From de3e4e34e92f405d09ba6901ca2380214f8fdf94 Mon Sep 17 00:00:00 2001 From: xsoar-bot Date: Thu, 4 Feb 2021 14:50:35 +0000 Subject: [PATCH 1/4] "pack contribution initial commit" --- Packs/SimpleEmailReputation/.pack-ignore | 0 Packs/SimpleEmailReputation/.secrets-ignore | 0 .../SimpleEmailReputation/Pipfile | 20 ++ .../SimpleEmailReputation/Pipfile.lock | 313 ++++++++++++++++++ .../SimpleEmailReputation/README.md | 0 .../SimpleEmailReputation.py | 141 ++++++++ .../SimpleEmailReputation.yml | 48 +++ .../SimpleEmailReputation_image.png | Bin 0 -> 9945 bytes Packs/SimpleEmailReputation/README.md | 0 .../SimpleEmailReputation/pack_metadata.json | 17 + 10 files changed, 539 insertions(+) create mode 100644 Packs/SimpleEmailReputation/.pack-ignore create mode 100644 Packs/SimpleEmailReputation/.secrets-ignore create mode 100644 Packs/SimpleEmailReputation/Integrations/SimpleEmailReputation/Pipfile create mode 100644 Packs/SimpleEmailReputation/Integrations/SimpleEmailReputation/Pipfile.lock create mode 100644 Packs/SimpleEmailReputation/Integrations/SimpleEmailReputation/README.md create mode 100644 Packs/SimpleEmailReputation/Integrations/SimpleEmailReputation/SimpleEmailReputation.py create mode 100644 Packs/SimpleEmailReputation/Integrations/SimpleEmailReputation/SimpleEmailReputation.yml create mode 100644 Packs/SimpleEmailReputation/Integrations/SimpleEmailReputation/SimpleEmailReputation_image.png create mode 100644 Packs/SimpleEmailReputation/README.md create mode 100644 Packs/SimpleEmailReputation/pack_metadata.json diff --git a/Packs/SimpleEmailReputation/.pack-ignore b/Packs/SimpleEmailReputation/.pack-ignore new file mode 100644 index 000000000000..e69de29bb2d1 diff --git a/Packs/SimpleEmailReputation/.secrets-ignore b/Packs/SimpleEmailReputation/.secrets-ignore new file mode 100644 index 000000000000..e69de29bb2d1 diff --git a/Packs/SimpleEmailReputation/Integrations/SimpleEmailReputation/Pipfile b/Packs/SimpleEmailReputation/Integrations/SimpleEmailReputation/Pipfile new file mode 100644 index 000000000000..751a15a41948 --- /dev/null +++ b/Packs/SimpleEmailReputation/Integrations/SimpleEmailReputation/Pipfile @@ -0,0 +1,20 @@ +[[source]] +name = "pypi" +url = "https://pypi.org/simple" +verify_ssl = true + +[dev-packages] +pylint = "*" +pytest = "*" +pytest-mock = "*" +requests-mock = "*" +pytest-asyncio = "*" +pytest-xdist = "*" +pytest-datadir-ng = "*" +freezegun = "*" +pytest-json = "*" + +[packages] + +[requires] +python_version = "3.7" diff --git a/Packs/SimpleEmailReputation/Integrations/SimpleEmailReputation/Pipfile.lock b/Packs/SimpleEmailReputation/Integrations/SimpleEmailReputation/Pipfile.lock new file mode 100644 index 000000000000..0b40cbc69d5f --- /dev/null +++ b/Packs/SimpleEmailReputation/Integrations/SimpleEmailReputation/Pipfile.lock @@ -0,0 +1,313 @@ +{ + "_meta": { + "hash": { + "sha256": "5c3e1bf65f4fbe385565206a0c7fef1fda1310bfd844ec73e20fa7cf1035aa32" + }, + "pipfile-spec": 6, + "requires": { + "python_version": "3.7" + }, + "sources": [ + { + "name": "pypi", + "url": "https://pypi.org/simple", + "verify_ssl": true + } + ] + }, + "default": {}, + "develop": { + "apipkg": { + "hashes": [ + "sha256:37228cda29411948b422fae072f57e31d3396d2ee1c9783775980ee9c9990af6", + "sha256:58587dd4dc3daefad0487f6d9ae32b4542b185e1c36db6993290e7c41ca2b47c" + ], + "version": "==1.5" + }, + "astroid": { + "hashes": [ + "sha256:2f4078c2a41bf377eea06d71c9d2ba4eb8f6b1af2135bec27bbbb7d8f12bb703", + "sha256:bc58d83eb610252fd8de6363e39d4f1d0619c894b0ed24603b881c02e64c7386" + ], + "version": "==2.4.2" + }, + "attrs": { + "hashes": [ + "sha256:26b54ddbbb9ee1d34d5d3668dd37d6cf74990ab23c828c2888dccdceee395594", + "sha256:fce7fc47dfc976152e82d53ff92fa0407700c21acd20886a13777a0d20e655dc" + ], + "version": "==20.2.0" + }, + "certifi": { + "hashes": [ + "sha256:5930595817496dd21bb8dc35dad090f1c2cd0adfaf21204bf6732ca5d8ee34d3", + "sha256:8fc0819f1f30ba15bdb34cceffb9ef04d99f420f68eb75d901e9560b8749fc41" + ], + "version": "==2020.6.20" + }, + "chardet": { + "hashes": [ + "sha256:84ab92ed1c4d4f16916e05906b6b75a6c0fb5db821cc65e70cbd64a3e2a5eaae", + "sha256:fc323ffcaeaed0e0a02bf4d117757b98aed530d9ed4531e3e15460124c106691" + ], + "version": "==3.0.4" + }, + "execnet": { + "hashes": [ + "sha256:cacb9df31c9680ec5f95553976c4da484d407e85e41c83cb812aa014f0eddc50", + "sha256:d4efd397930c46415f62f8a31388d6be4f27a91d7550eb79bc64a756e0056547" + ], + "version": "==1.7.1" + }, + "freezegun": { + "hashes": [ + "sha256:02b35de52f4699a78f6ac4518e4cd3390dddc43b0aeb978335a8f270a2d9668b", + "sha256:1cf08e441f913ff5e59b19cc065a8faa9dd1ddc442eaf0375294f344581a0643" + ], + "index": "pypi", + "version": "==1.0.0" + }, + "idna": { + "hashes": [ + "sha256:b307872f855b18632ce0c21c5e45be78c0ea7ae4c15c828c20788b26921eb3f6", + "sha256:b97d804b1e9b523befed77c48dacec60e6dcb0b5391d57af6a65a312a90648c0" + ], + "version": "==2.10" + }, + "importlib-metadata": { + "hashes": [ + "sha256:90bb658cdbbf6d1735b6341ce708fc7024a3e14e99ffdc5783edea9f9b077f83", + "sha256:dc15b2969b4ce36305c51eebe62d418ac7791e9a157911d58bfb1f9ccd8e2070" + ], + "markers": "python_version < '3.8'", + "version": "==1.7.0" + }, + "iniconfig": { + "hashes": [ + "sha256:80cf40c597eb564e86346103f609d74efce0f6b4d4f30ec8ce9e2c26411ba437", + "sha256:e5f92f89355a67de0595932a6c6c02ab4afddc6fcdc0bfc5becd0d60884d3f69" + ], + "version": "==1.0.1" + }, + "isort": { + "hashes": [ + "sha256:171c5f365791073426b5ed3a156c2081a47f88c329161fd28228ff2da4c97ddb", + "sha256:ba91218eee31f1e300ecc079ef0c524cea3fc41bfbb979cbdf5fd3a889e3cfed" + ], + "version": "==5.5.2" + }, + "lazy-object-proxy": { + "hashes": [ + "sha256:0c4b206227a8097f05c4dbdd323c50edf81f15db3b8dc064d08c62d37e1a504d", + "sha256:194d092e6f246b906e8f70884e620e459fc54db3259e60cf69a4d66c3fda3449", + "sha256:1be7e4c9f96948003609aa6c974ae59830a6baecc5376c25c92d7d697e684c08", + "sha256:4677f594e474c91da97f489fea5b7daa17b5517190899cf213697e48d3902f5a", + "sha256:48dab84ebd4831077b150572aec802f303117c8cc5c871e182447281ebf3ac50", + "sha256:5541cada25cd173702dbd99f8e22434105456314462326f06dba3e180f203dfd", + "sha256:59f79fef100b09564bc2df42ea2d8d21a64fdcda64979c0fa3db7bdaabaf6239", + "sha256:8d859b89baf8ef7f8bc6b00aa20316483d67f0b1cbf422f5b4dc56701c8f2ffb", + "sha256:9254f4358b9b541e3441b007a0ea0764b9d056afdeafc1a5569eee1cc6c1b9ea", + "sha256:9651375199045a358eb6741df3e02a651e0330be090b3bc79f6d0de31a80ec3e", + "sha256:97bb5884f6f1cdce0099f86b907aa41c970c3c672ac8b9c8352789e103cf3156", + "sha256:9b15f3f4c0f35727d3a0fba4b770b3c4ebbb1fa907dbcc046a1d2799f3edd142", + "sha256:a2238e9d1bb71a56cd710611a1614d1194dc10a175c1e08d75e1a7bcc250d442", + "sha256:a6ae12d08c0bf9909ce12385803a543bfe99b95fe01e752536a60af2b7797c62", + "sha256:ca0a928a3ddbc5725be2dd1cf895ec0a254798915fb3a36af0964a0a4149e3db", + "sha256:cb2c7c57005a6804ab66f106ceb8482da55f5314b7fcb06551db1edae4ad1531", + "sha256:d74bb8693bf9cf75ac3b47a54d716bbb1a92648d5f781fc799347cfc95952383", + "sha256:d945239a5639b3ff35b70a88c5f2f491913eb94871780ebfabb2568bd58afc5a", + "sha256:eba7011090323c1dadf18b3b689845fd96a61ba0a1dfbd7f24b921398affc357", + "sha256:efa1909120ce98bbb3777e8b6f92237f5d5c8ea6758efea36a473e1d38f7d3e4", + "sha256:f3900e8a5de27447acbf900b4750b0ddfd7ec1ea7fbaf11dfa911141bc522af0" + ], + "version": "==1.4.3" + }, + "mccabe": { + "hashes": [ + "sha256:ab8a6258860da4b6677da4bd2fe5dc2c659cff31b3ee4f7f5d64e79735b80d42", + "sha256:dd8d182285a0fe56bace7f45b5e7d1a6ebcbf524e8f3bd87eb0f125271b8831f" + ], + "version": "==0.6.1" + }, + "more-itertools": { + "hashes": [ + "sha256:6f83822ae94818eae2612063a5101a7311e68ae8002005b5e05f03fd74a86a20", + "sha256:9b30f12df9393f0d28af9210ff8efe48d10c94f73e5daf886f10c4b0b0b4f03c" + ], + "version": "==8.5.0" + }, + "packaging": { + "hashes": [ + "sha256:4357f74f47b9c12db93624a82154e9b120fa8293699949152b22065d556079f8", + "sha256:998416ba6962ae7fbd6596850b80e17859a5753ba17c32284f67bfff33784181" + ], + "version": "==20.4" + }, + "pluggy": { + "hashes": [ + "sha256:15b2acde666561e1298d71b523007ed7364de07029219b604cf808bfa1c765b0", + "sha256:966c145cd83c96502c3c3868f50408687b38434af77734af1e9ca461a4081d2d" + ], + "version": "==0.13.1" + }, + "py": { + "hashes": [ + "sha256:366389d1db726cd2fcfc79732e75410e5fe4d31db13692115529d34069a043c2", + "sha256:9ca6883ce56b4e8da7e79ac18787889fa5206c79dcc67fb065376cd2fe03f342" + ], + "version": "==1.9.0" + }, + "pylint": { + "hashes": [ + "sha256:bb4a908c9dadbc3aac18860550e870f58e1a02c9f2c204fdf5693d73be061210", + "sha256:bfe68f020f8a0fece830a22dd4d5dddb4ecc6137db04face4c3420a46a52239f" + ], + "index": "pypi", + "version": "==2.6.0" + }, + "pyparsing": { + "hashes": [ + "sha256:c203ec8783bf771a155b207279b9bccb8dea02d8f0c9e5f8ead507bc3246ecc1", + "sha256:ef9d7589ef3c200abe66653d3f1ab1033c3c419ae9b9bdb1240a85b024efc88b" + ], + "version": "==2.4.7" + }, + "pytest": { + "hashes": [ + "sha256:0e37f61339c4578776e090c3b8f6b16ce4db333889d65d0efb305243ec544b40", + "sha256:c8f57c2a30983f469bf03e68cdfa74dc474ce56b8f280ddcb080dfd91df01043" + ], + "index": "pypi", + "version": "==6.0.2" + }, + "pytest-asyncio": { + "hashes": [ + "sha256:2eae1e34f6c68fc0a9dc12d4bea190483843ff4708d24277c41568d6b6044f1d", + "sha256:9882c0c6b24429449f5f969a5158b528f39bde47dc32e85b9f0403965017e700" + ], + "index": "pypi", + "version": "==0.14.0" + }, + "pytest-datadir-ng": { + "hashes": [ + "sha256:0d9e0212eaa4d0440a4b7c3d2df4b4b7eeebde1854ab383c5aff590764ad8a52", + "sha256:7fec7a4996a12529a935512c128624fa7289495b520fd31b4645c3a71daa394e" + ], + "index": "pypi", + "version": "==1.1.1" + }, + "pytest-forked": { + "hashes": [ + "sha256:6aa9ac7e00ad1a539c41bec6d21011332de671e938c7637378ec9710204e37ca", + "sha256:dc4147784048e70ef5d437951728825a131b81714b398d5d52f17c7c144d8815" + ], + "version": "==1.3.0" + }, + "pytest-json": { + "hashes": [ + "sha256:8bf4e1be1691f4416bc12b14785b5ad9e842887b0b2b2d61b37dcb555b208630" + ], + "index": "pypi", + "version": "==0.4.0" + }, + "pytest-mock": { + "hashes": [ + "sha256:024e405ad382646318c4281948aadf6fe1135632bea9cc67366ea0c4098ef5f2", + "sha256:a4d6d37329e4a893e77d9ffa89e838dd2b45d5dc099984cf03c703ac8411bb82" + ], + "index": "pypi", + "version": "==3.3.1" + }, + "pytest-xdist": { + "hashes": [ + "sha256:7c629016b3bb006b88ac68e2b31551e7becf173c76b977768848e2bbed594d90", + "sha256:82d938f1a24186520e2d9d3a64ef7d9ac7ecdf1a0659e095d18e596b8cbd0672" + ], + "index": "pypi", + "version": "==2.1.0" + }, + "python-dateutil": { + "hashes": [ + "sha256:73ebfe9dbf22e832286dafa60473e4cd239f8592f699aa5adaf10050e6e1823c", + "sha256:75bb3f31ea686f1197762692a9ee6a7550b59fc6ca3a1f4b5d7e32fb98e2da2a" + ], + "version": "==2.8.1" + }, + "requests": { + "hashes": [ + "sha256:b3559a131db72c33ee969480840fff4bb6dd111de7dd27c8ee1f820f4f00231b", + "sha256:fe75cc94a9443b9246fc7049224f75604b113c36acb93f87b80ed42c44cbb898" + ], + "version": "==2.24.0" + }, + "requests-mock": { + "hashes": [ + "sha256:11215c6f4df72702aa357f205cf1e537cffd7392b3e787b58239bde5fb3db53b", + "sha256:e68f46844e4cee9d447150343c9ae875f99fa8037c6dcf5f15bf1fe9ab43d226" + ], + "index": "pypi", + "version": "==1.8.0" + }, + "six": { + "hashes": [ + "sha256:30639c035cdb23534cd4aa2dd52c3bf48f06e5f4a941509c8bafd8ce11080259", + "sha256:8b74bedcbbbaca38ff6d7491d76f2b06b3592611af620f8426e82dddb04a5ced" + ], + "version": "==1.15.0" + }, + "toml": { + "hashes": [ + "sha256:926b612be1e5ce0634a2ca03470f95169cf16f939018233a670519cb4ac58b0f", + "sha256:bda89d5935c2eac546d648028b9901107a595863cb36bae0c73ac804a9b4ce88" + ], + "version": "==0.10.1" + }, + "typed-ast": { + "hashes": [ + "sha256:0666aa36131496aed8f7be0410ff974562ab7eeac11ef351def9ea6fa28f6355", + "sha256:0c2c07682d61a629b68433afb159376e24e5b2fd4641d35424e462169c0a7919", + "sha256:249862707802d40f7f29f6e1aad8d84b5aa9e44552d2cc17384b209f091276aa", + "sha256:24995c843eb0ad11a4527b026b4dde3da70e1f2d8806c99b7b4a7cf491612652", + "sha256:269151951236b0f9a6f04015a9004084a5ab0d5f19b57de779f908621e7d8b75", + "sha256:4083861b0aa07990b619bd7ddc365eb7fa4b817e99cf5f8d9cf21a42780f6e01", + "sha256:498b0f36cc7054c1fead3d7fc59d2150f4d5c6c56ba7fb150c013fbc683a8d2d", + "sha256:4e3e5da80ccbebfff202a67bf900d081906c358ccc3d5e3c8aea42fdfdfd51c1", + "sha256:6daac9731f172c2a22ade6ed0c00197ee7cc1221aa84cfdf9c31defeb059a907", + "sha256:715ff2f2df46121071622063fc7543d9b1fd19ebfc4f5c8895af64a77a8c852c", + "sha256:73d785a950fc82dd2a