然后我的思路是这样的, 通过以下四个步骤来完成我的自动化闭环运营。
为什么使用他们?
MalwareBazaar:
抽样评估:
Abuseipdb
对新报告恶意 IP 地址进行抽样评估
某步:
某60
某信
response = requests.post('https://mb-api.abuse.ch/api/v1/', data=data, timeout=30, headers=headers,proxies=proxies)
json_response = response.json()
if(args.field):
query = ".data[]." + args.field
json_response = jq(query).transform(text=json_response, text_output=True)
today = datetime.today()
yesterday_9 = (today - timedelta(days=1)).replace(hour=9, minute=0, second=0, microsecond=0)
today_9 = today.replace(hour=9, minute=0, second=0, microsecond=0)
results = []
for i in range(len(json_response['data'])):
data_time = datetime.strptime(json_response['data'][i]['first_seen'], '%Y-%m-%d %H:%M:%S')
if yesterday_9 <= data_time < today_9:
first_seen = "first_seen: " + json_response['data'][i]['first_seen']
sha256_hash = "sha256_hash: " + json_response['data'][i]['sha256_hash']
sha1_hash = "sha1_hash: " + json_response['data'][i]['sha1_hash']
md5_hash = "md5_hash: " + json_response['data'][i]['md5_hash']
file_type = "file_type: " + json_response['data'][i]['file_type']
testttt = first_seen + "\n" + sha256_hash + "\n" + sha1_hash + "\n" + md5_hash + "\n" + file_type + "\n"
results.extend(testttt.splitlines())
url = "https://www.abuseipdb.com/statistics"
re= requests.get(url)
re.encoding="utf-8"#改为utf-8格式,不然可能读取到的是乱码
selector=etree.HTML(re.text)#解析网站,变成HTML格式
xPath1 = "/html/body/div[3]/div/div/div/div/div[4]//text()"
xPath2 = "/html/body/div[3]/div/div/div/div/div[5]//text()"
xPath3 = "/html/body/div[3]/div/div/div/div/div[6]//text()"
xPath4 = "/html/body/div[3]/div/div/div/div/div[7]//text()"
xPath5 = "/html/body/div[3]/div/div/div/div/div[8]//text()"
widelyIP=selector.xpath("/html/body/div[3]/div/div/div/div/aside[1]//text()")
recentlyIP=selector.xpath(xPath1)+selector.xpath(xPath2)+selector.xpath(xPath3)+selector.xpath(xPath4)+selector.xpath(xPath5)
通过上面的自动化操作,我完成了病毒情报的自动化闭环运营。
1、每天定时自动化获取 IOC
2、存储 jira 工单便于度量
3、SOAR 自动化提取赋能安全设备
4、SOAR 自动化验证闭环 JIRA 工单。
最终效果流程如下: