21
21
)
22
22
23
23
def attach_resp_to_event (event , data ):
24
- event ["ip_range_score " ] = data ["ip_range_score" ]
25
- event ["ip " ] = data ["ip" ]
26
- event ["ip_range " ] = data ["ip_range" ]
27
- event ["as_name " ] = data ["as_name" ]
28
- event ["as_num " ] = data ["as_num" ]
24
+ event ["crowdsec_ip_range_score " ] = data ["ip_range_score" ]
25
+ event ["crowdsec_ip " ] = data ["ip" ]
26
+ event ["crowdsec_ip_range " ] = data ["ip_range" ]
27
+ event ["crowdsec_as_name " ] = data ["as_name" ]
28
+ event ["crowdsec_as_num " ] = data ["as_num" ]
29
29
30
- event ["country " ] = data ["location" ]["country" ]
31
- event ["city " ] = data ["location" ]["city" ]
32
- event ["latitude " ] = data ["location" ]["latitude" ]
33
- event ["longitude " ] = data ["location" ]["longitude" ]
34
- event ["reverse_dns " ] = data ["reverse_dns" ]
30
+ event ["crowdsec_country " ] = data ["location" ]["country" ]
31
+ event ["crowdsec_city " ] = data ["location" ]["city" ]
32
+ event ["crowdsec_latitude " ] = data ["location" ]["latitude" ]
33
+ event ["crowdsec_longitude " ] = data ["location" ]["longitude" ]
34
+ event ["crowdsec_reverse_dns " ] = data ["reverse_dns" ]
35
35
36
- event ["behaviors " ] = data ["behaviors" ]
36
+ event ["crowdsec_behaviors " ] = data ["behaviors" ]
37
37
38
- event ["first_seen " ] = data ["history" ]["first_seen" ]
39
- event ["last_seen " ] = data ["history" ]["last_seen" ]
40
- event ["full_age " ] = data ["history" ]["full_age" ]
41
- event ["days_age " ] = data ["history" ]["days_age" ]
38
+ event ["crowdsec_first_seen " ] = data ["history" ]["first_seen" ]
39
+ event ["crowdsec_last_seen " ] = data ["history" ]["last_seen" ]
40
+ event ["crowdsec_full_age " ] = data ["history" ]["full_age" ]
41
+ event ["crowdsec_days_age " ] = data ["history" ]["days_age" ]
42
42
43
- event ["false_positives " ] = data ["classifications" ]["false_positives" ]
44
- event ["classifications " ] = data ["classifications" ]["classifications" ]
43
+ event ["crowdsec_false_positives " ] = data ["classifications" ]["false_positives" ]
44
+ event ["crowdsec_classifications " ] = data ["classifications" ]["classifications" ]
45
45
46
46
# attack_details
47
- event ["attack_details " ] = data ["attack_details" ]
47
+ event ["crowdsec_attack_details " ] = data ["attack_details" ]
48
48
49
49
# target_countries
50
- event ["target_countries " ] = data ["target_countries" ]
50
+ event ["crowdsec_target_countries " ] = data ["target_countries" ]
51
51
52
52
# background_noise_score
53
- event ["background_noise_score " ] = data ["background_noise_score" ]
53
+ event ["crowdsec_background_noise_score " ] = data ["background_noise_score" ]
54
54
55
55
# overall
56
- event ["overall_aggresiveness " ] = data ["scores" ]["overall" ]["aggressiveness" ]
57
- event ["overall_threat " ] = data ["scores" ]["overall" ]["threat" ]
58
- event ["overall_trust " ] = data ["scores" ]["overall" ]["trust" ]
59
- event ["overall_anomaly " ] = data ["scores" ]["overall" ]["anomaly" ]
60
- event ["overall_total " ] = data ["scores" ]["overall" ]["total" ]
56
+ event ["crowdsec_overall_aggresiveness " ] = data ["scores" ]["overall" ]["aggressiveness" ]
57
+ event ["crowdsec_overall_threat " ] = data ["scores" ]["overall" ]["threat" ]
58
+ event ["crowdsec_overall_trust " ] = data ["scores" ]["overall" ]["trust" ]
59
+ event ["crowdsec_overall_anomaly " ] = data ["scores" ]["overall" ]["anomaly" ]
60
+ event ["crowdsec_overall_total " ] = data ["scores" ]["overall" ]["total" ]
61
61
62
62
# last_day
63
- event ["last_day_aggresiveness " ] = data ["scores" ]["last_day" ]["aggressiveness" ]
64
- event ["last_day_threat " ] = data ["scores" ]["last_day" ]["threat" ]
65
