Skip to content

Commit f7483e8

Browse files
author
marcobizzarr1
committed
APIs refactoring
- Modified sandbox.sample_result , migrated to intel.sample_result - Modified sandbox.sample_report , now downloads full sample report, it doesn't accept anymore filters + Added intel.sample_info, accepting report filters previously handled by the previous sandbox.sample_report
1 parent 5d38267 commit f7483e8

File tree

5 files changed

+150
-139
lines changed

5 files changed

+150
-139
lines changed

‎README.md‎

Lines changed: 11 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -69,24 +69,27 @@ if result.status == SUCCESS:
6969
time.sleep(1)
7070
```
7171

72-
To retrieve scan result of a specific MD5
72+
To retrieve full scan report for a specific MD5
7373

7474
```python
7575
from deepviz import sandbox
7676
sbx = sandbox.Sandbox()
77-
result = sbx.sample_result(md5="MD5-hash", api_key="my-api-key")
78-
status = result.msg['classification']['result']
79-
accuracy = result.msg['classification']['accuracy']
80-
print "STATUS: %s ACCURACY: %s" % (status, accuracy)
77+
result = sbx.sample_report(md5="MD5-hash", api_key="my-api-key")
78+
print result
8179
```
8280

83-
To retrieve full scan report for a specific MD5
81+
# Threat Intelligence SDK API
82+
83+
To retrieve scan result of a specific MD5
8484

8585
```python
8686
from deepviz import sandbox
8787
sbx = sandbox.Sandbox()
88-
result = sbx.sample_report(md5="MD5-hash", api_key="my-api-key")
89-
print result
88+
result = sbx.sample_result(md5="MD5-hash", api_key="my-api-key")
89+
status = result.msg['classification']['result']
90+
accuracy = result.msg['classification']['accuracy']
91+
92+
print "STATUS: %s ACCURACY: %s" % (status, accuracy)
9093
```
9194

9295
To retrieve only specific parts of the report of a specific MD5 scan
@@ -95,24 +98,8 @@ To retrieve only specific parts of the report of a specific MD5 scan
9598
from deepviz import sandbox
9699
sbx = sandbox.Sandbox()
97100
result = sbx.sample_report(md5="MD5-hash", api_key="my-api-key", filters=["classification","rules"])
98-
99-
# List of the optional filters - they can be combined together
100-
# "network_ip",
101-
# "network_ip_tcp",
102-
# "network_ip_udp",
103-
# "rules",
104-
# "classification",
105-
# "created_process",
106-
# "hook_user_mode",
107-
# "strings",
108-
# "created_files",
109-
# "hash",
110-
# "info",
111-
# "code_injection"
112-
113101
print result
114102
```
115-
# Threat Intelligence SDK API
116103

117104
To retrieve intel data about one or more IPs:
118105

‎deepviz/intel.py‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
import simplejson as json
99

1010

11+
URL_INTEL_REPORT = "https://api.deepviz.com/intel/report"
1112
URL_INTEL_SEARCH = "https://api.deepviz.com/intel/search"
1213
URL_INTEL_IP = "https://api.deepviz.com/intel/network/ip"
1314
URL_INTEL_DOMAIN = "https://api.deepviz.com/intel/network/domain"
@@ -19,6 +20,62 @@ class Intel:
1920
def __init__(self):
2021
pass
2122

