threat_crowd_add_domain.py

def add_domain_lookup(domain):
    # Add the nodes

    domain_maker = modules.DomainTC()
    hash_maker = modules.Hashes_TC()
    email = modules.EmailTC()
    sub_domain = modules.Sub_DomainTC()
    ip_address = modules.IP_addressTC()

    # add the relationships

    domain_to_hash = modules.Domains_Hashes_Relationship()
    domain_to_sub_domain = modules.Domain_Sub_domain_Relationship()
    domain_to_email = modules.Email_Domain_TC_Relationship()
    domain_to_ip = modules.Domain_to_IP_address()

    # add the domain
    domain_maker.create_or_update(key=domain)

    # Do the look up
    data = get_TC_domain(domain)

    if data:

        if data['emails']:
            for email_address in data['emails']:

                email.create_or_update(email_address)
                domain_to_email.make_relationship(to_node=domain, from_node=email_address)

        if data['resolutions']:
            for resolve in data['resolutions']:

                resolved = {}

                resolved['last_resolved']= resolve['last_resolved']

                ip_address.create_or_update(key=resolve['ip_address'], data=resolved)

                domain_to_ip.make_relationship(from_node=domain, to_node=resolve['ip_address'])

        if data['hashes']:
            for hashes in data['hashes']:
                hash_maker.create_or_update(key=hashes)
                domain_to_hash.make_relationship(from_node=domain, to_node=hashes)

        if data['subdomains']:
            for subdomains in data['subdomains']:
                sub_domain.create_or_update(key=subdomains)
                domain_to_sub_domain.make_relationship(from_node=domain, to_node=subdomains)
    else:
        pass