<commit_before>#!/usr/bin/env python3

import requests

from cortexutils.analyzer import Analyzer


class AbuseIPDBAnalyzer(Analyzer):
    """
    AbuseIPDB API docs: https://www.abuseipdb.com/api
    """

    @staticmethod
    def extract_abuse_ipdb_category(category_number):
        # Reference: https://www.abuseipdb.com/categories
        mapping = {
            "3": "Fraud Orders",
            "4": "DDOS Attack",
            "5": "FTP Brute-Force",
            "6": "Ping of Death",
            "7": "Phishing",
            "8": "Fraud VOIP",
            "9": "Open Proxy",
            "10": "Web Spam",
            "11": "Email Spam",
            "12": "Blog Spam",
            "13": "VPN IP",
            "14": "Port Scan",
            "15": "Hacking",
            "16": "SQL Injection",
            "17": "Spoofing",
            "18": "Brute Force",
            "19": "Bad Web Bot",
            "20": "Exploited Host",
            "21": "Web App Attack",
            "22": "SSH",
            "23": "IoT Targeted",
        }
        return mapping.get(str(category_number), 'unknown category')

    def run(self):

        try:
            if self.data_type == "ip":
                api_key = self.get_param('config.key', None, 'Missing AbuseIPDB API key')
                days_to_check = self.get_param('config.days', 30)
                ip = self.get_data()
                url = 'https://www.abuseipdb.com/check/{}/json?days={}'.format(ip, days_to_check)
                response = requests.post(url, data = {'key': api_key})
                if not (200 <= response.status_code < 300):
                    self.error('Unable to query AbuseIPDB API\n{}'.format(response.text))
                json_response = response.json()
                # this is because in case there's only one result, the api gives back a list instead of a dict
                response_list = json_response if isinstance(json_response, list) else [json_response]
                for found in response_list:
                    if 'category' in found:
                        categories_strings = []
                        for category in found['category']:
                            categories_strings.append(self.extract_abuse_ipdb_category(category))
                        found['categories_strings'] = categories_strings
                self.report({'values': response_list})
            else:
                self.notSupported()
        except Exception as e:
            self.unexpectedError(e)

    def summary(self, raw):
        taxonomies = []

        if raw and 'values' in raw:
            taxonomies.append(self.build_taxonomy('malicious', 'AbuseIPDB', 'Records', len(raw['values'])))
        else:
            taxonomies.append(self.build_taxonomy('safe', 'AbuseIPDB', 'Records', 0))

        return {"taxonomies": taxonomies}


if __name__ == '__main__':
    AbuseIPDBAnalyzer().run()<commit_msg>#425 #353 fix number of values = 0 in summary()<commit_after>#!/usr/bin/env python3

import requests

from cortexutils.analyzer import Analyzer


class AbuseIPDBAnalyzer(Analyzer):
    """
    AbuseIPDB API docs: https://www.abuseipdb.com/api
    """

    @staticmethod
    def extract_abuse_ipdb_category(category_number):
        # Reference: https://www.abuseipdb.com/categories
        mapping = {
            "3": "Fraud Orders",
            "4": "DDOS Attack",
            "5": "FTP Brute-Force",
            "6": "Ping of Death",
            "7": "Phishing",
            "8": "Fraud VOIP",
            "9": "Open Proxy",
            "10": "Web Spam",
            "11": "Email Spam",
            "12": "Blog Spam",
            "13": "VPN IP",
            "14": "Port Scan",
            "15": "Hacking",
            "16": "SQL Injection",
            "17": "Spoofing",
            "18": "Brute Force",
            "19": "Bad Web Bot",
            "20": "Exploited Host",
            "21": "Web App Attack",
            "22": "SSH",
            "23": "IoT Targeted",
        }
        return mapping.get(str(category_number), 'unknown category')

    def run(self):

        try:
            if self.data_type == "ip":
                api_key = self.get_param('config.key', None, 'Missing AbuseIPDB API key')
                days_to_check = self.get_param('config.days', 30)
                ip = self.get_data()
                url = 'https://www.abuseipdb.com/check/{}/json?days={}'.format(ip, days_to_check)
                response = requests.post(url, data = {'key': api_key})
                if not (200 <= response.status_code < 300):
                    self.error('Unable to query AbuseIPDB API\n{}'.format(response.text))
                json_response = response.json()
                # this is because in case there's only one result, the api gives back a list instead of a dict
                response_list = json_response if isinstance(json_response, list) else [json_response]
                for found in response_list:
                    if 'category' in found:
                        categories_strings = []
                        for category in found['category']:
                            categories_strings.append(self.extract_abuse_ipdb_category(category))
                        found['categories_strings'] = categories_strings
                self.report({'values': response_list})
            else:
                self.notSupported()
        except Exception as e:
            self.unexpectedError(e)

    def summary(self, raw):
        taxonomies = []

        if raw and 'values' in raw and len(raw['values']) > 0 :
            taxonomies.append(self.build_taxonomy('malicious', 'AbuseIPDB', 'Records', len(raw['values'])))
        else:
            taxonomies.append(self.build_taxonomy('safe', 'AbuseIPDB', 'Records', 0))

        return {"taxonomies": taxonomies}


if __name__ == '__main__':
    AbuseIPDBAnalyzer().run()
{'fraction_non_alphanumeric': 0.12917518745739603, 'fraction_numerical': 0.016700749829584187, 'mean_word_length': 1.8041089345437171, 'pattern_counts': {'":': 46, '<': 7, '<?xml version=': 0, '>': 4, 'https://': 6, 'lorem ipsum': 0, 'www.': 6, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5877721', 'n_tokens_mistral': 1788, 'n_tokens_neox': 1655, 'n_words': 412}