25897d525d003f6378d1cb23ab305578394694202a58c3", + "sha256:8c8aaad94455178e3187ab22c8b01a3837f8ee50e09cf31f1ba129eb293ec30b", + "sha256:8ce678dbaf790dbdb3eba24056d5364fb45944f33553dd5869b7580cdbb83614", + "sha256:aaee9905aee35ba5905cfb3c62f3e83b3bec7b39413f0a7f19be4e547ea01ebb", + "sha256:bcd3b13b56ea479b3650b82cabd6b5343a625b0ced5429e4ccad28a8973f301b", + "sha256:c9e348e02e4d2b4a8b2eedb48210430658df6951fa484e59de33ff773fbd4b41", + "sha256:d205b1b46085271b4e15f670058ce182bd1199e56b317bf2ec004b6a44f911f6", + "sha256:d43943ef777f9a1c42bf4e552ba23ac77a6351de620aa9acf64ad54933ad4d34", + "sha256:d5d33e9e7af3b34a40dc05f498939f0ebf187f07c385fd58d591c533ad8562fe", + "sha256:fc0fea399acb12edbf8a628ba8d2312f583bdbdb3335635db062fa98cf71fca4", + "sha256:fe460b922ec15dd205595c9b5b99e2f056fd98ae8f9f56b888e7a17dc2b757e7" + ], + "markers": "implementation_name == 'cpython' and python_version < '3.8'", + "version": "==1.4.1" + }, + "urllib3": { + "hashes": [ + "sha256:91056c15fa70756691db97756772bb1eb9678fa585d9184f24534b100dc60f4a", + "sha256:e7983572181f5e1522d9c98453462384ee92a0be7fac5f1413a1e35c56cc0461" + ], + "version": "==1.25.10" + }, + "wrapt": { + "hashes": [ + "sha256:b62ffa81fb85f4332a4f609cab4ac40709470da05643a082ec1eb88e6d9b97d7" + ], + "version": "==1.12.1" + }, + "zipp": { + "hashes": [ + "sha256:aa36550ff0c0b7ef7fa639055d797116ee891440eac1a56f378e2d3179e0320b", + "sha256:c599e4d75c98f6798c509911d08a22e6c021d074469042177c8c86fb92eefd96" + ], + "version": "==3.1.0" + } + } +} diff --git a/Packs/SimpleEmailReputation/Integrations/SimpleEmailReputation/README.md b/Packs/SimpleEmailReputation/Integrations/SimpleEmailReputation/README.md new file mode 100644 index 000000000000..e69de29bb2d1 diff --git a/Packs/SimpleEmailReputation/Integrations/SimpleEmailReputation/SimpleEmailReputation.py b/Packs/SimpleEmailReputation/Integrations/SimpleEmailReputation/SimpleEmailReputation.py new file mode 100644 index 000000000000..d4d939798efb --- /dev/null +++ b/Packs/SimpleEmailReputation/Integrations/SimpleEmailReputation/SimpleEmailReputation.py @@ -0,0 +1,141 @@ +import json +import traceback +from typing import Any, Dict, List, Optional, Tuple, Union, cast + +import dateparser +import demistomock as demisto # noqa: F401 +import urllib3 +from CommonServerPython import * # noqa: F401 + +# Disable insecure warnings +urllib3.disable_warnings() + +''' CLIENT CLASS ''' + + +class Client(BaseClient): + """Client class to interact with the service API + + This Client implements API calls, and does not contain any Demisto logic. + Should only do requests and return data. + It inherits from BaseClient defined in CommonServer Python. + Most calls use _http_request() that handles proxy, SSL verification, etc. + """ + + def get_email_reputation(self, email: str) -> Dict[str, Any]: + """Gets the email reputation using the API endpoint + + :type email: ``str`` + :param email: email address to get the reputation for + + :return: dict containing the email reputation as returned from the API + :rtype: ``Dict[str, Any]`` + """ + + return self._http_request( + method='GET', + url_suffix='/' + email, + ) + + +''' COMMAND FUNCTIONS ''' + + +def email_reputation_command(client: Client, args: Dict[str, Any]) -> List[CommandResults]: + """email command: Returns email reputation for a list of emails + + :type client: ``Client`` + :param Client: client to use + + :type args: ``Dict[str, Any]`` + :param args: + all command arguments, usually passed from ``demisto.args()``. + ``args['email']`` is a list of emails or a single email + + :return: + A ``CommandResults`` object that is then passed to ``return_results``, + that contains emails + + :rtype: ``CommandResults`` + """ + + emails = argToList(args.get('email')) + if len(emails) == 0: + raise ValueError('Email(s) not specified') + + # Initialize an empty list of CommandResults to return + # each CommandResult will contain context standard for email + command_results: List[CommandResults] = [] + + for email in emails: + em_data = client.get_email_reputation(email) + em_data['email'] = email + + readable_output = tableToMarkdown('Simple Email Reputation', em_data) + + command_results.append(CommandResults( + readable_output=readable_output, + outputs_prefix='Emailrep.email', + outputs_key_field=em_data['email'], + outputs=em_data + )) + return command_results + + +def test_module(client: Client): + em_data = client.get_email_reputation('test@test.com') + return em_data + + +''' MAIN FUNCTION ''' + + +def main() -> None: + """main function, parses params and runs command functions + + :return: + :rtype: + """ + api_key = demisto.params().get('apikey') + + # get the service API url + base_url = urljoin(demisto.params()['url']) + + # if your Client class inherits from BaseClient, SSL verification is + # handled out of the box by it, just pass ``verify_certificate`` to + # the Client constructor + verify_certificate = not demisto.params().get('insecure', False) + + # if your Client class inherits from BaseClient, system proxy is handled + # out of the box by it, just pass ``proxy`` to the Client constructor + proxy = demisto.params().get('proxy', False) + + demisto.debug(f'Command being called is {demisto.command()}') + try: + headers = { + 'Key': f'{api_key}' + } + client = Client( + base_url=base_url, + verify=verify_certificate, + headers=headers, + proxy=proxy) + + if demisto.command() == 'test-module': + # This is the call made when pressing the integration Test button. + result = test_module(client) + return_results("ok") + + elif demisto.command() == 'email': + return_results(email_reputation_command(client, demisto.args())) + + # Log exceptions and return errors + except Exception as e: + demisto.error(traceback.format_exc()) # print the traceback + return_error(f'Failed to execute {demisto.command()} command.\nError:\n{str(e)}') + + +''' ENTRY POINT ''' + +if __name__ in ('__main__', '__builtin__', 'builtins'): + main() diff --git a/Packs/SimpleEmailReputation/Integrations/SimpleEmailReputation/SimpleEmailReputation.yml b/Packs/SimpleEmailReputation/Integrations/SimpleEmailReputation/SimpleEmailReputation.yml new file mode 100644 index 000000000000..bd1e24126a03 --- /dev/null +++ b/Packs/SimpleEmailReputation/Integrations/SimpleEmailReputation/SimpleEmailReputation.yml @@ -0,0 +1,48 @@ +category: Data Enrichment & Threat Intelligence +commonfields: + id: Simple Email Reputation + version: -1 +configuration: +- defaultvalue: https://emailrep.io/ + display: 'Server URL ' + name: url + required: true + type: 0 +- display: API Key + name: apikey + required: true + type: 4 +- defaultvalue: "false" + display: Use system proxy settings + name: proxy + required: false + type: 8 +- defaultvalue: "false" + display: Trust any certificate (not secure) + name: insecure + required: false + type: 8 +description: |- + EmailRep is a system of crawlers, scanners and enrichment services that collects data on email addresses, domains, and internet personas. + + EmailRep uses hundreds of data points from social media profiles, professional networking sites, dark web credential leaks, data breaches, phishing kits, phishing emails, spam lists, open mail relays, domain age and reputation, deliverability, and more to predict the risk of an email address. +display: Simple Email Reputation +name: Simple Email Reputation +script: + commands: + - arguments: + - default: true + description: List of email + isArray: true + name: email + required: true + description: Return email information and reputation + name: email + dockerimage: demisto/python3:3.9.1.15759 + runonce: false + script: '' + subtype: python3 + type: python +fromversion: 6.0.0 +tests: +- No tests (auto formatted) diff --git a/Packs/SimpleEmailReputation/Integrations/SimpleEmailReputation/SimpleEmailReputation_image.png b/Packs/SimpleEmailReputation/Integrations/SimpleEmailReputation/SimpleEmailReputation_image.png new file mode 100644 index 0000000000000000000000000000000000000000..22be2dcaf247f7880dda9a9707a62fb4d4b0ad77 GIT binary patch literal 9945 zcmbVS1ydYKvjxJU!QC&eiv)KI?oM!bcMb0D5ZDmhf(4g_1(pCoH@LgITY$&+7hctP zbx+mQNT2RGaq6ma7-*zuaBy%K3i6*d-|LJ2WfY|MQcUMC{k=kUlmFrg2ZxULzYGue zt$_G_5Z+T$P71DWg8cBkgJ>(MA_)iAn1cS#8~_K$;G*zZQri#y6twP2KJPs=38KFp zNT&G{7RG~htBEC(R!