage }} :
+
{{content.input}}
+
+
+
+ + diff --git a/thehive-templates/GoogleVisionAPI_WebDetection_1_0_0/short.html b/thehive-templates/GoogleVisionAPI_WebDetection_1_0_0/short.html new file mode 100644 index 000000000..acc0c81a6 --- /dev/null +++ b/thehive-templates/GoogleVisionAPI_WebDetection_1_0_0/short.html @@ -0,0 +1,6 @@ + + {{t.namespace}}:{{t.predicate}}={{t.value}} + From a54307ae609e8474e2699cecfcf643019026b60d Mon Sep 17 00:00:00 2001 From: root Date: Thu, 5 Jul 2018 16:48:20 +0200 Subject: [PATCH 2/2] Adding Google Vision API --- analyzers/GoogleVisionAPI/GoogleVisionAPI_WebDetection.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/analyzers/GoogleVisionAPI/GoogleVisionAPI_WebDetection.json b/analyzers/GoogleVisionAPI/GoogleVisionAPI_WebDetection.json index 50be28a33..307c3ec3a 100644 --- a/analyzers/GoogleVisionAPI/GoogleVisionAPI_WebDetection.json +++ b/analyzers/GoogleVisionAPI/GoogleVisionAPI_WebDetection.json @@ -7,7 +7,7 @@ "description": "Find look alike image via Google Cloud Vision API using the Web_Detection service ", "dataTypeList": ["file", "url"], "command": "GoogleVisionAPI/GoogleVisionAPI_WebDetection.py", - "baseConfig": "Vision", + "baseConfig": "GoogleVisionAPI", "config": { "service": "get" },