23+
def sample_info(self, md5=None, api_key=None, filters=None):
24+
if not api_key:
25+
return Result(status=INPUT_ERROR, msg="API key cannot be null or empty String")
26+
27+
if not md5:
28+
return Result(status=INPUT_ERROR, msg="MD5 cannot be null or empty String")
29+
30+
if not filters:
31+
return Result(status=INPUT_ERROR, msg="filters cannot be null or empty")
32+
33+
if len(filters) > 10:
34+
return Result(status=INPUT_ERROR, msg="Parameter 'filters' takes at most 10 values ({count} given).".format(count=len(filters)))
35+
36+
body = json.dumps(
37+
{
38+
"md5": md5,
39+
"api_key": api_key,
40+
"output_filters": filters
41+
}
42+
)
43+
44+
try:
45+
r = requests.post(URL_INTEL_REPORT, data=body)
46+
except Exception as e:
47+
return Result(status=NETWORK_ERROR, msg="Error while connecting to Deepviz: %s" % e)
48+
49+
try:
50+
data = json.loads(r.content)
51+
except Exception as e:
52+
return Result(status=INTERNAL_ERROR, msg="Error loading Deepviz response: %s" % e)
53+
54+
if r.status_code == 428:
55+
return Result(status=PROCESSING, msg="Analysis is running")
56+
else:
57+
try:
58+
data = json.loads(r.content)
59+
except Exception as e:
60+
return Result(status=INTERNAL_ERROR, msg="Error loading Deepviz response: %s" % e)
61+
62+
if r.status_code == 200:
63+
return Result(status=SUCCESS, msg=data['data'])
64+
else:
65+
if r.status_code >= 500:
66+
return Result(status=SERVER_ERROR, msg="{status_code} - Error while connecting to Deepviz: {errmsg}".format(status_code=r.status_code, errmsg=data['errmsg']))
67+
else:
68+
return Result(status=CLIENT_ERROR, msg="{status_code} - Error while connecting to Deepviz: {errmsg}".format(status_code=r.status_code, errmsg=data['errmsg']))
69+
70+
def sample_result(self, md5=None, api_key=None):
71+
if not api_key:
72+
return Result(status=INPUT_ERROR, msg="API key cannot be null or empty String")
73+
74+
if not md5:
75+
return Result(status=INPUT_ERROR, msg="MD5 cannot be null or empty String")
76+
77+
return self.sample_info(md5, api_key, ["classification"])
78+
2279
def ip_info(self, api_key=None, ip=None, time_delta=None, history=False):
2380
if not api_key:
2481
return Result(status=INPUT_ERROR, msg="API key cannot be null or empty String")

‎deepviz/sandbox.py‎

Lines changed: 42 additions & 82 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,8 @@
77
except:
88
import simplejson as json
99

10+
URL_SAMPLE_REPORT = "https://api.deepviz.com/general/report"
1011
URL_UPLOAD_SAMPLE = "https://api.deepviz.com/sandbox/submit"
11-
URL_DOWNLOAD_REPORT = "https://api.deepviz.com/general/report"
1212
URL_DOWNLOAD_SAMPLE = "https://api.deepviz.com/sandbox/sample"
1313
URL_DOWNLOAD_BULK = "https://api.deepviz.com/sandbox/sample/bulk/retrieve"
1414
URL_REQUEST_BULK = "https://api.deepviz.com/sandbox/sample/bulk/request"
@@ -19,6 +19,47 @@ class Sandbox:
1919
def __init__(self):
2020
pass
2121

22+
def sample_report(self, md5=None, api_key=None):
23+
if not api_key:
24+
return Result(status=INPUT_ERROR, msg="API key cannot be null or empty String")
25+
26+
if not md5:
27+
return Result(status=INPUT_ERROR, msg="MD5 cannot be null or empty String")
28+
29+
body = json.dumps(
30+
{
31+
"md5": md5,
32+
"api_key": api_key
33+
}
34+
)
35+
36+
try:
37+
r = requests.post(URL_SAMPLE_REPORT, data=body)
38+
except Exception as e:
39+
return Result(status=NETWORK_ERROR, msg="Error while connecting to Deepviz: %s" % e)
40+
41+
try:
42+
data = json.loads(r.content)
43+
except Exception as e:
44+
return Result(status=INTERNAL_ERROR, msg="Error loading Deepviz response: %s" % e)
45+
46+
if r.status_code == 428:
47+
return Result(status=PROCESSING, msg="Analysis is running")
48+
else:
49+
try:
50+
data = json.loads(r.content)
51+
except Exception as e:
52+
return Result(status=INTERNAL_ERROR, msg="Error loading Deepviz response: %s" % e)
53+
54+
if r.status_code == 200:
55+
return Result(status=SUCCESS, msg=data['data'])
56+
else:
57+
if r.status_code >= 500:
58+
return Result(status=SERVER_ERROR, msg="{status_code} - Error while connecting to Deepviz: {errmsg}".format(status_code=r.status_code, errmsg=data['errmsg']))
59+
else:
60+
return Result(status=CLIENT_ERROR, msg="{status_code} - Error while connecting to Deepviz: {errmsg}".format(status_code=r.status_code, errmsg=data['errmsg']))
61+
62+
2263
def upload_sample(self, path=None, api_key=None):
2364
if not path:
2465
return Result(status=INPUT_ERROR, msg="File path cannot be null or empty String")
@@ -150,87 +191,6 @@ def download_sample(self, md5=None, path=None, api_key=None):
150191
return Result(status=CLIENT_ERROR, msg="{status_code} - Error while connecting to Deepviz: {errmsg}".format(status_code=r.status_code, errmsg=data['errmsg']))
151192

