Skip to content

Commit 4137787

Browse files
nusantara-selfnusantara-self
committed
Merge branch 'release/3.5.18'
2 parents 07b4107 + df974eb commit 4137787

File tree

10 files changed

+226
-73
lines changed

10 files changed

+226
-73
lines changed

‎CHANGELOG.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,13 @@
11
# Changelog
22

3+
## [3.5.17](https://github.com/TheHive-Project/Cortex-Analyzers/tree/3.5.17) (2025-06-13)
4+
5+
[Full Changelog](https://github.com/TheHive-Project/Cortex-Analyzers/compare/3.5.16...3.5.17)
6+
7+
**Merged pull requests:**
8+
9+
- Added the n8n responder [\#1359](https://github.com/TheHive-Project/Cortex-Analyzers/pull/1359) ([elohim666](https://github.com/elohim666))
10+
311
## [3.5.16](https://github.com/TheHive-Project/Cortex-Analyzers/tree/3.5.16) (2025-06-06)
412

513
[Full Changelog](https://github.com/TheHive-Project/Cortex-Analyzers/compare/3.5.15...3.5.16)

‎analyzers/BitcoinAbuse/BitcoinAbuse.json‎

Lines changed: 0 additions & 20 deletions
This file was deleted.

‎analyzers/BitcoinAbuse/BitcoinAbuse.py‎

Lines changed: 0 additions & 53 deletions
This file was deleted.

‎analyzers/ChainAbuse/ChainAbuse.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"name": "ChainAbuse",
3+
"version": "1.1",
4+
"author": "Peter Juhas; Fabien Bloume, StrangeBee",
5+
"url": "https://github.com/pjuhas/Cortex-Analyzers",
6+
"license": "AGPL-V3",
7+
"description": "Check crypto address against reported abuse cases on ChainAbuse",
8+
"dataTypeList": [
9+
"crypto_address",
10+
"btc_address"
11+
],
12+
"baseConfig": "ChainAbuse",
13+
"configurationItems": [
14+
{
15+
"name": "key",
16+
"description": "API key for ChainAbuse",
17+
"type": "string",
18+
"multi": false,
19+
"required": true
20+
}
21+
],
22+
"command": "ChainAbuse/ChainAbuse.py",
23+
"registration_required": true,
24+
"subscription_required": false,
25+
"service_homepage": "https://www.chainabuse.com/",
26+
"service_logo": {
27+
"path": "assets/chainabuse-logo.png",
28+
"caption": "logo"
29+
},
30+
"screenshots": [
31+
{
32+
"path": "assets/chainabuse-long-report.png",
33+
"caption": "ChainAbuse: long report"
34+
}
35+
]
36+
}

‎analyzers/ChainAbuse/ChainAbuse.py‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
#!/usr/bin/env python3
2+
# encoding: utf-8
3+
4+
import requests
5+
from cortexutils.analyzer import Analyzer
6+
7+
8+
class ChainAbuse(Analyzer):
9+
10+
def __init__(self):
11+
Analyzer.__init__(self)
12+
self.key = self.get_param('config.key', None, 'Missing ChainAbuse API key')
13+
14+
def summary(self, raw):
15+
color = 0
16+
taxonomies = []
17+
level = 'info'
18+
namespace = 'ChainAbuse'
19+
predicate = 'Report count'
20+
value = "0"
21+
count = raw.get("count") or raw.get("total") \
22+
or len(raw.get("data", []))
23+
24+
value = str(count)
25+
color = count
26+
27+
if color == 0:
28+
level = "safe"
29+
elif color < 5:
30+
level = "suspicious"
31+
elif color > 4:
32+
level = "malicious"
33+
34+
taxonomies.append(self.build_taxonomy(level, namespace, predicate, value))
35+
return {'taxonomies': taxonomies}
36+
37+
def run(self):
38+
Analyzer.run(self)
39+
try:
40+
data = self.get_data()
41+
s = requests.Session()
42+
url = "https://api.chainabuse.com/v0/reports"
43+
headers = {
44+
"accept": "application/json"
45+
}
46+
params = {
47+
"address": data
48+
}
49+
# ChainAbuse uses HTTP Basic Auth where the API-key is passed as both user & password
50+
response_details = s.get(
51+
url,
52+
params=params,
53+
auth=(self.key, self.key),
54+
headers=headers,
55+
timeout=30
56+
)
57+
if response_details.status_code == 200:
58+
try:
59+
result = response_details.json()
60+
if isinstance(result, list):
61+
print("Warning: Got a list, not an object. Raw output:", result)
62+
result = {"data": result, "count": len(result)}
63+
except Exception as e:
64+
return self.error(f"Could not decode JSON: {str(e)}")
65+
self.report(result if len(result) > 0 else {})
66+
else:
67+
self.error(f'Failed to query ChainAbuse details. Status_code {response_details.status_code}, content: {response_details.text}')
68+
except Exception as e:
69+
self.error(f'Unexpected error: {str(e)}')
70+
71+
72+
if __name__ == '__main__':
73+
ChainAbuse().run()

