gistfile1.py

#! /usr/bin/env python

# Convert abuse.ch SSL Fingerprint Blacklist in CVS format to format ingestible by
# the Bro intelligence framework.
#
# Get the blacklist at https://sslbl.abuse.ch/blacklist/, get bro at https://bro.org
#
# Usage:
# ./sslbl.py > sslbl.txt
#
# In your site/local.bro add:
# @load policy/frameworks/intel/seen
# @load policy/frameworks/intel/seen/file-hashes
# redef Intel::read_files += { "/pathto/sslbl.txt" };


import urllib

f = urllib.urlopen("https://sslbl.abuse.ch/blacklist/sslblacklist.csv")

print '#fields\tindicator\tindicator_type\tmeta.sourcet\tmeta.desc\tmeta.url'
for l in f.readlines():
    # lines starting with # are comments
    if not l.startswith('#'):
        (ts, hash, reason) = l.split(',')
        print '\t'.join([hash, 'Intel::FILE_HASH', 'abuse.ch SSLBL', reason, 'https://sslbl.abuse.ch/blacklist/'])