Skip to content

Commit e446541

Browse files
karand-metronkarand-metron
committed
implemented search-domain command
1 parent 707d212 commit e446541

File tree

2 files changed

+169
-135
lines changed

2 files changed

+169
-135
lines changed

‎Packs/SilentPush/Integrations/SilentPush/SilentPush.py

Lines changed: 71 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313

1414
import requests
1515
import urllib3
16-
from typing import Any
16+
from typing import Any, Optional, Dict
1717

1818
# Disable insecure warnings
1919
urllib3.disable_warnings()
@@ -134,6 +134,42 @@ def get_domain_certificates(self, domain: str) -> dict:
134134
url_suffix = f'explore/domain/certificates/{domain}'
135135
return self._http_request('GET', url_suffix)
136136

137+
def search_domains(self,
138+
query: Optional[str] = None,
139+
start_date: Optional[str] = None,
140+
end_date: Optional[str] = None,
141+
risk_score_min: Optional[int] = None,
142+
risk_score_max: Optional[int] = None,
143+
limit: int = 100) -> dict:
144+
"""
145+
Search for domains with optional filters.
146+
147+
Args:
148+
query (str, optional): Search query string (e.g., domain pattern, keywords)
149+
start_date (str, optional): Start date for domain registration (ISO8601 format)
150+
end_date (str, optional): End date for domain registration (ISO8601 format)
151+
risk_score_min (int, optional): Minimum risk score filter
152+
risk_score_max (int, optional): Maximum risk score filter
153+
limit (int, optional): Maximum number of results to return (default: 100)
154+
155+
Returns:
156+
dict: A dictionary containing the search results
157+
"""
158+
demisto.debug(f'Searching domains with query: {query}')
159+
url_suffix = 'explore/domain/search'
160+
161+
# Build parameters dictionary with only non-None values
162+
params = {k: v for k, v in {
163+
'query': query,
164+
'start_date': start_date,
165+
'end_date': end_date,
166+
'risk_score_min': risk_score_min,
167+
'risk_score_max': risk_score_max,
168+
'limit': limit
169+
}.items() if v is not None}
170+
171+
return self._http_request('GET', url_suffix, params=params)
172+
137173

138174
def test_module(client: Client) -> str:
139175
"""
@@ -218,6 +254,38 @@ def get_domain_certificates_command(client: Client, args: dict) -> CommandResult
218254
)
219255

220256

257+
def search_domains_command(client: Client, args: dict) -> CommandResults:
258+
259+
# Extract parameters from args with type conversion
260+
query = args.get('query')
261+
start_date = args.get('start_date')
262+
end_date = args.get('end_date')
263+
risk_score_min = arg_to_number(args.get('risk_score_min'))
264+
risk_score_max = arg_to_number(args.get('risk_score_max'))
265+
limit = arg_to_number(args.get('limit', 100))
266+
267+
demisto.debug(f'Searching domains with query: {query}')
268+
269+
raw_response = client.search_domains(
270+
query=query,
271+
start_date=start_date,
272+
end_date=end_date,
273+
risk_score_min=risk_score_min,
274+
risk_score_max=risk_score_max,
275+
limit=limit
276+
)
277+
278+
readable_output = tableToMarkdown('Domain Search Results', raw_response.get('results', []))
279+
280+
return CommandResults(
281+
outputs_prefix='SilentPush.SearchResults',
282+
outputs_key_field='domain',
283+
outputs=raw_response,
284+
readable_output=readable_output,
285+
raw_response=raw_response
286+
)
287+
288+
221289
''' MAIN FUNCTION '''
222290

223291

@@ -257,6 +325,7 @@ def main():
257325
'test-module': test_module,
258326
'silentpush-list-domain-information': list_domain_information_command,
259327
'silentpush-get-domain-certificates': get_domain_certificates_command,
328+
'silentpush-search-domains': search_domains_command,
260329
}
261330

262331
if command in command_handlers:
@@ -277,4 +346,4 @@ def main():
277346

278347

279348
if __name__ in ('__main__', '__builtin__', 'builtins'):
280-
main()
349+
main()

‎Packs/SilentPush/Integrations/SilentPush/SilentPush.yml

Lines changed: 98 additions & 133 deletions
Original file line numberDiff line numberDiff line change
@@ -1,139 +1,104 @@
11
commonfields:
22
id: SilentPush
3-
version: -1
4-
name: SilentPush
5-
type: python
6-
subType: python3
7-
description: |
8-
This integration allows fetching domain information from the SilentPush API. It includes commands to get domain-related information such as WHOIS data, domain age, and risk scores, as well as SSL/TLS certificate data.
9-
tags: []
10-
enabled: true
11-
manufacturer: SilentPush
12-
comment: ''
13-
minVersion: -1
14-
dependencies:
15-
- CommonServerPython
16-
- CommonServerUserPython
17-
18-
scripts:
19-
- path: SilentPush.py
20-
comment: |
21-
Integration for SilentPush that enables fetching domain information, including WHOIS data, domain age, risk scores, and certificates.
22-
23-
commands:
24-
- name: test-module
25-
description: |
26-
Tests the connectivity to the SilentPush API and checks the authentication status.
27-
isArray: false
28-
argContext:
29-
- id: base_url
30-
type: string
31-
description: The base URL for the SilentPush API.
32-
- id: api_key
33-
type: string
34-
description: The API key used to authenticate requests.
35-
- id: verify_ssl
36-
type: boolean
37-
description: Flag to determine whether SSL verification is enabled.
38-
examples: |
39-
!test-module
40-
41-
- name: silentpush-list-domain-information
42-
description: |
43-
Fetches domain information, such as WHOIS data, domain age, and risk scores.
44-
isArray: false
45-
argContext:
46-
- id: domain
47-
type: string
48-
description: The domain name to fetch information for.
49-
examples: |
50-
!silentpush-list-domain-information domain=example.com
51-
52-
- name: silentpush-get-domain-certificates
53-
description: |
54-
Fetches SSL/TLS certificate data for a given domain.
55-
isArray: false
56-
argContext:
57-
- id: domain
58-
type: string
59-
description: The domain to fetch certificate information for.
60-
examples: |
61-
!silentpush-get-domain-certificates domain=example.com
3+
version: 1.0.0
624

