<commit_before>#!/usr/bin/env python
# -*- coding: utf-8 -*-

import requests

from collections import defaultdict, OrderedDict
from cortexutils.analyzer import Analyzer


class GreyNoiseAnalyzer(Analyzer):
    """
    GreyNoise API docs: https://github.com/GreyNoise-Intelligence/api.greynoise.io
    """

    @staticmethod
    def _get_level(current_level, new_intention):
        """
        Map GreyNoise intentions to Cortex maliciousness levels.
        Accept a Cortex level and a GreyNoise intention, the return the more malicious of the two.

        :param current_level: A Cortex maliciousness level
            https://github.com/TheHive-Project/CortexDocs/blob/master/api/how-to-create-an-analyzer.md#output
        :param new_intention: An intention field value from a GreyNoise record
            https://github.com/GreyNoise-Intelligence/api.greynoise.io#v1queryip
        :return: The more malicious of the 2 submitted values as a Cortex maliciousness level
        """

        intention_level_map = OrderedDict([
            ('info', 'info'),
            ('benign', 'safe'),
            ('suspicious', 'suspicious'),
            ('malicious', 'malicious')
        ])
        levels = intention_level_map.values()

        new_level = intention_level_map.get(new_intention, 'info')
        new_index = levels.index(new_level)

        try:
            current_index = levels.index(current_level)
        except ValueError:  # There is no existing level
            current_index = -1

        return new_level if new_index > current_index else current_level

    def run(self):

        if self.data_type == "ip":
            api_key = self.get_param('config.key', None)
            url = 'http://api.greynoise.io:8888/v1/query/ip'
            headers = {'Content-Type': 'application/x-www-form-urlencoded'}
            data = {'ip': self.getData()}
            if api_key:
                data['key'] = api_key
            response = requests.post(url, data=data, headers=headers)
            if not (200 <= response.status_code < 300):
                self.error('Unable to query GreyNoise API\n{}'.format(response.text))
            self.report(response.json())
        else:
            self.notSupported()

    def summary(self, raw):
        """
        Return one taxonomy summarizing the reported tags
            If there is only one tag, use it as the predicate
            If there are multiple tags, use "entries" as the predicate<commit_msg>GreyNoise use https instead port 8000 http<commit_after>#!/usr/bin/env python
# -*- coding: utf-8 -*-

import requests

from collections import defaultdict, OrderedDict
from cortexutils.analyzer import Analyzer


class GreyNoiseAnalyzer(Analyzer):
    """
    GreyNoise API docs: https://github.com/GreyNoise-Intelligence/api.greynoise.io
    """

    @staticmethod
    def _get_level(current_level, new_intention):
        """
        Map GreyNoise intentions to Cortex maliciousness levels.
        Accept a Cortex level and a GreyNoise intention, the return the more malicious of the two.

        :param current_level: A Cortex maliciousness level
            https://github.com/TheHive-Project/CortexDocs/blob/master/api/how-to-create-an-analyzer.md#output
        :param new_intention: An intention field value from a GreyNoise record
            https://github.com/GreyNoise-Intelligence/api.greynoise.io#v1queryip
        :return: The more malicious of the 2 submitted values as a Cortex maliciousness level
        """

        intention_level_map = OrderedDict([
            ('info', 'info'),
            ('benign', 'safe'),
            ('suspicious', 'suspicious'),
            ('malicious', 'malicious')
        ])
        levels = intention_level_map.values()

        new_level = intention_level_map.get(new_intention, 'info')
        new_index = levels.index(new_level)

        try:
            current_index = levels.index(current_level)
        except ValueError:  # There is no existing level
            current_index = -1

        return new_level if new_index > current_index else current_level

    def run(self):

        if self.data_type == "ip":
            api_key = self.get_param('config.key', None)
            url = 'https://api.greynoise.io/v1/query/ip'
            headers = {'Content-Type': 'application/x-www-form-urlencoded'}
            data = {'ip': self.get_data()}
            if api_key:
                data['key'] = api_key
            response = requests.post(url, data=data, headers=headers)
            if not (200 <= response.status_code < 300):
                self.error('Unable to query GreyNoise API\n{}'.format(response.text))
            self.report(response.json())
        else:
            self.notSupported()

    def summary(self, raw):
        """
        Return one taxonomy summarizing the reported tags
            If there is only one tag, use it as the predicate
            If there are multiple tags, use "entries" as the predicate
{'fraction_non_alphanumeric': 0.10080482897384306, 'fraction_numerical': 0.006036217303822937, 'mean_word_length': 2.3656059580230195, 'pattern_counts': {'":': 2, '<': 7, '<?xml version=': 0, '>': 5, 'https://': 7, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3807957', 'n_tokens_mistral': 1439, 'n_tokens_neox': 1373, 'n_words': 373}