Skip to content

Commit 3ec141d

Browse files
nusantara-selfnusantara-self
authored
Merge pull request #1393 from avadhsonagara/feat/googlethreatintelligence
Add Google Threat Intelligence (GTI) analyzers
2 parents d57ea29 + f501ee1 commit 3ec141d

35 files changed

Lines changed: 7320 additions & 0 deletions

‎analyzers/GoogleThreatIntelligence/Dockerfile‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
FROM python:3-alpine
2+
3+
WORKDIR /worker
4+
5+
# install runtime dependencies.
6+
RUN apk add --no-cache perl-image-exiftool file-dev
7+
8+
COPY requirements.txt GoogleThreatIntelligence/
9+
10+
# Install Python dependencies from requirements.txt
11+
RUN test ! -e GoogleThreatIntelligence/requirements.txt || pip install --no-cache-dir -r GoogleThreatIntelligence/requirements.txt
12+
13+
COPY . GoogleThreatIntelligence
14+
15+
ENTRYPOINT ["python", "GoogleThreatIntelligence/gti.py"]

‎analyzers/GoogleThreatIntelligence/GTI_GetIOCReport.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"name": "GTI_GetIOCReport",
3+
"version": "1.0",
4+
"author": "Google",
5+
"url": "https://github.com/TheHive-Project/Cortex-Analyzers",
6+
"license": "AGPL-V3",
7+
"description": "Get the latest Google Threat Intelligence report for a file, hash, url, domain or an IP address.",
8+
"dataTypeList": [ "file", "hash", "domain", "fqdn", "ip", "url"],
9+
"command": "GoogleThreatIntelligence/gti.py",
10+
"baseConfig": "GTI_GetReport",
11+
"config": {
12+
"service": "get"
13+
},
14+
"configurationItems": [
15+
{
16+
"name": "gti_api_key",
17+
"description": "API key for Google Threat Intelligence.",
18+
"type": "string",
19+
"multi": false,
20+
"required": true
21+
}
22+
],
23+
"registration_required": true,
24+
"subscription_required": false,
25+
"service_homepage": "https://www.virustotal.com/",
26+
"service_logo": {
27+
"path": "assets/googlethreatintelligence_logo.png",
28+
"caption": "logo"
29+
},
30+
"screenshots": [
31+
{
32+
"path": "assets/get_ioc_report_summary.png",
33+
"caption": "GooogleThreatIntelligence: summary report"
34+
},
35+
{
36+
"path": "assets/get_ioc_report_full_report.png",
37+
"caption": "GooogleThreatIntelligence: long report"
38+
}
39+
]
40+
}

‎analyzers/GoogleThreatIntelligence/GTI_ScanFile.json‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
{
2+
"name": "GTI_ScanFile",
3+
"version": "1.0",
4+
"author": "Google",
5+
"url": "https://github.com/TheHive-Project/Cortex-Analyzers",
6+
"license": "AGPL-V3",
7+
"description": "Get the latest Google Threat Intelligence report for a file that was submitted to Google Threat Intelligence for scanning",
8+
"dataTypeList": ["file"],
9+
"command": "GoogleThreatIntelligence/gti.py",
10+
"baseConfig": "GTI_ScanFile",
11+
"config": {
12+
"service": "scan"
13+
},
14+
"configurationItems": [
15+
{
16+
"name": "gti_api_key",
17+
"description": "API key for Google Threat Intelligence.",
18+
"type": "string",
19+
"multi": false,
20+
"required": true
21+
},
22+
{
23+
"name": "password",
24+
"description": "Password used to decompress and scan files contained within password-protected ZIP archives.",
25+
"type": "string",
26+
"multi": false,
27+
"required": false
28+
}
29+
],
30+
"registration_required": true,
31+
"subscription_required": false,
32+
"service_homepage": "https://www.virustotal.com/",
33+
"service_logo": {
34+
"path": "assets/googlethreatintelligence_logo.png",
35+
"caption": "logo"
36+
},
37+
"screenshots": [
38+
{
39+
"path": "assets/scan_file_summary.png",
40+
"caption": "GooogleThreatIntelligence: summary report"
41+
},
42+
{
43+
"path": "assets/scan_file_full_report.png",
44+
"caption": "GooogleThreatIntelligence: long report"
45+
}
46+
]
47+
}