152193

153-
def sample_result(self, md5=None, api_key=None):
154-
if not api_key:
155-
return Result(status=INPUT_ERROR, msg="API key cannot be null or empty String")
156-
157-
if not md5:
158-
return Result(status=INPUT_ERROR, msg="MD5 cannot be null or empty String")
159-
160-
body = json.dumps(
161-
{
162-
"api_key": api_key,
163-
"md5": md5,
164-
"output_filters": ["classification"]
165-
}
166-
)
167-
try:
168-
r = requests.post(URL_DOWNLOAD_REPORT, data=body)
169-
except Exception as e:
170-
return Result(status=NETWORK_ERROR, msg="Error while connecting to Deepviz: %s" % e)
171-
172-
if r.status_code == 428:
173-
return Result(status=PROCESSING, msg="Analysis is running")
174-
else:
175-
try:
176-
data = json.loads(r.content)
177-
except Exception as e:
178-
return Result(status=INTERNAL_ERROR, msg="Error loading Deepviz response: %s" % e)
179-
180-
if r.status_code == 200:
181-
return Result(status=SUCCESS, msg=data['data'])
182-
else:
183-
if r.status_code >= 500:
184-
return Result(status=SERVER_ERROR, msg="{status_code} - Error while connecting to Deepviz: {errmsg}".format(status_code=r.status_code, errmsg=data['errmsg']))
185-
else:
186-
return Result(status=CLIENT_ERROR, msg="{status_code} - Error while connecting to Deepviz: {errmsg}".format(status_code=r.status_code, errmsg=data['errmsg']))
187-
188-
189-
def sample_report(self, md5=None, api_key=None, filters=None):
190-
if not api_key:
191-
return Result(status=INPUT_ERROR, msg="API key cannot be null or empty String")
192-
193-
if not md5:
194-
return Result(status=INPUT_ERROR, msg="MD5 cannot be null or empty String")
195-
196-
if not filters:
197-
body = json.dumps(
198-
{
199-
"api_key": api_key,
200-
"md5": md5
201-
}
202-
)
203-
else:
204-
body = json.dumps(
205-
{
206-
"md5": md5,
207-
"api_key": api_key,
208-
"output_filters": filters
209-
}
210-
)
211-
212-
try:
213-
r = requests.post(URL_DOWNLOAD_REPORT, data=body)
214-
except Exception as e:
215-
return Result(status=NETWORK_ERROR, msg="Error while connecting to Deepviz: %s" % e)
216-
217-
if r.status_code == 428:
218-
return Result(status=PROCESSING, msg="Analysis is running")
219-
else:
220-
try:
221-
data = json.loads(r.content)
222-
except Exception as e:
223-
return Result(status=INTERNAL_ERROR, msg="Error loading Deepviz response: %s" % e)
224-
225-
if r.status_code == 200:
226-
return Result(status=SUCCESS, msg=data['data'])
227-
else:
228-
if r.status_code >= 500:
229-
return Result(status=SERVER_ERROR, msg="{status_code} - Error while connecting to Deepviz: {errmsg}".format(status_code=r.status_code, errmsg=data['errmsg']))
230-
else:
231-
return Result(status=CLIENT_ERROR, msg="{status_code} - Error while connecting to Deepviz: {errmsg}".format(status_code=r.status_code, errmsg=data['errmsg']))
232-
233-
234194
def bulk_download_request(self, md5_list=None, api_key=None):
235195
if not api_key:
236196
return Result(status=INPUT_ERROR, msg="API key cannot be null or empty String")

0 commit comments

Comments
 (0)