<commit_before>#!/usr/bin/env python3

'''
Import VMRay results.

This version supports import from different analyze jobs, starting from one sample
(the supplied sample_id).

Requires "vmray_rest_api"

TODO:
 # Import one job (analyze_id)
 # Import STIX package (XML version)

'''

import json
import re

from ._vmray.vmray_rest_api import VMRayRESTAPI

misperrors = {'error': 'Error'}
inputSource = []
moduleinfo = {'version': '0.1', 'author': '<NAME>',
              'description': 'Import VMRay (VTI) results',
              'module-type': ['import']}
userConfig = {'include_textdescr': {'type': 'Boolean',
                                    'message': 'Include textual description'
                                    },
              'include_analysisid': {'type': 'Boolean',
                                     'message': 'Include VMRay analysis_id text'
                                     },
              'only_network_info': {'type': 'Boolean',
                                    'message': 'Only include network (src-ip, hostname, domain, ...) information'
                                    },
              'sample_id': {'type': 'Integer',
                            'errorMessage': 'Expected a sample ID',
                            'message': 'The VMRay sample_id'
                            }
              }

moduleconfig = ['apikey', 'url']

include_textdescr = False
include_analysisid = False
only_network_info = False


def handler(q=False):
    global include_textdescr
    global include_analysisid
    global only_network_info

    if q is False:
        return False
    request = json.loads(q)

    include_textdescr = request["config"].get("include_textdescr")
    include_analysisid = request["config"].get("include_analysisid")
    only_network_info = request["config"].get("only_network_info")
    if include_textdescr == "1":
        include_textdescr = True
    else:
        include_textdescr = False
    if include_analysisid == "1":
        include_analysisid = True
    else:
        include_analysisid = False
    if only_network_info == "1":
        only_network_info = True
    else:
        only_network_info = False

    sample_id = int(request["config"].get("sample_id"))

    if (request["config"].get("apikey") is None) or (request["config"].get("url") is None):
        misperrors["error"] = "Missing API key or server URL (hint: try cloud.vmray.com)"
        return misperrors

    if sample_id > 0:
        try:
            api = VMRayRESTAPI(request["config"].get("url"), request["config"].get("apikey"), False)
            vmray_results = {'results': []}
            # Get all information on the sample, returns a set of finished analyze jobs
            data = vmrayGetInfoAnalysis(api, sample_id)
            if data["data"]:
                vti_patterns_found = False
                for analysis in data["data"]:
                    analysis_id = analysis["analysis_id"]

                    if analysis_id > 0:
                        # Get the details for an analyze job
                        analysis_data = vmrayDownloadAnalysis(api, analysis_id)

                        if analysis_data:
                            p = vmrayVtiPatterns(analysis_data["vti_patterns"])
                            if p and len(p["results"]) > 0:
                                vti_patterns_found = True
                                vmray_results = {'results': vmray_results["results"] + p["results"]}
                            if include_analysisid:
                                a_id = {'results': []}
                                url1 = "https://cloud.vmray.com/user/analysis/view?from_sample_id=%u" % sample_id
                                url2 = "&id=%u" % analysis_id
                                url3 = "&sub=%2Freport%2Foverview.html"
                                a_id["results"].append({ "values": url1 + url2 + url3, "types": "link" })<commit_msg>Fix VMRay API access error<commit_after>#!/usr/bin/env python3

'''
Import VMRay results.

This version supports import from different analyze jobs, starting from one sample
(the supplied sample_id).

Requires "vmray_rest_api"

TODO:
 # Import one job (analyze_id)
 # Import STIX package (XML version)

'''

import json
import re

from ._vmray.vmray_rest_api import VMRayRESTAPI

misperrors = {'error': 'Error'}
inputSource = []
moduleinfo = {'version': '0.1', 'author': '<NAME>',
              'description': 'Import VMRay (VTI) results',
              'module-type': ['import']}
userConfig = {'include_textdescr': {'type': 'Boolean',
                                    'message': 'Include textual description'
                                    },
              'include_analysisid': {'type': 'Boolean',
                                     'message': 'Include VMRay analysis_id text'
                                     },
              'only_network_info': {'type': 'Boolean',
                                    'message': 'Only include network (src-ip, hostname, domain, ...) information'
                                    },
              'sample_id': {'type': 'Integer',
                            'errorMessage': 'Expected a sample ID',
                            'message': 'The VMRay sample_id'
                            }
              }

moduleconfig = ['apikey', 'url']

include_textdescr = False
include_analysisid = False
only_network_info = False


def handler(q=False):
    global include_textdescr
    global include_analysisid
    global only_network_info

    if q is False:
        return False
    request = json.loads(q)

    include_textdescr = request["config"].get("include_textdescr")
    include_analysisid = request["config"].get("include_analysisid")
    only_network_info = request["config"].get("only_network_info")
    if include_textdescr == "1":
        include_textdescr = True
    else:
        include_textdescr = False
    if include_analysisid == "1":
        include_analysisid = True
    else:
        include_analysisid = False
    if only_network_info == "1":
        only_network_info = True
    else:
        only_network_info = False

    sample_id = int(request["config"].get("sample_id"))

    if (request["config"].get("apikey") is None) or (request["config"].get("url") is None):
        misperrors["error"] = "Missing API key or server URL (hint: try cloud.vmray.com)"
        return misperrors

    if sample_id > 0:
        try:
            api = VMRayRESTAPI(request["config"].get("url"), request["config"].get("apikey"), False)
            vmray_results = {'results': []}
            # Get all information on the sample, returns a set of finished analyze jobs
            data = vmrayGetInfoAnalysis(api, sample_id)
            if data["data"]:
                vti_patterns_found = False
                for analysis in data["data"]:
                    analysis_id = analysis["analysis_id"]

                    if analysis_id > 0:
                        # Get the details for an analyze job
                        analysis_data = vmrayDownloadAnalysis(api, analysis_id)

                        if analysis_data:
                            if "analysis_vti_patterns" in analysis_data:
                                p = vmrayVtiPatterns(analysis_data["analysis_vti_patterns"])
                            else:
                                p = vmrayVtiPatterns(analysis_data["vti_patterns"])
                            if p and len(p["results"]) > 0:
                                vti_patterns_found = True
                                vmray_results = {'results': vmray_results["results"] + p["results"]}
                            if include_analysisid:
                                a_id = {'results': []}
                                url1 = "https://cloud.vmray.com/user/analysis/view?from_sample_id=%u" % sample_id
                                url2 = "&id=%u" % analysis_id
                                url3 = "&sub=%2Freport%2Foverview.html"
                                a_id["results"].append({ "values": url1 + url2 + url3, "types": "link" })
{'fraction_non_alphanumeric': 0.10912919608571782, 'fraction_numerical': 0.004211569428960733, 'mean_word_length': 1.7528128196385953, 'pattern_counts': {'":': 10, '<': 5, '<?xml version=': 0, '>': 11, 'https://': 2, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 18, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '363281', 'n_tokens_mistral': 2188, 'n_tokens_neox': 2115, 'n_words': 521}