‎analyzers/GoogleThreatIntelligence/GTI_ScanPrivateFile.json‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
{
2+
"name": "GTI_ScanPrivateFile",
3+
"version": "1.0",
4+
"author": "Google",
5+
"url": "https://github.com/TheHive-Project/Cortex-Analyzers",
6+
"license": "AGPL-V3",
7+
"description": "Get the latest Google Threat Intelligence report for a file that was privately submitted to Google Threat Intelligence for scanning",
8+
"dataTypeList": ["file"],
9+
"command": "GoogleThreatIntelligence/gti.py",
10+
"baseConfig": "GTI_ScanPrivateFile",
11+
"config": {
12+
"service": "privateScan"
13+
},
14+
"configurationItems": [
15+
{
16+
"name": "gti_api_key",
17+
"description": "API key for Google Threat Intelligence.",
18+
"type": "string",
19+
"multi": false,
20+
"required": true
21+
},
22+
{
23+
"name": "password",
24+
"description": "Password used to decompress and scan files contained within password-protected ZIP archives.",
25+
"type": "string",
26+
"multi": false,
27+
"required": false
28+
},
29+
{
30+
"name": "command_line",
31+
"description": "Command-line arguments to be used when executing the file in sandbox environments.",
32+
"type": "string",
33+
"multi": false,
34+
"required": false
35+
},
36+
{
37+
"name": "disable_sandbox",
38+
"description": "If true, the file will not be detonated in sandbox environments.",
39+
"type": "boolean",
40+
"multi": false,
41+
"required": false,
42+
"defaultValue": false
43+
},
44+
{
45+
"name": "enable_internet",
46+
"description": "Specifies whether the file should have internet access while running in sandbox environments.",
47+
"type": "boolean",
48+
"multi": false,
49+
"required": false,
50+
"defaultValue": false
51+
},
52+
{
53+
"name": "retention_period_days",
54+
"description": "Number of days the report and file are retained in VirusTotal (1–28). If not set, the group's retention policy is applied.",
55+
"type": "number",
56+
"multi": false,
57+
"required": false,
58+
"defaultValue": 1
59+
},
60+
{
61+
"name": "interaction_sandbox",
62+
"description": "Specifies the sandbox to use for interactive analysis. Allowed values: cape_win, cape_linux.",
63+
"type": "string",
64+
"multi": false,
65+
"required": false
66+
},
67+
{
68+
"name": "interaction_timeout",
69+
"description": "Timeout for interactive sessions, in seconds. Minimum: 60 (1 minute), Maximum: 1800 (30 minutes).",
70+
"type": "number",
71+
"multi": false,
72+
"required": false,
73+
"defaultValue": 60
74+
},
75+
{
76+
"name": "locale",
77+
"description": "Preferred sandbox locale. On Windows, this sets the analysis machine’s language and keyboard settings. Allowed values: EN_US, AR_SA, DE_DE, ES_ES, PT_BR.",
78+
"type": "string",
79+
"multi": false,
80+
"required": false,
81+
"defaultValue": "EN_US"
82+
},
83+
{
84+
"name": "storage_region",
85+
"description": "Region where files will be stored. If not provided, uses the group's private_scanning.storage_region setting. Allowed values: US, CA, EU, GB.",
86+
"type": "string",
87+
"multi": false,
88+
"required": false
89+
}
90+
],
91+
"registration_required": true,
92+
"subscription_required": true,
93+
"service_homepage": "https://www.virustotal.com/",
94+
"service_logo": {
95+
"path": "assets/googlethreatintelligence_logo.png",
96+
"caption": "logo"
97+
},
98+
"screenshots": [
99+
{
100+
"path": "assets/scan_private_file_summary.png",
101+
"caption": "GooogleThreatIntelligence: summary report"
102+
},
103+
{
104+
"path": "assets/scan_private_file_full_report.png",
105+
"caption": "GooogleThreatIntelligence: long report"
106+
}
107+
]
108+
}