(?`Xh+Jk_1C|R32qBHp28EEMrEN3iGfE|6zZLye9Ry>#uOJe7Z#INp%c8eZ)9OjT7NlBG zM0`a80HNhUV3mc%FZ2D?mn=$4f&to0-I#43e86&oy66K-eV8W`@^!y+}e>>#JKd z-9a7IjrNg*kTa?!D*D?rnmdl4UjaW5V(wGnnN@N%Z4OU`gq1eRNM`Xi-Ma?2C!r5X zDTxxMZK`O(R%}*DCp5FdEvA3_SM~2YySs5?lFy1ji$pEnK!L_`IXy^aB=+^-o~5Iq z{}}LiohdSet|{OhocNFVGs-!9&z;P|DtJ)iQ9~a>5|Aqb!pumJ%i-TjN7ofBk`PBS zCWeLoIzXe$>6iV>(#TyM+0?z;NI+@gYYy+YX~OK4yTUpr@Vjta(Kr>{pIpp+1fC|a zmXSTq;yIj+gtu`67?rwpg&SvugO_uNR;k`7Hr5!4vxa5@{4~N<)60X@>M^TRk<}nF zsJ>IIsdIIsuBWo*1oj_TcKUEQ87hkHxaI}fO+E|#@%UAi)581c+=SU4ZIZC_TzEWw zT~2P$E5>yGwt@0+cSU$}H~u7*KuCK^tac;^|kn zx*2>>(SEa1byPC?&FLX#Q^hXTgg=OzafC*BY)rC{n;7ABV=4Lw>@73dlr3SKB)Ifc zoIm?r@fy$D&6aG!a0KsQhZJ$v+IuGLD&h;2r1kHvsXKnQn zW`@6uA(BH~klsYrpvVG7JswFI?SW^s8TJ%A4#rj^+X{AW0rVWmymQENNFUNK6R~-V z_7N@uCv2YZNWI1xl2Ocw&L1?lmc34?inllNfh$NB$)19E^ws6;dE-m_?6!iGYP$2I zYyIfv_5T!g;-b>@3GkSX$xb7TcsCui!cJ;17b~TnWgHty4*t8iwXu7%J+X5rdkYs| zo(NO-VLyB3J6)KFv2D-HP*BKdo0iO+pgj9$q)6x1? z^0K(`8J9yRuMeSIGx~A$zkZV`*@n=<&wOpOuvW~XR04yIfS<`GU>)7%D%+c{nALMf z0TL;Qt!kIqK|Ol@elJ$~5M+(kj;^{%m#P*WW6A}DQ-{R~-ph=Z3;Th4^`IY@!TMpV zt7HW?OIYabIiDg82~rN~oSlrFb=fzRC-%Hj2BgH`2;F`o&#Sjzr?$CiH0VcHp8C(R zf|?IIZRNQ>5Y{9TYyfIw=0xOl8$!7Rb!s-V^kcdYg!Jy(P)!<5rr4~APe3GYOn#zm zKRxDYpMFa)n8#m*6Iw`P)^L10Y6!sgwHe;)xZWVUixtbY=>9=8?Y%?z5j$dT>O7=< ztS-xD=MW$oI&dU;2_;SI2P631-w*!4N;4iALKm_$YyIyu1pYa>^Ft4r3H!g-9Jr82 z55lD%4kXQBmKY+StA@ZY$3Z+?s3)k1vV$!pvgtnE+eE-k$ z4tPI={p0OTZvZ_Z8qF**8@t}xr!w0Iz^U^hjJR%iqbRB#9|9J6UcgVox07O2}$<}pFXX#czKnOG05&# zZUm1~d(+Dp0pYvih{!N)&__8P@w%&;v5O1_EKTv9)hmu`)FkN$+0Z3e7`Kj478JTU z^%hd|R#~xVxGPzIkF7e(8#CkRNkdw<1|RDvKk-w$x^SqCp8NI9gb5}R9*AaKo#T7d zY*i=54iGhf{oH$m^PZ#n`&;PWvc=o{-RVD*w}v`5jknuW4d$;0>CGEi9@axg|H69N>1fYq5X$&gcb(r!#bjhXxW-8uuj# z7{NP+tsrV$sp=Al4vpWf&GOT;1+Lsswsel)2Jp)?Cjpw1fKY4Pkv3l<({&++wjH;n zAh1B%8<^4o?{h9fYi)yKI(=?#UX;l2!0fhrCnfCQM&tGD-k8JgpUA{*rstka&u&uh zTUjVaPp3;-k?PKMC$`0)uHU<=vub*cX7_a}vVVZ=eSkw2aG?U`++LWfH=(Vnn(>Hf zc*;Gqd^k>D(CLPv0ulP-EWxxjJ{r(Um3R^0Y*}K*fQ)re%X9Qdln9QEa12FJg0$th zPdM_)jVN{3wag*I>KWj{n50WnV9c+>9Heh&dI&x}knj|elA%LgXpS@qa}=#v{%*0z zUU$!ar_LewUDW#Cb7Bxp;Y)!4u~sN2qEm+ZZ>MYM7|+9J#>or+nLYwA;9zUxY%KLj ze7-dGWh|?0SH*lHu>7g57kg^aA8SnZYoAs5C{csTU$h);2Akh~j6Km~2JP2Zj|5t8 zWI|t~PD12CKrYnFo=p+4*izj`gdT7=z-DU@t;W4xW4vrah?dSX6#LR%J%`Tmiqvm* zId!SW0zKxABTKNKMGsQme`!ovwcn+$!i&LfMw4_eUA*aY9d*dfscjp_rc^r9*utt+=I2l8Dj(jy z_JojZK)DkfvLY0FcFWYncryo2cO$*X*FcOmvVF)CTfiw|2)=Xr{IfSP5W-$IwRe1` zz~0fEVRV)LaxN6OLM@g96vPt4pyx!~g@sq3GAkK8LS(wF{p=~CDcLPVuX0^bm478u zH|^Fhk2>FWHY48*{b6ra#iPO%lG*O`Dumx@njVo^Smi#$)10}i)wjLB& zg4;j3^>Q=TgW5Jm_Jxgg*-KZfOK;1Pq=_bjvlKex_D%l(pRybab zKa?az)8t}Gp2MGV&$c)CIv3aFIREfCGuw*_V>=1m%h)qE4o z%hV6+hVkd-&2TSGYRbD?yXzqu0Yy0{~rmljVB%!d)5b9Pg;;A=BrMaWjwZP26D1auJ5U0lX!cVy5g>EB5LgA-GUs5!{__*@3NW{EL$!fY@E)ds^Rs3 zW80=5-O!(6UvV!^trOjBM#VrAk1H!k!OhIyrfQj8PTvY2G#EQKO4|SS2C=z2$t3y+ z;Bj+EQo+O#TJ!JsY@_#=4sYm;z{T8Htnv-CC@+OD@=fLBJhwNPfT2aPj^gcKz3a_) ziw3HZ%Nn~dxO%Q_UTMrzO0RT0tMk>laa4_YXoJFzn{sw+-;(=E6rJC$RYFkwg6#*V za-DS6q9!9;ouV&dV7vpY6$OpQ@JaPUIk_)bRi}U0pKXHMpAbw8a}|>g>~-LFJ{l4Wha4?NpNVTPY8VDLcT&J z-v^Ivdkg`S2PSW}T^P-Qm;4-ju5Vf?EKR6=M7z8<&u~rM<<}Qs#N5v$dD)MWt6$lcLrtijzS@n3QDNgJ^F; zlN{^qw1bomO#1j*6U9|krEsd+1u?n!eY@LgpMPND6S2I@&^9iV|!k26EB`$AqM17C$mOe^76YkcLX32!T*Vm~ZYD*Zu zAx%mSPg+y+YF3iZ;&IAKWPGgTPy-^)``3=c+mt_daOi}Ml>T-y#H_Ndjh>N89KB!o z9k#9E#sq@;eLZ>(W-&gmd)I7GxB=*2W_!<(xHe&t?62uNirNu2Z+}7)3v@EctDBa| z& zXtz381&Qi(5!q>Tb?f38dM?G+Nq>`ox6c+0d~7=^ z11W+*VcM(+`P#;h@jd0Wm5L{A3$aSFq z3Howa-tEIKAyb(gI-fH)JdV&)T;JFwm#o{oq;_nAB-R}`| zB8+OACOuUANvv&&`7TF}mdS{Y% z?_(S)qdhQbp|b|uf-N`*U=aKl1fT!0aNCck2(k*ol8>017K7&TbZ=+6x0(v(H=pAiBl6MjBr2$%6ifZ~T{jf&((B+x84ZAM|}iC8TE#47fWahZK%!;GjMMPzQG96-a`12&T$)GA5EXm! zO(7qgmwqO1d|l@2i%h1Fp5zG=vf}>&U=DKwBo3Zym$-n%Q$^D>%5s)}!Kl`ec59q$ zMl(ufcV2y;Ms5>R}1qwzu;X&dzJ?HeIz5wj+09fpwBHP?&U|7Lwhut3YS-i zWHnovi;!LJcw&jOCyMy)$ln(w?puz5E`tm4*T?BXS-3y{?s2F8d)TjgF7kt~?n;bd zcvUN{Yph$oACEUdDSkhJn{%bA5auYOF+^U?w7OXLirjEQRyWw?I z3j(WO+H4f?2sQ!nl!!