diff --git a/fn_useragentanalysis/MANIFEST.in b/fn_useragentanalysis/MANIFEST.in new file mode 100644 index 000000000..74fda543b --- /dev/null +++ b/fn_useragentanalysis/MANIFEST.in @@ -0,0 +1,4 @@ +include README.md +include fn_useragentanalysis/util/* +include fn_useragentanalysis/LICENSE +include fn_useragentanalysis/doc/* \ No newline at end of file diff --git a/fn_useragentanalysis/README.md b/fn_useragentanalysis/README.md new file mode 100644 index 000000000..09997c938 --- /dev/null +++ b/fn_useragentanalysis/README.md @@ -0,0 +1,82 @@ +# User Agent Analysis +User agent analysis allows for the data enrichment on user agent strings found in web and firewall logs. These entries can provide clues as to potential attempted malicious access and what follow on steps are needed to restrict access. + +If you do not already have an account at WhatIsMyBrowser, you can complete those steps here: `https://developers.whatismybrowser.com/api/pricing/`. + +Sample workflows and rules are provided demonstrating the execution of the function by placing the resulting payload into a note. +Your use of the function may require parsing of the result json. Here's a sample result: + +``` +{ + "parse": { + "user_agent": "\"user_agent\": \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36\"", + "software_name": "Chrome", + "operating_system": "Mac OS X (Mavericks)", + "software_version": "64", + "operating_system_name": "Mac OS X", + "operating_system_version_full": [ + "10", + "9", + "5" + ], + "software_name_code": "chrome", + "simple_operating_platform_string": null, + "operating_system_version": "Mavericks", + "simple_sub_description_string": null, + "is_abusive": false, + "operating_system_flavour_code": null, + "software_version_full": [ + "64", + "0", + "3282", + "140" + ], + "simple_software_string": "Chrome 64 on Mac OS X (Mavericks)", + "operating_system_flavour": null, + "operating_system_name_code": "mac-os-x", + "software": "Chrome 64" + }, + "result": { + "message": "The user agent was parsed successfully.", + "code": "success", + "message_code": "user_agent_parsed" + } +} +``` + +##Updates for config file +``` +[fn_useragentanalysis] +url=WHAT_IS_MY_BROWSER_API_URL +api_key=WHAT_IS_MY_BROWSER_API_KEY +``` + + +##Installation +To install in "development mode" + + pip install -e ./fn_useragentanalysis/ + +After installation, the package will be loaded by `resilient-circuits run`. + + +To uninstall, + + pip uninstall fn_useragentanalysis + + +To package for distribution, + + python ./fn_useragentanalysis/setup.py sdist + +The resulting .tar.gz file can be installed using + + pip install fn_useragentanalysis-.tar.gz + +##Reference +This template project was generated by + + resilient-circuits codegen -p fn_useragentanalysis [-f fn_useragentanalysis] [-w user_agent_workflow] [--rule "Example: User Agent Analysis"] + + + diff --git a/fn_useragentanalysis/fn_useragentanalysis/LICENSE b/fn_useragentanalysis/fn_useragentanalysis/LICENSE new file mode 100644 index 000000000..365b4bb06 --- /dev/null +++ b/fn_useragentanalysis/fn_useragentanalysis/LICENSE @@ -0,0 +1,19 @@ +Copyright © IBM Corporation 2010, 2018 + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to +deal in the Software without restriction, including without limitation the +rights to use, copy, modify, merge, publish, distribute, sublicense, and/or +sell copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in +all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING +FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS +IN THE SOFTWARE. \ No newline at end of file