‎analyzers/ChainAbuse/assets/chainabuse-logo.png‎

4.82 KB
Loading

‎analyzers/ChainAbuse/assets/chainabuse-long-report.png‎

177 KB
Loading

‎analyzers/BitcoinAbuse/requirements.txt‎ renamed to ‎analyzers/ChainAbuse/requirements.txt‎

File renamed without changes.

‎thehive-templates/ChainAbuse_1_1/long.html‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
<!-- Success -->
2+
<div class="panel panel-default" ng-if="success">
3+
<div class="panel-heading">
4+
<i class="fa fa-link text-primary"></i>
5+
ChainAbuse Report<span ng-if="content && content.data && content.data.length">s</span>
6+
<span class="badge bg-primary" style="margin-left:10px;" ng-if="content && content.data && content.data.length">{{content.count || (content.data && content.data.length)}}</span>
7+
</div>
8+
<div class="panel-body" ng-if="content && content.data && content.data.length">
9+
<div class="alert alert-info" ng-if="!content.data || !content.data.length">
10+
<i class="fa fa-info-circle"></i> No reports found.
11+
</div>
12+
13+
<div class="panel-group" id="chainAbuseAccordion">
14+
<div class="panel panel-info" ng-repeat="report in content.data">
15+
<div class="panel-heading" style="cursor:pointer;" data-toggle="collapse" data-parent="#chainAbuseAccordion" data-target="#report{{$index}}">
16+
<span class="fa-stack" style="vertical-align: middle;">
17+
<i class="fa fa-circle fa-stack-2x text-info"></i>
18+
<i class="fa fa-warning fa-stack-1x fa-inverse"></i>
19+
</span>
20+
<strong>Scam Category:</strong> <span class="label label-warning" style="margin-right:10px;">{{report.scamCategory}}</span>
21+
<small class="text-muted">Reported <i class="fa fa-clock-o"></i> {{report.createdAt | date:'yyyy-MM-dd HH:mm:ss'}}</small>
22+
<span ng-if="report.trusted" class="label label-success" style="margin-left:10px;"><i class="fa fa-check"></i> Trusted</span>
23+
<a class="btn btn-xs btn-primary pull-right" style="margin-left:10px;" title="Open ChainAbuse Report"
24+
href="https://www.chainabuse.com/report/{{report.id}}" target="_blank" rel="noopener noreferrer">
25+
<i class="fa fa-external-link"></i> View on ChainAbuse
26+
</a>
27+
</div>
28+
<div id="report{{$index}}" class="panel-collapse collapse" ng-class="{'in': $first}">
29+
<div class="panel-body">
30+
<dl class="dl-horizontal">
31+
<dt><i class="fa fa-tags"></i> Scam Category</dt>
32+
<dd>{{report.scamCategory}}</dd>
33+
<dt><i class="fa fa-calendar"></i> Date</dt>
34+
<dd>{{report.createdAt | date:'yyyy-MM-dd HH:mm:ss'}}</dd>
35+
<dt><i class="fa fa-shield"></i> Trusted Source</dt>
36+
<dd>
37+
<span ng-if="report.trusted" class="label label-success"><i class="fa fa-check"></i> Yes</span>
38+
<span ng-if="!report.trusted" class="label label-default"><i class="fa fa-minus-circle"></i> No</span>