`yRO(9Q8g&*wy8>aTi+xj>yoxxira=@M6y(>QHTT=BPBAaf;E233jdr&FYbVq9eeZYUH{YX**t6X5!iO`{XVgU6?LB$@l!8{d2=-_HTI?FY9 z<{tEtS%o$cak^gtGXJOA<%7$G7KU3FN-Js1;AX5^w8}K)FbK#v%ND@2MSdI+d<;Si z?!u-1iZG7zOuDs=wbN~i9krWEO*rsFq#s4@&xfjc`AtL-WCmRsK@7+F|86q_gxsB| z!c=grJDCTZjhBU6K0601O2^L^@!UABLp2C$rx5Uz9c`kE0!92n^OL5jB85VR2OPo*H6Yf4bOpG|*)(ZVN!}hSh(2Fl7(Cd&Y?}CFKq0U# zf@A*%`|y!g-=_s;L98|BwB%hBC$vSjX&}OUbbOvIy2Ym zb-Q$!NraCX)GDq5b3EgY2&@nu*BO5yaQ}Vid}cBW;Dpq{I(*3ky+#=-tEMY5hO6UU zCHu5=7W;+dQe0D*>_;%G&qvY7lpi2vM?*a&>K|$0y-mPDOUcA zmW%m$`a+6C<8b@e(+r)^lRTxha7#4$+P#^-ILlZJGrP^l=dc_ntRI0vBdQF|!>XBM zEacTcF>&T;vq`mn|M`!o57%jAK+q}rTMrsVOnFLu>)|7uFWK4(%B*g7K#n+I7S0rF zli|mwIbee%{>685(ACoj;pG8N#e9Sr+`ddY9g zd%a#Z3M~LO@;SI$j$v^J`&a}Y`Ajb%Ac+Q(+)^(g`O??+mFO77%-aeI5WDku1iC&~ znJdEeMn+6mK<0&41Go`2O!JbuxiSL1_(w<5e``z*{bk2xGD3gK09YL%_$30sCm9&) z+BfE)@X5oz0i@L0OmY=k4?1P|eQQuBmVc7qS?R}aqWn_Hkj#X}GwtQ&MIb|*jB$-JdA>j;fhD`mZc^Y?u-5a5 zW?)2pC1#a61U5t@T=GXSG91PCAyL~HvZ1@|$a&(`p`o61Z?wOpJ&&C;K9kA#;+DTM z6RJvwWyY6l6G|I`t)B3j;pesGv{T4UZFtliE7ysVyM}e-QSxJ6lb_rbUt0s@i8sT| zKqwrrkJK)FWaYCTv2KKiEw^x?!AL>%a6y79h%g-uVvnN&_hK7ETfKa$6jD26Ds;D zTWKy)gt@sTn2u5HCp(mJ|28V(@V5&@_K|YAXynMy|G2pdbhI;CE#DJYd|+DH`^((^ zb`fuM+(Y|zOP(9HoIDY=B;w9{`QZa8Q|>xUgIbte8K}zgY^KRF z?!e#MorJzIWiP^YL!fZzzrN<40}Gldz6GXbHT>V8k80%WsaolJ<{@u&B<)|?vGp`v zkA*!xU)e4!#?8*VFzV6_3GzIdd@%A_ixgHk)3#q*R$4$H#NoZ<*3buJ7+M+8Q?WWs zZ-kH7?1&X}UV#foTxn}Gp&SvxbnNL?YTX%4gI?wS3{LRV+%U^z0_8z%MRSYf0y7VC z+3kYmO3iAYL8aqD11d^KDaO~j-GX)|TwcYh2EVihfRk?D&Zq7&##{$X;dA?gfrGtb zLv0?z5|GAmzgTstHr{Io6Syi2KIOd zmm~bBd?XG1O2M*}qGq9cIw3(toFNX1Ek_-sI8p*Hp$wf-J}TJ<1O~>hM*Dp`*UBAP z|B=Qj#*z&AC~(&4{Vr;rL}R{bi8n3CDHg=A`>dCos?olDB#X<)5w&J+CG~)iEDRWr z7)f)7MvNlfB9Mk{Qcqh%%E9;(Wg_IpD$$sYY;U9De|resjKQuohl&1@>ElS95uDiz zTJ;#*QeSUJa+r0)jp%Y=UYkAnL+p_Q=#me^`aw>@m zwxM0lGwPHZaCp;in2rT=tRy<*E@|vn)b%Uk8UQk|i6~-VHy(0SD#(64s{1Mta%OL5 zfz_M;rPNW6X>Vh2e|0yosZpzN9OBP97z2P#f;ayW%8@xF3ttw8+@%`#^b=HXgSq4v>Se8(4f#fp&)6Q!A<&btfXJdV}F5?cM%s- z`sq&w16C7a%;~*YpN6(EJ$(z-4GQ^+`NzTQ}(w`K>Ui3gpEz=;2u&E?E#&*A{cJya(;q6S)`0t|LsEyC4*#*)xh zb4BtwAi5FD<^vfY^()HA$~SQ*qqmKS@f1MGhdy*AONi_hn>^c}y%SffTEJ55jDjsM zX*tHSGeWiK8J?_2d%^EezR7>6?AJ*F!x#HfIVfdy3$d%V9HgBJ6O}x@lQ@S=+j>(7 z*xKD;_DeNk-_X=!9Sg0?WsJ2{wxuabxw1CzZkXF&qpVg(IT|)?mhgpf5=CUe-ME4` zuAlgJ{Sp^&`s90D?d*zjT;7P46EkD2MFH<tw`GT$2#sm82L<;7TT6+n^~iO_xa~hhVi!xD!i-ZCHr3|qG?aLN2vO8 z)fJ{z4B4Mz-Y|_g%Ch%oXFD4ba>pFAB_Cz0k_N~#466TmIdMDp`+EPCkLs@3AGTA> ziCeVI!P839{4)geh90zrTwD)H0ZcI?j+L(em?cHyn~9vAusRtu{X7cG$l3K@4X&KQ zIAA}syrFU+0=N#-8EYGcfk5Jr)P=}Z^G8=KJb}xP5YuEh9x>H6cHW@6$@LHIjJ?T} zS&NqxkF1uVv^cNIW>@=D=h|A3;idk}L_b&2E%{tJVxX&E3-aL80n-wvo0w79M4Xap z60#5PD65;)ci)x9&7x;=i7#Dfmq-u2s=v}_Z@otIT15sJ$VKO(>q}8$q6jx7p`aUE zjE%m5&LD@*B%b)+ci*TY?M8d+`;+~MNbhmC$)uwy>q5CXNqxI?bhQd?*Y_dR)WMDO zYTIFpf;iN5{qsG1=W5X0FChZJ!HejBt0n4)LhiBQYj1)_U!;tKD^}Fq?b%h?{Ydf< z6>kAX_zWQFg(IIWXk}CCTn^!m;P_E3IDziF#zTL9 zP)6ziH34OU;FafXgA?>ciIh>2YKQly9iy}`Xlz+G%*^5Qv4`wlq(GJ_5-RO_N{5st z_>FmHpK#tkJzk@`17XCqZbB6`v^&t+N=7q%2*Ux0;N!o@-GarK0b1FRYuO;+)+)z( z_&Yc{8^;1q?yFPBuI@HpK2fY)2FwVFtf!p#{u> z9A6~4vgAciO6Szr@1YI#SxgVhMAl=ldrFFI zfLF9#iDt?CZ>i!5Y(LyN2L!tJdSmZW(ZxuHh;dFTMmW?5?k$XdqCK%a)#l*p@WP~b zFcJCa+W)d7(Y$s0fz8Zx0mC}D4NjGLK)8tyIs_XyDta&`^muruxLAl$O%w&%!E<+? z2im<^QtQDHHmErbW~9WfbM@qrE2pHU{ONtgVC+H&2b_?BGia7xaxpA}6NudliSGZV zo2r~HdLzCSNNiKyG%d>zn8ELdCFLWf$HaEcN!LjqQEGmQ^h%_$sl;T-L=SY zL{Wk_hX2zGsS({DS>_a(2?xbymR6;im zFB#<)Yv9C?eQ#=G-Ev`S6!8ZJB0o$co=k_@U%>^Ps-#U-dBR&BwN3+zqm%I46v^+r zq`mKfX?`J@1Mi$BQ-%ZLPl9b##*Eu+EZeaVc9!Gd)Liln6eETJV?tUZisn&h{cLu* z|H=7|B0r1TXfN1eLnKcgUTqX-unXcB0~pJl_Wll~z?!%lbEoS4j%&@w$z|y%01*KY za&G@F`93A^jaUoGdx^lKst{;Q^8e#(MZ-UY5d0U`h^;}__Rd6uQ;<>pTqk7~{(pGF BcpU%$ literal 0 HcmV?d00001 diff --git a/Packs/SimpleEmailReputation/README.md b/Packs/SimpleEmailReputation/README.md new file mode 100644 index 000000000000..e69de29bb2d1 diff --git a/Packs/SimpleEmailReputation/pack_metadata.json b/Packs/SimpleEmailReputation/pack_metadata.json new file mode 100644 index 000000000000..f6bceabc63a1 --- /dev/null +++ b/Packs/SimpleEmailReputation/pack_metadata.json @@ -0,0 +1,17 @@ +{ + "name": "Simple Email Reputation", + "description": "EmailRep is a system of crawlers, scanners and enrichment services that collects data on email addresses, domains, and internet personas. EmailRep uses hundreds of data