Cy cat#1479 by g4ze · Pull Request #2328 · intelowlproject/IntelOwl

g4ze · 2024-05-20T11:00:56Z

closes #1479

Description

add cycat

Type of change

Please delete options that are not relevant.

Bug fix (non-breaking change which fixes an issue).
New feature (non-breaking change which adds functionality).
Breaking change (fix or feature that would cause existing functionality to not work as expected).

Checklist

Important Rules

If you miss to compile the Checklist properly, your PR won't be reviewed by the maintainers.
Everytime you make changes to the PR and you think the work is done, you should explicitly ask for a review. After being reviewed and received a "change request", you should explicitly ask for a review again once you have made the requested changes.

{
"description": """Detects Execution via
SyncInvoke in CL_Invocation.ps1 module""",
"raw": """
author: oscd.community, Natalia Shornikova
date: 2020/10/14
description: Detects Execution via
SyncInvoke in CL_Invocation.ps1 module
detection:
condition: selection
selection:
EventID: 4104
ScriptBlockText|contains|all:
- CL_Invocation.ps1
- SyncInvoke
falsepositives:
- Unknown
id: 4cd29327-685a-460e-9dac-c3ab96e549dc
level: high
logsource:
product: windows
service: powershell
modified: 2021/05/21
references:
- https://twitter.com/bohops/status/948061991012327424
status: experimental
tags:
- attack.defense_evasion
- attack.t1216
title: Execution via CL_Invocation.ps1
""",
"sigma:id": "4cd29327-685a-460e-9dac-c3ab96e549dc",
"title": "Execution via CL_Invocation.ps1",
"_cycat_type": "Item",
},

…into CyCat#1479

g4ze · 2024-05-20T11:31:31Z

@mlodic kindly check the wrapper.

mlodic · 2024-05-20T12:23:29Z

lgtm

g4ze · 2024-05-20T12:43:15Z

TLP amber?

…into CyCat#1479

g4ze · 2024-05-20T15:23:15Z

I think we are gtg here.

mlodic · 2024-05-20T15:26:07Z

api_app/analyzers_manager/migrations/0090_analyzer_config_cycat.py

+        "base_path": "api_app.analyzers_manager.observable_analyzers",
+    },
+    "name": "CyCat",
+    "description": "[CyCat](https://cycat.org/)  or the CYbersecurity Resource CATalogue aims at mapping and documenting, in a single formalism and catalogue available cybersecurity tools, rules, playbooks, processes and controls.",


Suggested change

"description": "[CyCat](https://cycat.org/) or the CYbersecurity Resource CATalogue aims at mapping and documenting, in a single formalism and catalogue available cybersecurity tools, rules, playbooks, processes and controls.",

"description": "[CyCat](https://cycat.org/) or the CYbersecurity Resource CATalogue aims at mapping and documenting, in a single formalism and catalogue available cybersecurity tools, rules, playbooks, processes and controls.",

mlodic · 2024-05-20T15:26:47Z

api_app/analyzers_manager/observable_analyzers/cycat.py

+    url: str = "https://api.cycat.org"
+
+    def uuid_lookup(self, uuid: str):
+        logger.info(f"performing lookup on uuid: {uuid}")


adding the observable name in this log can help future debugging

mlodic · 2024-05-20T15:31:25Z

api_app/analyzers_manager/observable_analyzers/cycat.py

+                    "requests.get",
+                    return_value=MockUpResponse(
+                        [
+                            "24bfaeba-cb0d-4525-b3dc-507c77ecec41",


I am not sure this is the expected response. I would have expected data, like the one here: https://cycat.org/services/#fetch-item-by-uuid

UUID are useless as an output so I would have expected to get the data for the UUID. Your analyzer seems right to me so I don't understand why you get this result. can you please try again?

yes sure, makes sense.

