bro-downloader.py

import requests
import json 
import time


def main():
    base_url = "https://api.recordedfuture.com/v2"
    
    token = ""
    
    headers = {'X-RFToken': token, "Content-Type": "Application/json", "connection": "keep-alive"}
    
    ip_risk_rules_url = "https://api.recordedfuture.com/v2/ip/riskrules"
    
    ip_risklist = "https://api.recordedfuture.com/v2/ip/risklist?format=csv%2Fsplunk&gzip=false&list="
    
    list_of_ip_risk_lists = Get_IP_Risk_Lists(ip_risk_rules_url,headers)
    
    timestamp = Get_Timestamp()
    
    intel_file_name = "recorded_future_ip_list-" + str(timestamp) + ".intel"
    
    intel_file_line1 = "#fields\tindicator\tindicator_type\tmeta.source\tmeta.do_notice\n"
    
    csv_url = "https://api.recordedfuture.com/v2/ip/risklist?gzip=false&list="
    
    with open(intel_file_name, 'w') as intelfile:
        intelfile.write(intel_file_line1) 
        for ip_risk in list_of_ip_risk_lists:
            download_url = csv_url + ip_risk
            print("Downloading " + ip_risk + " from " + download_url + "...")
            csv_data = requests.get(download_url, headers=headers, stream = True)
            list_of_actors = csv_data.text.split("\n")
            print("Writing " + ip_risk + " to file...")
            for line in list_of_actors:
                if "Name" in line:
                    pass
                elif len(line.split(',')[0]) == 0:
                    pass
                elif "error" in line:
                    pass
                else:
                    intelfile.write(line.split(',')[0].strip('"') + "\t" + "Intel::ADDR" + "\t" + "rec-future" + "\t" + "T" + "\n")
        intelfile.close()
        

def Get_Timestamp():
    day = time.strftime("%Y%m%d_")
    clock = time.strftime("%I%M%S")
    timestamp = day+clock
    return timestamp

def Get_IP_Risk_Lists(ip_risk_rules_url,headers):
    list_of_ip_risk_lists = []
    ip_risk_lists = requests.get(ip_risk_rules_url, headers=headers)
    json_ip_risk_lists = json.loads(ip_risk_lists.content.decode('utf-8'))
    for ip_risk in json_ip_risk_lists['data']['results']:
        list_of_ip_risk_lists.append(ip_risk['name'])
    return list_of_ip_risk_lists

if __name__ == "__main__":
    main()