Skip to content

IPQuery Analyzer, Closes #2707#2719

Merged
mlodic merged 2 commits intointelowlproject:developfrom
basedBaba:feat/ipquery
Feb 20, 2025
Merged

IPQuery Analyzer, Closes #2707#2719
mlodic merged 2 commits intointelowlproject:developfrom
basedBaba:feat/ipquery

Conversation

@basedBaba
Copy link
Contributor

@basedBaba basedBaba commented Feb 7, 2025 •
edited
Loading

Description

IPQuery Analyzer, Closes #2707

Type of change

  • New feature (non-breaking change which adds functionality).

Checklist

  • I have read and understood the rules about how to Contribute to this project
  • The pull request is for the branch develop
  • A new plugin (analyzer, connector, visualizer, playbook, pivot or ingestor) was added or changed, in which case:
    • I strictly followed the documentation "How to create a Plugin"
    • Usage file was updated. A link to the PR to the docs repo has been added as a comment here.
    • Advanced-Usage was updated (in case the plugin provides additional optional configuration). A link to the PR to the docs repo has been added as a comment here.
    • I have dumped the configuration from Django Admin using the dumpplugin command and added it in the project as a data migration. ("How to share a plugin with the community")
    • If a File analyzer was added and it supports a mimetype which is not already supported, you added a sample of that type inside the archive test_files.zip and you added the default tests for that mimetype in test_classes.py.
    • If you created a new analyzer and it is free (does not require any API key), please add it in the FREE_TO_USE_ANALYZERS playbook by following this guide.
    • Check if it could make sense to add that analyzer/connector to other freely available playbooks.
    • I have provided the resulting raw JSON of a finished analysis and a screenshot of the results.
    • If the plugin interacts with an external service, I have created an attribute called precisely url that contains this information. This is required for Health Checks.
    • If the plugin requires mocked testing, _monkeypatch() was used in its class to apply the necessary decorators.
    • I have added that raw JSON sample to the MockUpResponse of the _monkeypatch() method. This serves us to provide a valid sample for testing.
  • If external libraries/packages with restrictive licenses were used, they were added in the Legal Notice section.
  • Linters (Black, Flake, Isort) gave 0 errors. If you have correctly installed pre-commit, it does these checks and adjustments on your behalf.
  • I have added tests for the feature/bug I solved (see tests folder). All the tests (new and old ones) gave 0 errors.
  • If the GUI has been modified:
    • I have a provided a screenshot of the result in the PR.
    • I have created new frontend tests for the new component or updated existing ones.
  • After you had submitted the PR, if DeepSource, Django Doctors or other third-party linters have triggered any alerts during the CI checks, I have solved those alerts.

Important Rules

  • If you miss to compile the Checklist properly, your PR won't be reviewed by the maintainers.
  • Everytime you make changes to the PR and you think the work is done, you should explicitly ask for a review. After being reviewed and received a "change request", you should explicitly ask for a review again once you have made the requested changes.

Raw JSON :-

{
    "id": 1,
    "user": {
        "username": "admin"
    },
    "tags": [],
    "comments": [],
    "pivots_to_execute": [],
    "analyzers_to_execute": [
        "IPQuery"
    ],
    "analyzers_requested": [
        "IPQuery"
    ],
    "connectors_to_execute": [],
    "connectors_requested": [],
    "visualizers_to_execute": [],
    "playbook_requested": null,
    "playbook_to_execute": null,
    "investigation": null,
    "permissions": {
        "kill": true,
        "delete": true,
        "plugin_actions": true
    },
    "analyzers_data_model": [],
    "analyzer_reports": [
        {
            "name": "IPQuery",
            "process_time": 1.54,
            "status": "SUCCESS",
            "end_time": "2025-02-07T11:16:19.355973Z",
            "parameters": {},
            "type": "analyzer",
            "id": 1,
            "report": {
                "ip": "1.1.1.1",
                "isp": {
                    "asn": "AS13335",
                    "isp": "Cloudflare, Inc.",
                    "org": "Cloudflare, Inc."
                },
                "risk": {
                    "is_tor": false,
                    "is_vpn": false,
                    "is_proxy": false,
                    "is_mobile": false,
                    "risk_score": 0,
                    "is_datacenter": true
                },
                "location": {
                    "city": "Sydney",
                    "state": "New South Wales",
                    "country": "Australia",
                    "zipcode": "1001",
                    "latitude": -33.854548400186665,
                    "timezone": "Australia/Sydney",
                    "localtime": "2025-02-07T11:16:19",
                    "longitude": 151.20016200912815,
                    "country_code": "AU"
                }
            },
            "errors": [],
            "start_time": "2025-02-07T11:16:17.812775Z",
            "description": "[IPQuery](https://ipquery.io/) aims to provide a straightforward and simplistic API for working with IP addresses.",
            "data_model": {}
        }
    ],
    "connector_reports": [],
    "pivot_reports": [],
    "visualizer_reports": [],
    "is_sample": false,
    "md5": "e086aa137fa19f67d27b39d0eca18610",
    "observable_name": "1.1.1.1",
    "observable_classification": "ip",
    "file_name": "",
    "file_mimetype": "",
    "status": "reported_without_fails",
    "runtime_configuration": {
        "pivots": {},
        "analyzers": {},
        "connectors": {},
        "visualizers": {}
    },
    "received_request_time": "2025-02-07T11:16:17.531367Z",
    "finished_analysis_time": "2025-02-07T11:16:19.496792Z",
    "process_time": 1.97,
    "tlp": "CLEAR",
    "errors": [],
    "warnings": [],
    "scan_mode": 2,
    "scan_check_time": "1 00:00:00"
}

Screenshot :-

ipquery

@github-actions
Copy link

github-actions bot commented Feb 18, 2025

This pull request has been marked as stale because it has had no activity for 10 days. If you are still working on this, please provide some updates or it will be closed in 5 days.

@github-actions github-actions bot added the stale label Feb 18, 2025
@basedBaba basedBaba marked this pull request as ready for review February 18, 2025 11:44
@github-actions github-actions bot removed the stale label Feb 19, 2025
mlodic
mlodic requested changes Feb 20, 2025
View reviewed changes
Copy link
Member

@mlodic mlodic left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PR in the docs is missing + fix migration numbers

@basedBaba basedBaba mentioned this pull request Feb 20, 2025
Merged
4 tasks
@basedBaba
Copy link
Contributor Author

basedBaba commented Feb 20, 2025

I have adjusted the migration numbers and added a PR in the docs

@basedBaba basedBaba requested a review from mlodic February 20, 2025 15:57
@mlodic mlodic merged commit 64daa28 into intelowlproject:develop Feb 20, 2025
10 checks passed
@basedBaba basedBaba deleted the feat/ipquery branch March 13, 2025 07:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mlodic mlodic Awaiting requested review from mlodic

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@basedBaba @mlodic