* updated yeti analyzer and connector to support new major * updated default pycti version * fixed MaxMind data extraction for the country flag * Fix pivot + file Signed-off-by: 0ssigeno <[email protected]> * healthcheck available for Plugins with `url` option by default (#2320) * healthcheck available for Plugins with `url` option * doc * fix * Bump quark-engine from 24.4.1 to 24.5.1 in /requirements (#2313) Bumps [quark-engine](https://github.com/quark-engine/quark-engine) from 24.4.1 to 24.5.1. - [Release notes](https://github.com/quark-engine/quark-engine/releases) - [Commits](ev-flow/quark-engine@v24.4.1...v24.5.1) --- updated-dependencies: - dependency-name: quark-engine dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump jsonschema from 4.21.1 to 4.22.0 in /requirements (#2311) Bumps [jsonschema](https://github.com/python-jsonschema/jsonschema) from 4.21.1 to 4.22.0. - [Release notes](https://github.com/python-jsonschema/jsonschema/releases) - [Changelog](https://github.com/python-jsonschema/jsonschema/blob/main/CHANGELOG.rst) - [Commits](python-jsonschema/jsonschema@v4.21.1...v4.22.0) --- updated-dependencies: - dependency-name: jsonschema dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump docutils from 0.20.1 to 0.21.2 in /requirements (#2312) Bumps [docutils](https://docutils.sourceforge.io) from 0.20.1 to 0.21.2. --- updated-dependencies: - dependency-name: docutils dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Revert "Bump docutils from 0.20.1 to 0.21.2 in /requirements (#2312)" This reverts commit 9e5106e. * prettier * changes (#2322) * Phoneinfoga analyzer adjustment (#2324) * Phoneinfoga Signed-off-by: 0ssigeno <[email protected]> * Linters Signed-off-by: 0ssigeno <[email protected]> * adjusted phoneinfoga * Update api_app/analyzers_manager/migrations/0088_phoneinfoga_parameters.py --------- Signed-off-by: 0ssigeno <[email protected]> Co-authored-by: Matteo Lodi <[email protected]> * Fix serializer Signed-off-by: 0ssigeno <[email protected]> * Fix sender Signed-off-by: 0ssigeno <[email protected]> * pcap_analyzers adjusts + new playbook for PCAP files + upgraded Suricata to v7 (#2325) * pcap_analyzers adjusts + new playbook for PCAP files + upgraded Suricata to v7 * adjusted hfinger * adjust test * adjust test and upgraded watchman * tests * fix custom analysis (#2323) * hudsonrock (#2327) * hudsonrock * tests * test * add params * migration * tests * migration * i always overlook this lol * tlp to amber --------- Co-authored-by: g4ze <[email protected]> * Update api_app/analyzers_manager/observable_analyzers/hudsonrock.py Co-authored-by: code-review-doctor[bot] <72320148+code-review-doctor[bot]@users.noreply.github.com> * black * Fixes frontend regex (#2329) * support phone numbers * moved phone number validation to E.164 format * removed dates from parsing as IP addresses * prettier * Cy cat#1479 (#2328) * cycat * cycat * cycat wrapper done * migration * docs * tests * tests --------- Co-authored-by: g4ze <[email protected]> * updated changelog * fix loading visualizer navbar (#2335) * fix visualizer loading * changes * --- (#2332) updated-dependencies: - dependency-name: celery[redis,sqs] dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * --- (#2334) updated-dependencies: - dependency-name: intezer-sdk dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * --- (#2333) updated-dependencies: - dependency-name: docutils dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Speed up (#2336) Signed-off-by: 0ssigeno <[email protected]> * Revert "--- (#2333)" This reverts commit 12802eb. --------- Signed-off-by: 0ssigeno <[email protected]> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: Daniele Rosetti <[email protected]> Co-authored-by: 0ssigeno <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Martina Carella <[email protected]> Co-authored-by: Simone Berni <[email protected]> Co-authored-by: Nilay Gupta <[email protected]> Co-authored-by: g4ze <[email protected]> Co-authored-by: code-review-doctor[bot] <72320148+code-review-doctor[bot]@users.noreply.github.com> Co-authored-by: Daniele Rosetti <[email protected]>

g4ze added 4 commits May 18, 2024 06:58

cycat

958941f

cycat

7a9a84a

Merge branch 'develop' of https://github.com/intelowlproject/IntelOwl …

920964b

…into CyCat#1479

cycat wrapper done

8b503b9

g4ze added 3 commits May 20, 2024 20:25

Merge branch 'develop' of https://github.com/intelowlproject/IntelOwl …

d0e5a42

…into CyCat#1479

migration

9469c61

docs

a0fa1ad

g4ze requested a review from mlodic May 20, 2024 15:24

mlodic requested changes May 20, 2024

View reviewed changes

g4ze added 2 commits May 20, 2024 21:37

tests

1f4c10e

tests

9548a80

g4ze requested a review from mlodic May 20, 2024 16:20

mlodic approved these changes May 20, 2024

View reviewed changes

mlodic merged commit db6eb02 into intelowlproject:develop May 20, 2024

g4ze linked an issue Jun 26, 2024 that may be closed by this pull request

[Analyzer]CyCat #1479

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Cy cat#1479#2328

Cy cat#1479#2328
mlodic merged 9 commits intointelowlproject:developfrom
g4ze:CyCat#1479

g4ze commented May 20, 2024 •

edited

Loading

Uh oh!

g4ze commented May 20, 2024

Uh oh!

mlodic commented May 20, 2024

Uh oh!

g4ze commented May 20, 2024

Uh oh!

g4ze commented May 20, 2024

Uh oh!

mlodic May 20, 2024

Uh oh!

mlodic May 20, 2024

Uh oh!

mlodic May 20, 2024

Uh oh!

mlodic May 20, 2024

Uh oh!

g4ze May 20, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	"description": "[CyCat](https://cycat.org/) or the CYbersecurity Resource CATalogue aims at mapping and documenting, in a single formalism and catalogue available cybersecurity tools, rules, playbooks, processes and controls.",
	"description": "[CyCat](https://cycat.org/) or the CYbersecurity Resource CATalogue aims at mapping and documenting, in a single formalism and catalogue available cybersecurity tools, rules, playbooks, processes and controls.",

Uh oh!

Conversation

g4ze commented May 20, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Type of change

Checklist

Important Rules

Uh oh!

g4ze commented May 20, 2024

Uh oh!

mlodic commented May 20, 2024

Uh oh!

g4ze commented May 20, 2024

Uh oh!

g4ze commented May 20, 2024

Uh oh!

mlodic May 20, 2024

Choose a reason for hiding this comment

Uh oh!

mlodic May 20, 2024

Choose a reason for hiding this comment

Uh oh!

mlodic May 20, 2024

Choose a reason for hiding this comment

Uh oh!

mlodic May 20, 2024

Choose a reason for hiding this comment

Uh oh!

g4ze May 20, 2024

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

g4ze commented May 20, 2024 •

edited

Loading