63-
args:
64-
- id: domain
65-
isArray: false
66-
description: |
67-
The domain to fetch information for.
68-
type: string
5+
name: SilentPush
6+
display: SilentPush
7+
category: Data Enrichment & Threat Intelligence
8+
description: Integration with SilentPush API for domain intelligence and analysis.
9+
configuration:
10+
- display: Server URL
11+
name: url
12+
defaultvalue: https://api.silentpush.com
13+
type: 0
14+
required: true
15+
16+
- display: API Key
17+
name: credentials
18+
type: 9
19+
required: true
20+
21+
- display: Trust any certificate (not secure)
22+
name: insecure
23+
type: 8
24+
required: false
25+
26+
- display: Use system proxy settings
27+
name: proxy
28+
type: 8
29+
required: false
6930

70-
outputs:
71-
- id: SilentPush.Domain
72-
type: complex
73-
description: |
74-
The domain information fetched from SilentPush API, including WHOIS data, domain age, and risk scores.
75-
contents:
76-
- name: domain
77-
type: string
78-
- name: whois_data
79-
type: string
80-
- name: domain_age
81-
type: integer
82-
- name: risk_score
83-
type: float
84-
85-
- id: SilentPush.Certificates
86-
type: complex
87-
description: |
88-
The certificate information fetched from SilentPush API for the domain.
89-
contents:
90-
- name: domain
91-
type: string
92-
- name: certificates
93-
type: list
94-
items:
95-
- name: certificate_issuer
96-
type: string
97-
- name: valid_from
98-
type: string
99-
- name: valid_to
100-
type: string
101-
- name: certificate_serial_number
102-
type: string
31+
script:
32+
script: ''
33+
type: python
34+
commands:
35+
- name: silentpush-list-domain-information
36+
description: Fetches domain information such as WHOIS data, domain age, and risk scores
37+
arguments:
38+
- name: domain
39+
description: The domain to fetch information for
40+
required: true
41+
default: false
42+
outputs:
43+
- contextPath: SilentPush.Domain
44+
description: Domain information retrieved from SilentPush
45+
type: unknown
46+
- contextPath: SilentPush.Domain.domain
47+
description: The domain name
48+
type: string
49+
50+
- name: silentpush-get-domain-certificates
51+
description: Fetches SSL/TLS certificate data for a given domain
52+
arguments:
53+
- name: domain
54+
description: The domain to fetch certificate information for
55+
required: true
56+
default: false
57+
outputs:
58+
- contextPath: SilentPush.Certificates
59+
description: Certificate information for the domain
60+
type: unknown
61+
- contextPath: SilentPush.Certificates.domain
62+
description: The domain name
63+
type: string
64+
65+
- name: silentpush-search-domains
66+
description: Search for domains with optional filters
67+
arguments:
68+
- name: query
69+
description: Search query string (e.g., domain pattern, keywords)
70+
required: false
71+
default: false
72+
- name: start_date
73+
description: Start date for domain registration (ISO8601 format)
74+
required: false
75+
default: false
76+
- name: end_date
77+
description: End date for domain registration (ISO8601 format)
78+
required: false
79+
default: false
80+
- name: risk_score_min
81+
description: Minimum risk score filter
82+
required: false
83+
default: false
84+
- name: risk_score_max
85+
description: Maximum risk score filter
86+
required: false
87+
default: false
88+
- name: limit
89+
description: Maximum number of results to return
90+
required: false
91+
default: true
92+
defaultValue: "100"
93+
outputs:
94+
- contextPath: SilentPush.SearchResults
95+
description: Search results from the domain query
96+
type: unknown
97+
- contextPath: SilentPush.SearchResults.domain
98+
description: The domain name in the search results
99+
type: string
103100

101+
dockerimage: demisto/python3:3.10
102+
fromversion: 6.0.0
104103
tests:
105-
- name: Test SilentPush Integration
106-
description: Test the integration with the SilentPush API.
107-
steps:
108-
- script: test-module
109-
name: Test SilentPush API Connectivity
110-
args:
111-
base_url: https://api.silentpush.com
112-
api_key: 'your_api_key'
113-
114-
115-
configurations:
116-
- default: true
117-
isArray: false
118-
description: The configuration parameters required for connecting to SilentPush API.
119-
context:
120-
- id: base_url
121-
type: string
122-
description: The base URL for the SilentPush API.
123-
- id: api_key
124-
type: string
125-
description: The API key used to authenticate requests.
126-
- id: verify_ssl
127-
type: boolean
128-
description: Flag to determine whether SSL verification is enabled.
129-
- id: proxy
130-
type: boolean
131-
description: Flag to determine whether to use a proxy.
132-
133-
errorHandling:
134-
- errorCode: 403
135-
description: |
136-
If an authorization error is encountered, it could indicate an incorrect or expired API key.
137-
- errorCode: 400
138-
description: |
139-
Bad Request error, likely due to incorrect input format or invalid parameters in the request.
104+
- No tests

0 commit comments

Comments
 (0)