- event ["last_day_trust " ] = data ["scores" ]["last_day" ]["trust" ]
66
- event ["last_day_anomaly " ] = data ["scores" ]["last_day" ]["anomaly" ]
67
- event ["last_day_total " ] = data ["scores" ]["last_day" ]["total" ]
63
+ event ["crowdsec_last_day_aggresiveness " ] = data ["scores" ]["last_day" ]["aggressiveness" ]
64
+ event ["crowdsec_last_day_threat " ] = data ["scores" ]["last_day" ]["threat" ]
65
+ event ["crowdsec_last_day_trust " ] = data ["scores" ]["last_day" ]["trust" ]
66
+ event ["crowdsec_last_day_anomaly " ] = data ["scores" ]["last_day" ]["anomaly" ]
67
+ event ["crowdsec_last_day_total " ] = data ["scores" ]["last_day" ]["total" ]
68
68
69
69
# last_week
70
- event ["last_week_aggressiveness " ] = data ["scores" ]["last_week" ]["aggressiveness" ]
71
- event ["last_week_threat " ] = data ["scores" ]["last_week" ]["threat" ]
72
- event ["last_week_trust " ] = data ["scores" ]["last_week" ]["trust" ]
73
- event ["last_week_anomaly " ] = data ["scores" ]["last_week" ]["anomaly" ]
74
- event ["last_week_total " ] = data ["scores" ]["last_week" ]["total" ]
70
+ event ["crowdsec_last_week_aggressiveness " ] = data ["scores" ]["last_week" ]["aggressiveness" ]
71
+ event ["crowdsec_last_week_threat " ] = data ["scores" ]["last_week" ]["threat" ]
72
+ event ["crowdsec_last_week_trust " ] = data ["scores" ]["last_week" ]["trust" ]
73
+ event ["crowdsec_last_week_anomaly " ] = data ["scores" ]["last_week" ]["anomaly" ]
74
+ event ["crowdsec_last_week_total " ] = data ["scores" ]["last_week" ]["total" ]
75
75
76
76
# last_month
77
- event ["last_month_aggressiveness " ] = data ["scores" ]["last_month" ][
77
+ event ["crowdsec_last_month_aggressiveness " ] = data ["scores" ]["last_month" ][
78
78
"aggressiveness"
79
79
]
80
- event ["last_month_threat " ] = data ["scores" ]["last_month" ]["threat" ]
81
- event ["last_month_trust " ] = data ["scores" ]["last_month" ]["trust" ]
82
- event ["last_month_anomaly " ] = data ["scores" ]["last_month" ]["anomaly" ]
83
- event ["last_month_total " ] = data ["scores" ]["last_month" ]["total" ]
80
+ event ["crowdsec_last_month_threat " ] = data ["scores" ]["last_month" ]["threat" ]
81
+ event ["crowdsec_last_month_trust " ] = data ["scores" ]["last_month" ]["trust" ]
82
+ event ["crowdsec_last_month_anomaly " ] = data ["scores" ]["last_month" ]["anomaly" ]
83
+ event ["crowdsec_last_month_total " ] = data ["scores" ]["last_month" ]["total" ]
84
84
# references
85
- event ["references " ] = data ["references" ]
85
+ event ["crowdsec_references " ] = data ["references" ]
86
86
return event
87
87
88
88
@@ -127,13 +127,13 @@ def stream(self, events):
127
127
128
128
for event in events :
129
129
event_dest_ip = event [self .ipfield ]
130
+ event ["crowdsec_error" ] = "None"
130
131
# API required parameters
131
132
params = (
132
133
("ipAddress" , event_dest_ip ),
133
134
("verbose" , "" ),
134
135
)
135
136
# Make API Request
136
- error = 0
137
137
response = req .get (
138
138
f"https://cti.api.crowdsec.net/v2/smoke/{ event_dest_ip } " ,
139
139
headers = headers ,
@@ -143,9 +143,9 @@ def stream(self, events):
143
143
data = response .json ()
144
144
event = attach_resp_to_event (event , data )
145
145
elif response .status_code == 429 :
146
- event ["error " ] = '"Quota exceeded for CrowdSec CTI API. Please visit https://www.crowdsec.net/pricing to upgrade your plan."'
146
+ event ["crowdsec_error " ] = '"Quota exceeded for CrowdSec CTI API. Please visit https://www.crowdsec.net/pricing to upgrade your plan."'
147
147
else :
148
- event ["error " ] = f"Error { response .status_code } : { response .text } "
148
+ event ["crowdsec_error " ] = f"Error { response .status_code } : { response .text } "
149
149
150
150
# Finalize event
151
151
yield event
0 commit comments