points from social media profiles, professional networking sites, dark web credential leaks, data breaches, phishing kits, phishing emails, spam lists, open mail relays, domain age and reputation, deliverability, and more to predict the risk of an email address.", + "support": "community", + "currentVersion": "1.0.0", + "author": "DNB Bank ASA", + "url": "", + "email": "", + "created": "2021-02-04T14:50:24Z", + "categories": [], + "tags": [], + "useCases": [], + "keywords": [], + "githubUser": [ + "znuf" + ] +} \ No newline at end of file From 78bb642c6343c4da0dcf6683595e6f65bd57a265 Mon Sep 17 00:00:00 2001 From: znuf Date: Mon, 8 Feb 2021 09:14:32 -0500 Subject: [PATCH 2/4] Update SimpleEmailReputation.py --- .../SimpleEmailReputation/SimpleEmailReputation.py | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/Packs/SimpleEmailReputation/Integrations/SimpleEmailReputation/SimpleEmailReputation.py b/Packs/SimpleEmailReputation/Integrations/SimpleEmailReputation/SimpleEmailReputation.py index d4d939798efb..74d2a4806741 100644 --- a/Packs/SimpleEmailReputation/Integrations/SimpleEmailReputation/SimpleEmailReputation.py +++ b/Packs/SimpleEmailReputation/Integrations/SimpleEmailReputation/SimpleEmailReputation.py @@ -1,8 +1,6 @@ -import json import traceback -from typing import Any, Dict, List, Optional, Tuple, Union, cast +from typing import Any, Dict, List -import dateparser import demistomock as demisto # noqa: F401 import urllib3 from CommonServerPython import * # noqa: F401 @@ -83,8 +81,8 @@ def email_reputation_command(client: Client, args: Dict[str, Any]) -> List[Comma def test_module(client: Client): - em_data = client.get_email_reputation('test@test.com') - return em_data + client.get_email_reputation('test@test.com') + return 'ok' ''' MAIN FUNCTION ''' @@ -123,8 +121,8 @@ def main() -> None: if demisto.command() == 'test-module': # This is the call made when pressing the integration Test button. - result = test_module(client) - return_results("ok") + res = test_module(client) + return_results(res) elif demisto.command() == 'email': return_results(email_reputation_command(client, demisto.args())) From 330d88780148e25c1e82083dcbee11a4f080b8e0 Mon Sep 17 00:00:00 2001 From: znuf Date: Mon, 8 Feb 2021 09:16:30 -0500 Subject: [PATCH 3/4] Update SimpleEmailReputation.yml --- .../SimpleEmailReputation/SimpleEmailReputation.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Packs/SimpleEmailReputation/Integrations/SimpleEmailReputation/SimpleEmailReputation.yml b/Packs/SimpleEmailReputation/Integrations/SimpleEmailReputation/SimpleEmailReputation.yml index bd1e24126a03..1c7adbd0fbb9 100644 --- a/Packs/SimpleEmailReputation/Integrations/SimpleEmailReputation/SimpleEmailReputation.yml +++ b/Packs/SimpleEmailReputation/Integrations/SimpleEmailReputation/SimpleEmailReputation.yml @@ -32,9 +32,9 @@ script: commands: - arguments: - default: true - description: List of email + description: A List of email addresses - comma separated isArray: true - name: email + name: emailrep-get-reputation required: true description: Return email information and reputation name: email From 05cbaeb8a84264dbc4085d281e83dc08d9129583 Mon Sep 17 00:00:00 2001 From: znuf Date: Mon, 8 Feb 2021 09:20:54 -0500 Subject: [PATCH 4/4] Update SimpleEmailReputation.py --- .../Integrations/SimpleEmailReputation/SimpleEmailReputation.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Packs/SimpleEmailReputation/Integrations/SimpleEmailReputation/SimpleEmailReputation.py b/Packs/SimpleEmailReputation/Integrations/SimpleEmailReputation/SimpleEmailReputation.py index d4d939798efb..bd7423fca554 100644 --- a/Packs/SimpleEmailReputation/Integrations/SimpleEmailReputation/SimpleEmailReputation.py +++ b/Packs/SimpleEmailReputation/Integrations/SimpleEmailReputation/SimpleEmailReputation.py @@ -126,7 +126,7 @@ def main() -> None: result = test_module(client) return_results("ok") - elif demisto.command() == 'email': + elif demisto.command() == 'emailrep-get-reputation': return_results(email_reputation_command(client, demisto.args())) # Log exceptions and return errors