diff --git a/fn_useragentanalysis/fn_useragentanalysis/__init__.py b/fn_useragentanalysis/fn_useragentanalysis/__init__.py new file mode 100644 index 000000000..2159b888b --- /dev/null +++ b/fn_useragentanalysis/fn_useragentanalysis/__init__.py @@ -0,0 +1,5 @@ +import pkg_resources +try: + __version__ = pkg_resources.get_distribution(__name__).version +except pkg_resources.DistributionNotFound: + pass \ No newline at end of file diff --git a/fn_useragentanalysis/fn_useragentanalysis/components/__init__.py b/fn_useragentanalysis/fn_useragentanalysis/components/__init__.py new file mode 100644 index 000000000..4287ca861 --- /dev/null +++ b/fn_useragentanalysis/fn_useragentanalysis/components/__init__.py @@ -0,0 +1 @@ +# \ No newline at end of file diff --git a/fn_useragentanalysis/fn_useragentanalysis/components/func_useragentanalysis.py b/fn_useragentanalysis/fn_useragentanalysis/components/func_useragentanalysis.py new file mode 100644 index 000000000..1e4c317a2 --- /dev/null +++ b/fn_useragentanalysis/fn_useragentanalysis/components/func_useragentanalysis.py @@ -0,0 +1,64 @@ +# -*- coding: utf-8 -*- +# pragma pylint: disable=unused-argument, no-self-use +"""Function implementation""" + +import logging +import requests +from resilient_circuits import ResilientComponent, function, handler, StatusMessage, FunctionResult, FunctionError +import fn_useragentanalysis.util.selftest as selftest + + +class FunctionComponent(ResilientComponent): + """Component that implements Resilient function 'fn_useragentanalysis""" + + def __init__(self, opts): + """constructor provides access to the configuration options""" + super(FunctionComponent, self).__init__(opts) + self.options = opts.get("fn_useragentanalysis", {}) + selftest.selftest_function(opts) + + @handler("reload") + def _reload(self, event, opts): + """Configuration options have changed, save new values""" + self.options = opts.get("fn_useragentanalysis", {}) + + @function("fn_useragentanalysis") + def _fn_useragentanalysis_function(self, event, *args, **kwargs): + """Function: As a SOC analysis, I want to perform data enrichment on user agent strings found in web and firewall logs. These entries can provide clues as to potential attempted malicious access and what follow on steps are needed to restrict access. + +An integration function is required, sending an artifact string of user agent infromation to a user agent analysis website, returning detailed information as an incident note. An example workflow and rule to execute the function will be included in the packaging.""" + try: + # Get the function parameters: + user_agent_string = kwargs.get("user_agent_string") # text + + log = logging.getLogger(__name__) + log.info("user_agent_string: %s", user_agent_string) + + url = self.options.get('url', None) + api_key = self.options.get('api_key', None) + if not url or not api_key: + raise ValueError('missing url and/or api_key from [fn_useragentanalysis] app_config') + + # PUT YOUR FUNCTION IMPLEMENTATION CODE HERE + yield StatusMessage("starting...") + data = {"user_agent": user_agent_string} + headers = {'X-API-KEY': api_key} + api_response = requests.post(url, headers=headers, json=data) + if api_response.status_code != 200: + raise Exception("Unexpected return code of {}".format(api_response.status_code)) + + user_agent_analysis = api_response.text + + results = { + "user_agent_string": user_agent_string, + "source_api_url": url, + "user_agent_analysis": user_agent_analysis + } + yield StatusMessage("done...") + + # Produce a FunctionResult with the results + yield