39+
</dd>
40+
<dt><i class="fa fa-link"></i> Report Link</dt>
41+
<dd>
42+
<a href="https://www.chainabuse.com/report/{{report.id}}" target="_blank" rel="noopener noreferrer">
43+
https://www.chainabuse.com/report/{{report.id}}
44+
<i class="fa fa-external-link"></i>
45+
</a>
46+
</dd>
47+
</dl>
48+
<div ng-if="report.addresses && report.addresses.length">
49+
<strong>Reported Addresses / Domains:</strong>
50+
<ul class="list-group" style="margin-top:10px;">
51+
<li class="list-group-item" ng-repeat="addr in report.addresses">
52+
<span ng-if="addr.address">
53+
<i class="fa fa-chain text-primary"></i>
54+
<strong>{{addr.address}}</strong>
55+
<span ng-if="addr.chain" class="label label-info" style="margin-left:5px;">{{addr.chain}}</span>
56+
</span>
57+
<span ng-if="addr.domain">
58+
<i class="fa fa-globe text-success"></i>
59+
<a href="{{addr.domain}}" target="_blank" rel="noopener noreferrer">{{addr.domain}}</a>
60+
</span>
61+
</li>
62+
</ul>
63+
</div>
64+
<div ng-if="report.checked !== null">
65+
<hr>
66+
<strong>Checked:</strong>
67+
<span ng-if="report.checked" class="label label-success"><i class="fa fa-check"></i> Yes</span>
68+
<span ng-if="!report.checked" class="label label-default"><i class="fa fa-minus"></i> No</span>
69+
</div>
70+
<div ng-if="report.additionalInfo">
71+
<hr>
72+
<pre class="bg-light" style="padding:10px;">{{report.additionalInfo}}</pre>
73+
</div>
74+
<div ng-if="report.references && report.references.length">
75+
<hr>
76+
<strong>References:</strong>
77+
<ul>
78+
<li ng-repeat="ref in report.references">
79+
<a ng-href="{{ref}}" target="_blank" rel="noopener noreferrer">{{ref}}</a>
80+
</li>
81+
</ul>
82+
</div>
83+
</div>
84+
</div>
85+
</div>
86+
</div>
87+
</div>
88+
<div class="panel-body" ng-if="!content.data || !content.data.length">
89+
<div class="alert alert-info">
90+
<i class="fa fa-info-circle"></i> No ChainAbuse reports found for this observable.
91+
</div>
92+
</div>
93+
</div>
94+
95+
<!-- General error -->
96+
<div class="panel panel-danger" ng-if="!success">
97+
<div class="panel-heading">
98+
<strong>{{(artifact.data || artifact.attachment.name) | fang}}</strong>
99+
</div>
100+
<div class="panel-body">
101+
<dl class="dl-horizontal" ng-if="content.errorMessage">
102+
<dt><i class="fa fa-warning"></i> ChainAbuse: </dt>
103+
<dd class="wrap">{{content.errorMessage}}</dd>
104+
</dl>
105+
</div>
106+
</div>

‎thehive-templates/ChainAbuse_1_1/short.html‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
<span class="label" ng-repeat="t in content.taxonomies" ng-class="{'info': 'label-info', 'safe': 'label-success', 'suspicious': 'label-warning', 'malicious':'label-danger'}[t.level]">
2+
{{t.namespace}}:{{t.predicate}}="{{t.value}}"
3+
</span>

0 commit comments

Comments
 (0)