‎analyzers/GoogleThreatIntelligence/GTI_ScanPrivateURL.json‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
{
2+
"name": "GTI_ScanPrivateURL",
3+
"version": "1.0",
4+
"author": "Google",
5+
"url": "https://github.com/TheHive-Project/Cortex-Analyzers",
6+
"license": "AGPL-V3",
7+
"description": "Get the latest Google Threat Intelligence report for a URL that was privately submitted to Google Threat Intelligence for scanning",
8+
"dataTypeList": ["url"],
9+
"command": "GoogleThreatIntelligence/gti.py",
10+
"baseConfig": "GTI_ScanPrivateURL",
11+
"config": {
12+
"service": "privateScan"
13+
},
14+
"configurationItems": [
15+
{
16+
"name": "gti_api_key",
17+
"description": "API key for Google Threat Intelligence.",
18+
"type": "string",
19+
"multi": false,
20+
"required": true
21+
},
22+
{
23+
"name": "sandboxes",
24+
"description": "Comma-separated list of sandbox environments to use. e.g., chrome_headless_linux,cape_win,zenbox_windows.",
25+
"type": "string",
26+
"multi": false,
27+
"required": false
28+
},
29+
{
30+
"name": "retention_period_days",
31+
"description": "Number of days the report and URL are retained in VirusTotal (1–28). If not set, the group's retention policy is applied.",
32+
"type": "number",
33+
"multi": false,
34+
"required": false,
35+
"defaultValue": 1
36+
},
37+
{
38+
"name": "storage_region",
39+
"description": "Region where the URL will be stored. Defaults to the group's private_scanning.storage_region setting. Allowed values: US, CA, EU, GB.",
40+
"type": "string",
41+
"multi": false,
42+
"required": false
43+
},
44+
{
45+
"name": "interaction_timeout",
46+
"description": "Timeout for interactive sandbox sessions, in seconds. Minimum: 60 (1 minute), Maximum: 1800 (30 minutes).",
47+
"type": "number",
48+
"multi": false,
49+
"required": false,
50+
"defaultValue": 60
51+
}
52+
],
53+
"registration_required": true,
54+
"subscription_required": true,
55+
"service_homepage": "https://www.virustotal.com/",
56+
"service_logo": {
57+
"path": "assets/googlethreatintelligence_logo.png",
58+
"caption": "logo"
59+
},
60+
"screenshots": [
61+
{
62+
"path": "assets/scan_private_url_summary.png",
63+
"caption": "GooogleThreatIntelligence: summary report"
64+
},
65+
{
66+
"path": "assets/scan_private_url_full_report.png",
67+
"caption": "GooogleThreatIntelligence: long report"
68+
}
69+
]
70+
}

‎analyzers/GoogleThreatIntelligence/GTI_ScanURL.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"name": "GTI_ScanURL",
3+
"version": "1.0",
4+
"author": "Google",
5+
"url": "https://github.com/TheHive-Project/Cortex-Analyzers",
6+
"license": "AGPL-V3",
7+
"description": "Get the latest Google Threat Intelligence report for a URL that was submitted to Google Threat Intelligence for scanning",
8+
"dataTypeList": ["url"],
9+
"command": "GoogleThreatIntelligence/gti.py",
10+
"baseConfig": "GTI_ScanURL",
11+
"config": {
12+
"service": "scan"
13+
},
14+
"configurationItems": [
15+
{
16+
"name": "gti_api_key",
17+
"description": "API key for Google Threat Intelligence.",
18+
"type": "string",
19+
"multi": false,
20+
"required": true
21+
}
22+
],
23+
"registration_required": true,
24+
"subscription_required": false,
25+
"service_homepage": "https://www.virustotal.com/",
26+
"service_logo": {
27+
"path": "assets/googlethreatintelligence_logo.png",
28+
"caption": "logo"
29+
},
30+
"screenshots": [
31+
{
32+
"path": "assets/scan_url_summary.png",
33+
"caption": "GooogleThreatIntelligence: summary report"
34+
},
35+
{
36+
"path": "assets/scan_url_full_report.png",
37+
"caption": "GooogleThreatIntelligence: long report"
38+
}
39+
]
40+
}

0 commit comments

Comments
 (0)