FunctionResult(results) + except Exception as e: + yield FunctionError(e) + + diff --git a/fn_useragentanalysis/fn_useragentanalysis/util/__init__.py b/fn_useragentanalysis/fn_useragentanalysis/util/__init__.py new file mode 100644 index 000000000..4287ca861 --- /dev/null +++ b/fn_useragentanalysis/fn_useragentanalysis/util/__init__.py @@ -0,0 +1 @@ +# \ No newline at end of file diff --git a/fn_useragentanalysis/fn_useragentanalysis/util/config.py b/fn_useragentanalysis/fn_useragentanalysis/util/config.py new file mode 100644 index 000000000..7ca261e4b --- /dev/null +++ b/fn_useragentanalysis/fn_useragentanalysis/util/config.py @@ -0,0 +1,16 @@ +# -*- coding: utf-8 -*- + +"""Generate a default configuration-file section for fn_useragentanalysis""" + +from __future__ import print_function + + +def config_section_data(): + """Produce the default configuration section for app.config, + when called by `resilient-circuits config [-c|-u]` + """ + config_data = u"""[fn_useragentanalysis] +url=https://api.whatismybrowser.com/api/v2/user_agent_parse +api_key=<> +""" + return config_data \ No newline at end of file diff --git a/fn_useragentanalysis/fn_useragentanalysis/util/customize.py b/fn_useragentanalysis/fn_useragentanalysis/util/customize.py new file mode 100644 index 000000000..a235f3f23 --- /dev/null +++ b/fn_useragentanalysis/fn_useragentanalysis/util/customize.py @@ -0,0 +1,224 @@ +# -*- coding: utf-8 -*- + +"""Generate the Resilient customizations required for fn_useragentanalysis""" + +from __future__ import print_function +from resilient_circuits.util import * + +def codegen_reload_data(): + """Parameters to codegen used to generate the fn_useragentanalysis package""" + reload_params = {"package": u"fn_useragentanalysis", + "incident_fields": [], + "action_fields": [], + "function_params": [u"user_agent_string"], + "datatables": [], + "message_destinations": [u"useragentanalysis_fn"], + "functions": [u"fn_useragentanalysis"], + "phases": [], + "automatic_tasks": [], + "scripts": [], + "workflows": [u"user_agent_workflow"], + "actions": [u"Example: User Agent Analysis"] + } + return reload_params + + +def customization_data(client=None): + """Produce any customization definitions (types, fields, message destinations, etc) + that should be installed by `resilient-circuits customize` + """ + + # This import data contains: + # Function inputs: + # user_agent_string + # Message Destinations: + # useragentanalysis_fn + # Functions: + # fn_useragentanalysis + # Workflows: + # user_agent_workflow + # Rules: + # Example: User Agent Analysis + + + yield ImportDefinition(u""" +eyJ0YXNrX29yZGVyIjogW10sICJ3b3JrZmxvd3MiOiBbeyJ1dWlkIjogImYxYmVjYmZkLWJhMjUt +NGIzZC1iYTY5LWFlNDk4NTQ5NTkzYiIsICJkZXNjcmlwdGlvbiI6ICIiLCAib2JqZWN0X3R5cGUi +OiAiYXJ0aWZhY3QiLCAiZXhwb3J0X2tleSI6ICJ1c2VyX2FnZW50X3dvcmtmbG93IiwgIndvcmtm +bG93X2lkIjogMjQsICJsYXN0X21vZGlmaWVkX2J5IjogImFAZXhhbXBsZS5jb20iLCAiY29udGVu +dCI6IHsieG1sIjogIjw/eG1sIHZlcnNpb249XCIxLjBcIiBlbmNvZGluZz1cIlVURi04XCI/Pjxk +ZWZpbml0aW9ucyB4bWxucz1cImh0dHA6Ly93d3cub21nLm9yZy9zcGVjL0JQTU4vMjAxMDA1MjQv +TU9ERUxcIiB4bWxuczpicG1uZGk9XCJodHRwOi8vd3d3Lm9tZy5vcmcvc3BlYy9CUE1OLzIwMTAw +NTI0L0RJXCIgeG1sbnM6b21nZGM9XCJodHRwOi8vd3d3Lm9tZy5vcmcvc3BlYy9ERC8yMDEwMDUy +NC9EQ1wiIHhtbG5zOm9tZ2RpPVwiaHR0cDovL3d3dy5vbWcub3JnL3NwZWMvREQvMjAxMDA1MjQv +RElcIiB4bWxuczpyZXNpbGllbnQ9XCJodHRwOi8vcmVzaWxpZW50LmlibS5jb20vYnBtblwiIHht +bG5zOnhzZD1cImh0dHA6Ly93d3cudzMub3JnLzIwMDEvWE1MU2NoZW1hXCIgeG1sbnM6eHNpPVwi +aHR0cDovL3d3dy53My5vcmcvMjAwMS9YTUxTY2hlbWEtaW5zdGFuY2VcIiB0YXJnZXROYW1lc3Bh +Y2U9XCJodHRwOi8vd3d3LmNhbXVuZGEub3JnL3Rlc3RcIj48cHJvY2VzcyBpZD1cInVzZXJfYWdl +bnRfd29ya2Zsb3dcIiBpc0V4ZWN1dGFibGU9XCJ0cnVlXCIgbmFtZT1cIkV4YW1wbGU6IFVzZXIg +QWdlbnQgV29ya2Zsb3dcIj48ZG9jdW1lbnRhdGlvbi8+PHN0YXJ0RXZlbnQgaWQ9XCJTdGFydEV2 +ZW50XzE1NWFzeG1cIj48b3V0Z29pbmc+U2VxdWVuY2VGbG93XzB6c21xY3M8L291dGdvaW5nPjwv +c3RhcnRFdmVudD48ZW5kRXZlbnQgaWQ9XCJFbmRFdmVudF8wdGliOHR4XCI+PGluY29taW5nPlNl +cXVlbmNlRmxvd18wNnVtaThhPC9pbmNvbWluZz48L2VuZEV2ZW50PjxzZXJ2aWNlVGFzayBpZD1c +IlNlcnZpY2VUYXNrXzFqZzBsbHVcIiBuYW1lPVwiVXNlciBBZ2VudCBBbmFseXNpc1wiIHJlc2ls +aWVudDp0eXBlPVwiZnVuY3Rpb25cIj48ZXh0ZW5zaW9uRWxlbWVudHM+PHJlc2lsaWVudDpmdW5j +dGlvbiB1dWlkPVwiZTM2M2ZiNTktOTRjMC00MGUzLThlODctMWVkNjNhNGM4MTJlXCI+e1wiaW5w +dXRzXCI6e30sXCJwb3N0X3Byb2Nlc3Npbmdfc2NyaXB0XCI6XCJ1c2VyX2FnZW50X2FuYWx5c2lz +ID0gc3RyKHJlc3VsdHMudXNlcl9hZ2VudF9hbmFseXNpcylcXG5pbmNpZGVudC5hZGROb3RlKHVc +XFwiQXJ0aWZhY3Q6IHt9XFxcXG5cXFxcbnt9XFxcIi5mb3JtYXQoYXJ0aWZhY3QudmFsdWUsIHVz +ZXJfYWdlbnRfYW5hbHlzaXMpKVxcblxcbiMgVE9ETyBhZGQgZXhhbXBsZSBwYXlsb2FkXFxuI3sn +dXNlcl9hZ2VudF9zdHJpbmcnOiAnXFxcIk1vemlsbGEvNS4wIChNYWNpbnRvc2g7IEludGVsIE1h +YyBPUyBYIDEwXzlfNSkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hy +b21lLzY0LjAuMzI4Mi4xNDAgU2FmYXJpLzUzNy4zNlxcXCInLCAnc291cmNlX2FwaV91cmwnOiAn +aHR0cHM6Ly9hcGkud2hhdGlzbXlicm93c2VyLmNvbS9hcGkvdjIvdXNlcl9hZ2VudF9wYXJzZScs +ICd1c2VyX2FnZW50X2FuYWx5c2lzJzogJ3tcXFwicGFyc2VcXFwiOiB7XFxcInVzZXJfYWdlbnRc +XFwiOiBcXFwiXFxcXFxcXFxcXFwiTW96aWxsYS81LjAgKE1hY2ludG9zaDsgSW50ZWwgTWFjIE9T +IFggMTBfOV81KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUv +NjQuMC4zMjgyLjE0MCBTYWZhcmkvNTM3LjM2XFxcXFxcXFxcXFwiXFxcIiwgXFxcInNvZnR3YXJl +X25hbWVcXFwiOiBcXFwiQ2hyb21lXFxcIiwgXFxcIm9wZXJhdGluZ19zeXN0ZW1cXFwiOiBcXFwi +TWFjIE9TIFggKE1hdmVyaWNrcylcXFwiLCBcXFwic29mdHdhcmVfdmVyc2lvblxcXCI6IFxcXCI2 +NFxcXCIsIFxcXCJvcGVyYXRpbmdfc3lzdGVtX25hbWVcXFwiOiBcXFwiTWFjIE9TIFhcXFwiLCBc +XFwib3BlcmF0aW5nX3N5c3RlbV92ZXJzaW9uX2Z1bGxcXFwiOiBbXFxcIjEwXFxcIiwgXFxcIjlc +XFwiLCBcXFwiNVxcXCJdLCBcXFwic29mdHdhcmVfbmFtZV9jb2RlXFxcIjogXFxcImNocm9tZVxc +XCIsIFxcXCJzaW1wbGVfb3BlcmF0aW5nX3BsYXRmb3JtX3N0cmluZ1xcXCI6IG51bGwsIFxcXCJv +cGVyYXRpbmdfc3lzdGVtX3ZlcnNpb25cXFwiOiBcXFwiTWF2ZXJpY2tzXFxcIiwgXFxcInNpbXBs +ZV9zdWJfZGVzY3JpcHRpb25fc3RyaW5nXFxcIjogbnVsbCwgXFxcImlzX2FidXNpdmVcXFwiOiBm +YWxzZSwgXFxcIm9wZXJhdGluZ19zeXN0ZW1fZmxhdm91cl9jb2RlXFxcIjogbnVsbCwgXFxcInNv +ZnR3YXJlX3ZlcnNpb25fZnVsbFxcXCI6IFtcXFwiNjRcXFwiLCBcXFwiMFxcXCIsIFxcXCIzMjgy +XFxcIiwgXFxcIjE0MFxcXCJdLCBcXFwic2ltcGxlX3NvZnR3YXJlX3N0cmluZ1xcXCI6IFxcXCJD +aHJvbWUgNjQgb24gTWFjIE9TIFggKE1hdmVyaWNrcylcXFwiLCBcXFwib3BlcmF0aW5nX3N5c3Rl +bV9mbGF2b3VyXFxcIjogbnVsbCwgXFxcIm9wZXJhdGluZ19zeXN0ZW1fbmFtZV9jb2RlXFxcIjog +XFxcIm1hYy1vcy14XFxcIiwgXFxcInNvZnR3YXJlXFxcIjogXFxcIkNocm9tZSA2NFxcXCJ9LCBc +XFwicmVzdWx0XFxcIjoge1xcXCJtZXNzYWdlXFxcIjogXFxcIlRoZSB1c2VyIGFnZW50IHdhcyBw +YXJzZWQgc3VjY2Vzc2Z1bGx5LlxcXCIsIFxcXCJjb2RlXFxcIjogXFxcInN1Y2Nlc3NcXFwiLCBc +XFwibWVzc2FnZV9jb2RlXFxcIjogXFxcInVzZXJfYWdlbnRfcGFyc2VkXFxcIn19J31cXG5cXG5c +IixcInByZV9wcm9jZXNzaW5nX3NjcmlwdFwiOlwiaW5wdXRzLnVzZXJfYWdlbnRfc3RyaW5nID0g +YXJ0aWZhY3QudmFsdWVcIixcInJlc3VsdF9uYW1lXCI6XCJcIn08L3Jlc2lsaWVudDpmdW5jdGlv +bj48L2V4dGVuc2lvbkVsZW1lbnRzPjxpbmNvbWluZz5TZXF1ZW5jZUZsb3dfMHpzbXFjczwvaW5j +b21pbmc+PG91dGdvaW5nPlNlcXVlbmNlRmxvd18wNnVtaThhPC9vdXRnb2luZz48L3NlcnZpY2VU +YXNrPjxzZXF1ZW5jZUZsb3cgaWQ9XCJTZXF1ZW5jZUZsb3dfMHpzbXFjc1wiIHNvdXJjZVJlZj1c +IlN0YXJ0RXZlbnRfMTU1YXN4bVwiIHRhcmdldFJlZj1cIlNlcnZpY2VUYXNrXzFqZzBsbHVcIi8+ +PHNlcXVlbmNlRmxvdyBpZD1cIlNlcXVlbmNlRmxvd18wNnVtaThhXCIgc291cmNlUmVmPVwiU2Vy +dmljZVRhc2tfMWpnMGxsdVwiIHRhcmdldFJlZj1cIkVuZEV2ZW50XzB0aWI4dHhcIi8+PHRleHRB +bm5vdGF0aW9uIGlkPVwiVGV4dEFubm90YXRpb25fMWt4eGl5dFwiPjx0ZXh0PlN0YXJ0IHlvdXIg +d29ya2Zsb3cgaGVyZTwvdGV4dD48L3RleHRBbm5vdGF0aW9uPjxhc3NvY2lhdGlvbiBpZD1cIkFz +c29jaWF0aW9uXzFzZXVqNDhcIiBzb3VyY2VSZWY9XCJTdGFydEV2ZW50XzE1NWFzeG1cIiB0YXJn +ZXRSZWY9XCJUZXh0QW5ub3RhdGlvbl8xa3h4aXl0XCIvPjx0ZXh0QW5ub3RhdGlvbiBpZD1cIlRl +eHRBbm5vdGF0aW9uXzBmZmk2MHhcIj48dGV4dD5PdXRwdXQgY3JlYXRlcyBhIE5vdGU8L3RleHQ+ +PC90ZXh0QW5ub3RhdGlvbj48YXNzb2NpYXRpb24gaWQ9XCJBc3NvY2lhdGlvbl8wdzluZGpmXCIg +c291cmNlUmVmPVwiU2VydmljZVRhc2tfMWpnMGxsdVwiIHRhcmdldFJlZj1cIlRleHRBbm5vdGF0 +aW9uXzBmZmk2MHhcIi8+PC9wcm9jZXNzPjxicG1uZGk6QlBNTkRpYWdyYW0gaWQ9XCJCUE1ORGlh +Z3JhbV8xXCI+PGJwbW5kaTpCUE1OUGxhbmUgYnBtbkVsZW1lbnQ9XCJ1bmRlZmluZWRcIiBpZD1c +IkJQTU5QbGFuZV8xXCI+PGJwbW5kaTpCUE1OU2hhcGUgYnBtbkVsZW1lbnQ9XCJTdGFydEV2ZW50 +XzE1NWFzeG1cIiBpZD1cIlN0YXJ0RXZlbnRfMTU1YXN4bV9kaVwiPjxvbWdkYzpCb3VuZHMgaGVp +Z2h0PVwiMzZcIiB3aWR0aD1cIjM2XCIgeD1cIjE2OVwiIHk9XCIxNzVcIi8+PGJwbW5kaTpCUE1O +TGFiZWw+PG9tZ2RjOkJvdW5kcyBoZWlnaHQ9XCIwXCIgd2lkdGg9XCI5MFwiIHg9XCIxNjRcIiB5 +PVwiMjEwXCIvPjwvYnBtbmRpOkJQTU5MYWJlbD48L2JwbW5kaTpCUE1OU2hhcGU+PGJwbW5kaTpC +UE1OU2hhcGUgYnBtbkVsZW1lbnQ9XCJUZXh0QW5ub3RhdGlvbl8xa3h4aXl0XCIgaWQ9XCJUZXh0 +QW5ub3RhdGlvbl8xa3h4aXl0X2RpXCI+PG9tZ2RjOkJvdW5kcyBoZWlnaHQ9XCIzMFwiIHdpZHRo +PVwiMTAwXCIgeD1cIjk5XCIgeT1cIjI1NFwiLz48L2JwbW5kaTpCUE1OU2hhcGU+PGJwbW5kaTpC +UE1ORWRnZSBicG1uRWxlbWVudD1cIkFzc29jaWF0aW9uXzFzZXVqNDhcIiBpZD1cIkFzc29jaWF0 +aW9uXzFzZXVqNDhfZGlcIj48b21nZGk6d2F5cG9pbnQgeD1cIjE3NlwiIHhzaTp0eXBlPVwib21n +ZGM6UG9pbnRcIiB5PVwiMjA3XCIvPjxvbWdkaTp3YXlwb2ludCB4PVwiMTUzXCIgeHNpOnR5cGU9 +XCJvbWdkYzpQb2ludFwiIHk9XCIyNTRcIi8+PC9icG1uZGk6QlBNTkVkZ2U+PGJwbW5kaTpCUE1O +U2hhcGUgYnBtbkVsZW1lbnQ9XCJFbmRFdmVudF8wdGliOHR4XCIgaWQ9XCJFbmRFdmVudF8wdGli +OHR4X2RpXCI+PG9tZ2RjOkJvdW5kcyBoZWlnaHQ9XCIzNlwiIHdpZHRoPVwiMzZcIiB4PVwiNjIw +XCIgeT1cIjE3NVwiLz48YnBtbmRpOkJQTU5MYWJlbD48b21nZGM6Qm91bmRzIGhlaWdodD1cIjEz +XCIgd2lkdGg9XCIwXCIgeD1cIjYzOFwiIHk9XCIyMTRcIi8+PC9icG1uZGk6QlBNTkxhYmVsPjwv +YnBtbmRpOkJQTU5TaGFwZT48YnBtbmRpOkJQTU5TaGFwZSBicG1uRWxlbWVudD1cIlNlcnZpY2VU +YXNrXzFqZzBsbHVcIiBpZD1cIlNlcnZpY2VUYXNrXzFqZzBsbHVfZGlcIj48b21nZGM6Qm91bmRz +IGhlaWdodD1cIjgwXCIgd2lkdGg9XCIxMDBcIiB4PVwiMzM3XCIgeT1cIjE1M1wiLz48L2JwbW5k +aTpCUE1OU2hhcGU+PGJwbW5kaTpCUE1ORWRnZSBicG1uRWxlbWVudD1cIlNlcXVlbmNlRmxvd18w +enNtcWNzXCIgaWQ9XCJTZXF1ZW5jZUZsb3dfMHpzbXFjc19kaVwiPjxvbWdkaTp3YXlwb2ludCB4 +PVwiMjA1XCIgeHNpOnR5cGU9XCJvbWdkYzpQb2ludFwiIHk9XCIxOTNcIi8+PG9tZ2RpOndheXBv +aW50IHg9XCIyNjhcIiB4c2k6dHlwZT1cIm9tZ2RjOlBvaW50XCIgeT1cIjE5M1wiLz48b21nZGk6 +d2F5cG9pbnQgeD1cIjI2OFwiIHhzaTp0eXBlPVwib21nZGM6UG9pbnRcIiB5PVwiMTkzXCIvPjxv +bWdkaTp3YXlwb2ludCB4PVwiMzM3XCIgeHNpOnR5cGU9XCJvbWdkYzpQb2ludFwiIHk9XCIxOTNc +Ii8+PGJwbW5kaTpCUE1OTGFiZWw+PG9tZ2RjOkJvdW5kcyBoZWlnaHQ9XCIxM1wiIHdpZHRoPVwi +OTBcIiB4PVwiMjM4XCIgeT1cIjE4Ni41XCIvPjwvYnBtbmRpOkJQTU5MYWJlbD48L2JwbW5kaTpC +UE1ORWRnZT48YnBtbmRpOkJQTU5FZGdlIGJwbW5FbGVtZW50PVwiU2VxdWVuY2VGbG93XzA2dW1p +OGFcIiBpZD1cIlNlcXVlbmNlRmxvd18wNnVtaThhX2RpXCI+PG9tZ2RpOndheXBvaW50IHg9XCI0 +MzdcIiB4c2k6dHlwZT1cIm9tZ2RjOlBvaW50XCIgeT1cIjE5M1wiLz48b21nZGk6d2F5cG9pbnQg +eD1cIjYyMFwiIHhzaTp0eXBlPVwib21nZGM6UG9pbnRcIiB5PVwiMTkzXCIvPjxicG1uZGk6QlBN +TkxhYmVsPjxvbWdkYzpCb3VuZHMgaGVpZ2h0PVwiMTNcIiB3aWR0aD1cIjBcIiB4PVwiNTI4LjVc +IiB5PVwiMTcxXCIvPjwvYnBtbmRpOkJQTU5MYWJlbD48L2JwbW5kaTpCUE1ORWRnZT48YnBtbmRp +OkJQTU5TaGFwZSBicG1uRWxlbWVudD1cIlRleHRBbm5vdGF0aW9uXzBmZmk2MHhcIiBpZD1cIlRl +eHRBbm5vdGF0aW9uXzBmZmk2MHhfZGlcIj48b21nZGM6Qm91bmRzIGhlaWdodD1cIjQyXCIgd2lk +dGg9XCIxMzJcIiB4PVwiMzk1XCIgeT1cIjUyXCIvPjwvYnBtbmRpOkJQTU5TaGFwZT48YnBtbmRp +OkJQTU5FZGdlIGJwbW5FbGVtZW50PVwiQXNzb2NpYXRpb25fMHc5bmRqZlwiIGlkPVwiQXNzb2Np +YXRpb25fMHc5bmRqZl9kaVwiPjxvbWdkaTp3YXlwb2ludCB4PVwiNDEyXCIgeHNpOnR5cGU9XCJv +bWdkYzpQb2ludFwiIHk9XCIxNTNcIi8+PG9tZ2RpOndheXBvaW50IHg9XCI0NDhcIiB4c2k6dHlw +ZT1cIm9tZ2RjOlBvaW50XCIgeT1cIjk0XCIvPjwvYnBtbmRpOkJQTU5FZGdlPjwvYnBtbmRpOkJQ +TU5QbGFuZT48L2JwbW5kaTpCUE1ORGlhZ3JhbT48L2RlZmluaXRpb25zPiIsICJ3b3JrZmxvd19p +ZCI6ICJ1c2VyX2FnZW50X3dvcmtmbG93IiwgInZlcnNpb24iOiA2fSwgImxhc3RfbW9kaWZpZWRf +dGltZSI6IDE1NTIxMzk3MDg2ODMsICJjcmVhdG9yX2lkIjogImFAZXhhbXBsZS5jb20iLCAiYWN0 +aW9ucyI6IFtdLCAicHJvZ3JhbW1hdGljX25hbWUiOiAidXNlcl9hZ2VudF93b3JrZmxvdyIsICJu +YW1lIjogIkV4YW1wbGU6IFVzZXIgQWdlbnQgV29ya2Zsb3cifV0sICJhY3Rpb25zIjogW3sibG9n +aWNfdHlwZSI6ICJhbGwiLCAibmFtZSI6ICJFeGFtcGxlOiBVc2VyIEFnZW50IEFuYWx5c2lzIiwg +InZpZXdfaXRlbXMiOiBbXSwgInR5cGUiOiAxLCAid29ya2Zsb3dzIjogWyJ1c2VyX2FnZW50X3dv +cmtmbG93Il0sICJvYmplY3RfdHlwZSI6ICJhcnRpZmFjdCIsICJ0aW1lb3V0X3NlY29uZHMiOiA4 +NjQwMCwgInV1aWQiOiAiYmE3ODY0YjAtZDBjOS00NTZhLThkNTktZjdjMTY2Yzg4OTkxIiwgImF1 +dG9tYXRpb25zIjogW10sICJleHBvcnRfa2V5IjogIkV4YW1wbGU6IFVzZXIgQWdlbnQgQW5hbHlz +aXMiLCAiY29uZGl0aW9ucyI6IFt7InR5cGUiOiBudWxsLCAiZXZhbHVhdGlvbl9pZCI6IG51bGws +ICJmaWVsZF9uYW1lIjogImFydGlmYWN0LnR5cGUiLCAibWV0aG9kIjogImluIiwgInZhbHVlIjog +WyJTdHJpbmciLCAiSFRUUCBSZXF1ZXN0IEhlYWRlciIsICJVc2VyIEFnZW50Il19XSwgImlkIjog +MzYsICJtZXNzYWdlX2Rlc3RpbmF0aW9ucyI6IFtdfV0sICJsYXlvdXRzIjogW10sICJleHBvcnRf +Zm9ybWF0X3ZlcnNpb24iOiAyLCAiaWQiOiA5LCAiaW5kdXN0cmllcyI6IG51bGwsICJwaGFzZXMi +OiBbXSwgImFjdGlvbl9vcmRlciI6IFtdLCAiZ2VvcyI6IG51bGwsICJsb2NhbGUiOiBudWxsLCAi +c2VydmVyX3ZlcnNpb24iOiB7Im1ham9yIjogMzEsICJ2ZXJzaW9uIjogIjMxLjAuNDI1NCIsICJi +dWlsZF9udW1iZXIiOiA0MjU0LCAibWlub3IiOiAwfSwgInRpbWVmcmFtZXMiOiBudWxsLCAid29y +a3NwYWNlcyI6IFtdLCAiYXV0b21hdGljX3Rhc2tzIjogW10sICJmdW5jdGlvbnMiOiBbeyJkaXNw +bGF5X25hbWUiOiAiVXNlciBBZ2VudCBBbmFseXNpcyIsICJkZXNjcmlwdGlvbiI6IHsiY29udGVu +dCI6ICJmdW5jdGlvbiB0byBwYXJzZSBhbmQgdG8gcHJvdmlkZSBhbmFseXNpcyBvbiB1c2VyIGFn +ZW50IHN0cmluZ3MiLCAiZm9ybWF0IjogInRleHQifSwgImNyZWF0b3IiOiB7ImRpc3BsYXlfbmFt +ZSI6ICJhYmxlIGJhY2tlciIsICJ0eXBlIjogInVzZXIiLCAiaWQiOiAzLCAibmFtZSI6ICJhQGV4 +YW1wbGUuY29tIn0sICJ2aWV3X2l0ZW1zIjogW3sic2hvd19pZiI6IG51bGwsICJmaWVsZF90eXBl +IjogIl9fZnVuY3Rpb24iLCAic2hvd19saW5rX2hlYWRlciI6IGZhbHNlLCAiZWxlbWVudCI6ICJm +aWVsZF91dWlkIiwgImNvbnRlbnQiOiAiY2I0MmE2YmEtYjZkNC00ZWVkLTgzOGYtNWM4YjYwYmI2 +YjMzIiwgInN0ZXBfbGFiZWwiOiBudWxsfV0sICJleHBvcnRfa2V5IjogImZuX3VzZXJhZ2VudGFu +YWx5c2lzIiwgInV1aWQiOiAiZTM2M2ZiNTktOTRjMC00MGUzLThlODctMWVkNjNhNGM4MTJlIiwg +Imxhc3RfbW9kaWZpZWRfYnkiOiB7ImRpc3BsYXlfbmFtZSI6ICJhYmxlIGJhY2tlciIsICJ0eXBl +IjogInVzZXIiLCAiaWQiOiAzLCAibmFtZSI6ICJhQGV4YW1wbGUuY29tIn0sICJ2ZXJzaW9uIjog +MiwgIndvcmtmbG93cyI6IFt7ImRlc2NyaXB0aW9uIjogbnVsbCwgIm9iamVjdF90eXBlIjogImFy +dGlmYWN0IiwgImFjdGlvbnMiOiBbXSwgIm5hbWUiOiAiRXhhbXBsZTogVXNlciBBZ2VudCBXb3Jr +ZmxvdyIsICJ3b3JrZmxvd19pZCI6IDI0LCAicHJvZ3JhbW1hdGljX25hbWUiOiAidXNlcl9hZ2Vu +dF93b3JrZmxvdyIsICJ1dWlkIjogbnVsbH1dLCAibGFzdF9tb2RpZmllZF90aW1lIjogMTU1MjA3 +MDIxNTIwNywgImRlc3RpbmF0aW9uX2hhbmRsZSI6ICJ1c2VyYWdlbnRhbmFseXNpc19mbiIsICJp +ZCI6IDE2LCAibmFtZSI6ICJmbl91c2VyYWdlbnRhbmFseXNpcyJ9XSwgIm5vdGlmaWNhdGlvbnMi +OiBudWxsLCAicmVndWxhdG9ycyI6IG51bGwsICJpbmNpZGVudF90eXBlcyI6IFt7ImNyZWF0ZV9k +YXRlIjogMTU1MjEzOTc1OTk3NCwgImRlc2NyaXB0aW9uIjogIkN1c3RvbWl6YXRpb24gUGFja2Fn +ZXMgKGludGVybmFsKSIsICJleHBvcnRfa2V5IjogIkN1c3RvbWl6YXRpb24gUGFja2FnZXMgKGlu +dGVybmFsKSIsICJpZCI6IDAsICJuYW1lIjogIkN1c3RvbWl6YXRpb24gUGFja2FnZXMgKGludGVy +bmFsKSIsICJ1cGRhdGVfZGF0ZSI6IDE1NTIxMzk3NTk5NzQsICJ1dWlkIjogImJmZWVjMmQ0LTM3 +NzAtMTFlOC1hZDM5LTRhMDAwNDA0NGFhMCIsICJlbmFibGVkIjogZmFsc2UsICJzeXN0ZW0iOiBm +YWxzZSwgInBhcmVudF9pZCI6IG51bGwsICJoaWRkZW4iOiBmYWxzZX1dLCAic2NyaXB0cyI6IFtd +LCAidHlwZXMiOiBbXSwgIm1lc3NhZ2VfZGVzdGluYXRpb25zIjogW3sidXVpZCI6ICJhY2MyOTM1 +NS0yMWM4LTQwNmMtODU4Mi1kZDRlNWFjMWNhOTkiLCAiZXhwb3J0X2tleSI6ICJ1c2VyYWdlbnRh +bmFseXNpc19mbiIsICJuYW1lIjogInVzZXJhZ2VudGFuYWx5c2lzX2ZuIiwgImRlc3RpbmF0aW9u +X3R5cGUiOiAwLCAicHJvZ3JhbW1hdGljX25hbWUiOiAidXNlcmFnZW50YW5hbHlzaXNfZm4iLCAi +ZXhwZWN0X2FjayI6IHRydWUsICJ1c2VycyI6IFsiYUBleGFtcGxlLmNvbSJdfV0sICJpbmNpZGVu +dF9hcnRpZmFjdF90eXBlcyI6IFtdLCAicm9sZXMiOiBbXSwgImZpZWxkcyI6IFt7Im9wZXJhdGlv +bnMiOiBbXSwgInR5cGVfaWQiOiAwLCAib3BlcmF0aW9uX3Blcm1zIjoge30sICJ0ZXh0IjogIlNp +bXVsYXRpb24iLCAiYmxhbmtfb3B0aW9uIjogZmFsc2UsICJwcmVmaXgiOiBudWxsLCAiY2hhbmdl +YWJsZSI6IHRydWUsICJpZCI6IDUxLCAicmVhZF9vbmx5IjogdHJ1ZSwgInV1aWQiOiAiYzNmMGUz +ZWQtMjFlMS00ZDUzLWFmZmItZmU1Y2EzMzA4Y2NhIiwgImNob3NlbiI6IGZhbHNlLCAiaW5wdXRf +dHlwZSI6ICJib29sZWFuIiwgInRvb2x0aXAiOiAiV2hldGhlciB0aGUgaW5jaWRlbnQgaXMgYSBz +aW11bGF0aW9uIG9yIGEgcmVndWxhciBpbmNpZGVudC4gIFRoaXMgZmllbGQgaXMgcmVhZC1vbmx5 +LiIsICJpbnRlcm5hbCI6IGZhbHNlLCAicmljaF90ZXh0IjogZmFsc2UsICJ0ZW1wbGF0ZXMiOiBb +XSwgImV4cG9ydF9rZXkiOiAiaW5jaWRlbnQvaW5jX3RyYWluaW5nIiwgImhpZGVfbm90aWZpY2F0 +aW9uIjogZmFsc2UsICJuYW1lIjogImluY190cmFpbmluZyIsICJkZXByZWNhdGVkIjogZmFsc2Us +ICJkZWZhdWx0X2Nob3Nlbl9ieV9zZXJ2ZXIiOiBmYWxzZSwgInZhbHVlcyI6IFtdfSwgeyJvcGVy +YXRpb25zIjogW10sICJ0eXBlX2lkIjogMTEsICJvcGVyYXRpb25fcGVybXMiOiB7fSwgInRleHQi +OiAidXNlcl9hZ2VudF9zdHJpbmciLCAiYmxhbmtfb3B0aW9uIjogZmFsc2UsICJwcmVmaXgiOiBu +dWxsLCAiY2hhbmdlYWJsZSI6IHRydWUsICJpZCI6IDIzMSwgInJlYWRfb25seSI6IGZhbHNlLCAi +dXVpZCI6ICJjYjQyYTZiYS1iNmQ0LTRlZWQtODM4Zi01YzhiNjBiYjZiMzMiLCAiY2hvc2VuIjog +ZmFsc2UsICJpbnB1dF90eXBlIjogInRleHQiLCAidG9vbHRpcCI6ICJTb2Z0d2FyZSAoYSBzb2Z0 +d2FyZSBhZ2VudCkgdGhhdCBpcyBhY3Rpbmcgb24gYmVoYWxmIG9mIGEgdXNlci4iLCAiaW50ZXJu +YWwiOiBmYWxzZSwgInJpY2hfdGV4dCI6IGZhbHNlLCAidGVtcGxhdGVzIjogW10sICJleHBvcnRf +a2V5IjogIl9fZnVuY3Rpb24vdXNlcl9hZ2VudF9zdHJpbmciLCAiaGlkZV9ub3RpZmljYXRpb24i +OiBmYWxzZSwgInBsYWNlaG9sZGVyIjogImhlbGxvIiwgIm5hbWUiOiAidXNlcl9hZ2VudF9zdHJp +bmciLCAiZGVwcmVjYXRlZCI6IGZhbHNlLCAiZGVmYXVsdF9jaG9zZW5fYnlfc2VydmVyIjogZmFs +c2UsICJ2YWx1ZXMiOiBbXX1dLCAib3ZlcnJpZGVzIjogW10sICJleHBvcnRfZGF0ZSI6IDE1NTIx +Mzk3MjUxNDN9 +""" + ) \ No newline at end of file diff --git a/fn_useragentanalysis/fn_useragentanalysis/util/selftest.py b/fn_useragentanalysis/fn_useragentanalysis/util/selftest.py new file mode 100644 index 000000000..e56102107 --- /dev/null +++ b/fn_useragentanalysis/fn_useragentanalysis/util/selftest.py @@ -0,0 +1,20 @@ +# -*- coding: utf-8 -*- +# pragma pylint: disable=unused-argument, no-self-use +"""Function implementation + test with: resilient-circuits selftest -l fn_useragentanalysis +""" + +import logging + +log = logging.getLogger(__name__) +log.setLevel(logging.INFO) +log.addHandler(logging.StreamHandler()) + + +def selftest_function(opts): + """ + Placeholder for selftest function. An example use would be to test package api connectivity. + Suggested return values are be unimplemented, success, or failure. + """ + options = opts.get("fn_useragentanalysis", {}) + return {"state": "unimplemented"} \ No newline at end of file diff --git a/fn_useragentanalysis/setup.py b/fn_useragentanalysis/setup.py new file mode 100644 index 000000000..3e89f3226 --- /dev/null +++ b/fn_useragentanalysis/setup.py @@ -0,0 +1,32 @@ +#!