Skip to content

Instantly share code, notes, and snippets.

Avatar

Philippe Langlois planglois925

View GitHub Profile
View cwa_parameter_store
{
"logs": {
"logs_collected": {
"windows_events": {
"collect_list": [
{
"event_format": "xml",
"event_levels": [
"INFORMATION",
"WARNING",
View intel-grapher.py
from threatcrowd import utils as tc_utils
import argparse
def main():
parser = argparse.ArgumentParser(description='Tool to take data and insert it into graphdatabase')
parser.add_argument('-d', '--domain', help="Domains to look up", default=None)
parser.add_argument('-e', '--email',help='Emails to look up', default=None)
parser.add_argument('-hx', '--hash', help='Hashes to look up', default=None)
View threat_crowd_add_domain.py
def add_domain_lookup(domain):
# Add the nodes
domain_maker = modules.DomainTC()
hash_maker = modules.Hashes_TC()
email = modules.EmailTC()
sub_domain = modules.Sub_DomainTC()
ip_address = modules.IP_addressTC()
View threat_crowd_modules.py
from core.modules import NodeCreator, RelationshipMaker
from py2neo import Graph
class EmailTC(NodeCreator):
def __init__(self):
NodeCreator.__init__(self)
self.Node_Label = 'Email'
self.Plugin_name = 'ThreatCrowd'
View core.py
from py2neo import Graph, Node, Relationship
class NodeCreator:
def __init__(self):
'''
Start off my creating the graph connection
View usern_name_tester
def user_mention(self, status):
# Once again we create an empty array
results = []
# Here we want to check the user mentions component of the status
# So the first step is to identify if it's empty or not
if status.entities['user_mentions']:
# Multiple users can be mentioned in a tweet,
View domain_test
def domain_test(self,status):
# begin by making an empty array that will store our TRUE/FALSE responses
results = []
# first lets check to see if we got URLs in our Entities object of the status
if status.entities['urls']:
# In a status we'll want to check all the urls that might be there
# so we create a very quick for loop
View user_name_loader
def load_twitter_accounts():
twitter_accounts = []
print "[] Loading twitter accounts (the good ones)"
file_location = os.path.join('data','twitter.txt')
if os.path.isfile(file_location):
with open(file_location) as f:
for account in f.readlines():
View domain_loader
def load_domains():
# start an empty array
domains = []
# A little status information for us
print "[] Loading domains"
# We want our code to platform neutral, so use os.path.join
# to get to our data directory and extract out domains
file_location = os.path.join('data','domains.txt')
View twitter_tut_hit
def twitter_hit(status):
# This is a super simple indicator that we found something,
# and the logic will be built up in the next one
print '[x] Hit found \n'