Adding some analyzers for common tools

analyzers/Bluecoat/Bluecoat.json

@@ -0,0 +1,16 @@
+{
+    "name": "Bluecoat",
+    "version": "0.1",
+    "author": "IFX-CDC Alexander Goedeke",
+    "url": "https://github.com/IFX-CDC/Cortex-Analyzers",
+    "license": "AGPL-V3",
+    "baseConfig": "Bluecoat",
+    "config": {
+        "check_tlp": true,
+        "max_tlp": 0,
+        "service": "search"
+    },
+    "description": "The analyser search for a url in bluecoat.",
+    "dataTypeList": ["domain", "url"],
+    "command": "Bluecoat/bluecoat_analyzer.py"
+}

analyzers/Bluecoat/bluecoat_analyzer.py

@@ -0,0 +1,55 @@
+#!/usr/bin/env python
+# encoding: utf-8
+
+from cortexutils.analyzer import Analyzer
+import json
+import requests
+import re
+
+class BluecoatAnalyzer(Analyzer):
+
+    def __init__(self):
+        Analyzer.__init__(self)
+        self.service = self.getParam('config.service', 'search', 'Bluecoat service is missing, default method is used')
+
+    def summary(self, raw):
+        taxonomies = []
+        if raw.get('categorization') and len(raw.get('categorization')) > 0:
+            for cat in raw.get('categorization'):
+                taxonomies.append(self.build_taxonomy("info", "Bluecoat", "Category", cat))
+            return {"taxonomies": taxonomies}      
+
+    def run(self):
+        # get input data
+        Analyzer.run(self)
+        data = self.getParam('data', None, 'Data is missing')
+        try:
+            # send service
+            if self.service == 'search':
+                payload = {'url': data}
+                r = requests.post('https://sitereview.bluecoat.com/rest/categorization', data=payload)
+                rep = json.loads(r.content.decode())
+
+                try:
+                    rep["categorization"] = re.findall('<a[^>]*>([^<]*?)</a>', rep["categorization"])
+                except:
+                    pass
+                try:
+                    rep["ratedate"] = re.findall('Last Time Rated/Reviewed[^:]*: ([^<]*?)<img', rep["ratedate"])[0]
+                except:
+                    pass
+                try:
+                    del rep['locked_message']
+                except:
+                    pass
+
+                # send result
+                self.report(rep)
+            else:
+                self.error('Unknown Bluecoat service')
+
+        except Exception as e:
+            self.unexpectedError(e)
+
+if __name__ == '__main__':
+    BluecoatAnalyzer().run()

analyzers/Bluecoat/requirements.txt

@@ -0,0 +1 @@
+cortexutils

analyzers/MailParser/MailParser.json

@@ -0,0 +1,17 @@
+{
+    "name": "MailParser",
+    "version": "1.0",
+    "author": "IFX-CDC Alexander Goedeke",
+    "url": "https://github.com/IFX-CDC/Cortex-Analyzers",
+    "license": "AGPL-V3",
+    "baseConfig":"MailParser",
+    "config": {
+        "check_tlp": false,
+        "service": "analyse"
+    },
+    "description": "Parse Outlook MSG files and extract the main artifacts",
+    "dataTypeList": [
+        "file"
+    ],
+    "command": "MailParser/parse.py"
+}

analyzers/MailParser/lib/__init__.py

@@ -0,0 +1 @@
+# __import__('pkg_resources').declare_namespace(__name__)