/usr/bin/env python +# -*- coding: utf-8 -*- + +from setuptools import setup, find_packages + +setup( + name='fn_useragentanalysis', + version='1.0.0', + license='MIT', + author='Resilient Labs', + author_email='resil.labs@gmail.com', + url='https://github.com/ibmresilient/resilient-community-apps', + description="Resilient Circuits Components for 'fn_useragentanalysis'", + long_description="Resilient Circuits Components for 'fn_useragentanalysis' to perform browser user agent analysis", + install_requires=[ + 'resilient_circuits>=30.0.0' + ], + packages=find_packages(), + include_package_data=True, + platforms='any', + classifiers=[ + 'Programming Language :: Python', + ], + entry_points={ + "resilient.circuits.components": [ + "FnUseragentanalysisFunctionComponent = fn_useragentanalysis.components.func_useragentanalysis:FunctionComponent" + ], + "resilient.circuits.configsection": ["gen_config = fn_useragentanalysis.util.config:config_section_data"], + "resilient.circuits.customize": ["customize = fn_useragentanalysis.util.customize:customization_data"], + "resilient.circuits.selftest": ["selftest = fn_useragentanalysis.util.selftest:selftest_function"] + } +) \ No newline at end of file diff --git a/fn_useragentanalysis/tests/test_fn_useragentanalysis.py b/fn_useragentanalysis/tests/test_fn_useragentanalysis.py new file mode 100644 index 000000000..d93d3ec58 --- /dev/null +++ b/fn_useragentanalysis/tests/test_fn_useragentanalysis.py @@ -0,0 +1,48 @@ +# -*- coding: utf-8 -*- +"""Tests using pytest_resilient_circuits""" + +from __future__ import print_function +import pytest +from resilient_circuits.util import get_config_data, get_function_definition +from resilient_circuits import SubmitTestFunction, FunctionResult + +PACKAGE_NAME = "fn_useragentanalysis" +FUNCTION_NAME = "fn_useragentanalysis" + +# Read the default configuration-data section from the package +config_data = get_config_data(PACKAGE_NAME) + +# Provide a simulation of the Resilient REST API (uncomment to connect to a real appliance) +resilient_mock = "pytest_resilient_circuits.BasicResilientMock" + + +def call_fn_useragentanalysis_function(circuits, function_params, timeout=10): + # Fire a message to the function + evt = SubmitTestFunction("fn_useragentanalysis", function_params) + circuits.manager.fire(evt) + event = circuits.watcher.wait("fn_useragentanalysis_result", parent=evt, timeout=timeout) + assert event + assert isinstance(event.kwargs["result"], FunctionResult) + pytest.wait_for(event, "complete", True) + return event.kwargs["result"].value + + +class TestFnUseragentanalysis: + """ Tests for the fn_useragentanalysis function""" + + def test_function_definition(self): + """ Test that the package provides customization_data that defines the function """ + func = get_function_definition(PACKAGE_NAME, FUNCTION_NAME) + assert func is not None + + @pytest.mark.parametrize("user_agent_string, expected_results", [ + ("text", {"value": "xyz"}), + ("text", {"value": "xyz"}) + ]) + def test_success(self, circuits_app, user_agent_string, expected_results): + """ Test calling with sample values for the parameters """ + function_params = { + "user_agent_string": user_agent_string + } + results = call_fn_useragentanalysis_function(circuits_app, function_params) + assert(expected_results == results) \ No newline at end of file diff --git a/fn_useragentanalysis/tox.ini b/fn_useragentanalysis/tox.ini new file mode 100644 index 000000000..5ff960520 --- /dev/null +++ b/fn_useragentanalysis/tox.ini @@ -0,0 +1,17 @@ +# Tox (https://tox.readthedocs.io/) is a tool for running tests +# in multiple virtualenvs. This configuration file will run the +# test suite on all supported python versions. To use it, "pip install tox" +# and then run "tox" from this directory. + +[tox] +envlist = py27, py36 +skip_missing_interpreters=True + +[testenv] +passenv=TEST_RESILIENT_* +commands = pytest -s {posargs} +deps = + pytest + resilient + resilient-circuits + pytest-resilient-circuits \ No newline at end of file