@itentialopensource/adapter-checkpoint_reputation_service 0.1.1

package/report/adapter-openapi.json

@@ -0,0 +1,502 @@
+{
+  "openapi": "3.0.0",
+  "info": {
+    "title": "Check Point Reputation Service API",
+    "description": "## Introduction\nLeverage the Check Point’s threat intelligence to enrich your SIEM and SOAR solutions and to secure your business applications and websites by using simple RESTful APIs.  \n\n| **Input** | **Output** |\n|-------|--------|\n| **URL, IP, File digest (md5/sha1/sha256)**   | classification and risk     |\n\n## Getting Started with the Reputation Service API  \n### 1. Get your API Key \n[Contact us](mailto:TCAPI_SUPPORT@checkpoint.com) to get an API key\n### 2. Request a session token\nThe session token is valid for 30min.  \n\nRequest example:  \n```linux\ncurl -X GET \"https://rep.checkpoint.com/rep-auth/service/v1.0/request\" -H \"Client-Key: XXXXXXXXXXXXX\"\n```\n\nResponse example:\n```\nexp=XXXXXXX~acl=XXXX/*~hmac=XXXXXXXXX\n```\n### 3. Use your API Key and your session token for a Reputation Service Query\nNote: you have to provide the resource to be queried both in the **message body** and in the **URL request**.  \n\nRequest example:  \n```linux\ncurl -X POST \"https://rep.checkpoint.com/url-rep/service/v2.0/query?resource=ynet.co.il\" -H \"accept: application/json\" -H \"Client-Key: XXXXXXX\" -H \"token: exp=XXXXX~acl=XXXXX\" -H \"Content-Type: application/json\" -d \"{\\\"request\\\":[{\\\"resource\\\":\\\"ynet.co.il\\\"}]}\"\n```\n\nResponse example:\n```json\n{\n  \"response\": [\n    {\n      \"status\": {\n        \"code\": 2001,\n        \"label\": \"SUCCESS\",\n        \"message\": \"Succeeded to generate reputation\"\n      },\n      \"resource\": \"ynet.co.il\",\n      \"reputation\": {\n        \"classification\": \"Benign\",\n        \"severity\": \"N/A\",\n        \"confidence\": \"High\"\n      },\n      \"risk\": 0,\n      \"context\": {\n        \"categories\": [\n          {\n            \"id\": 24,\n            \"name\": \"News / Media\"\n          }\n        ],\n        \"indications\": [\n          \"The domain is popular among websites with good reputation\",\n          \"The domain has good reputation\",\n          \"The domain is popular in the world\",\n          \"Check Point's URL Filtering category is News / Media\",\n          \"VirusTotal vendors detected benign URLs of the domain\",\n          \"The IP address is involved with benign activity\"\n        ],\n        \"vt_positives\": 0,\n        \"safe\": true,\n        \"creation_date\": \"2001:01:07 00:00:00\",\n        \"related_ips\": [\n          {\n            \"ip\": \"104.123.201.212\",\n            \"classification\": \"Benign\",\n            \"confidence\": \"Low\"\n          }\n        ]\n      }\n    }\n  ]\n}\n```\n",
+    "contact": {},
+    "version": "1.0.0"
+  },
+  "servers": [
+    {
+      "url": "https://rep.checkpoint.com",
+      "variables": {}
+    }
+  ],
+  "paths": {
+    "/rep-auth/service/v1.0/request": {
+      "get": {
+        "tags": [
+          "Authentication"
+        ],
+        "summary": "getSessionToken",
+        "description": "",
+        "operationId": "getSessionToken",
+        "parameters": [
+          {
+            "name": "Client-Key",
+            "in": "header",
+            "description": "",
+            "required": true,
+            "style": "simple",
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "The token to use in reputation",
+            "headers": {},
+            "content": {}
+          },
+          "401": {
+            "description": "Invalid Client-Key header",
+            "headers": {},
+            "content": {}
+          }
+        },
+        "deprecated": false
+      }
+    },
+    "/{service}-rep/service/v2.0/query": {
+      "post": {
+        "tags": [
+          "Query"
+        ],
+        "summary": "postQueryResource",
+        "description": "",
+        "operationId": "postQueryResource",
+        "parameters": [
+          {
+            "name": "Client-Key",
+            "in": "header",
+            "description": "",
+            "required": true,
+            "style": "simple",
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          },
+          {
+            "name": "token",
+            "in": "header",
+            "description": "",
+            "required": true,
+            "style": "simple",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "service",
+            "in": "path",
+            "description": "The service you want to query",
+            "required": true,
+            "style": "simple",
+            "schema": {
+              "allOf": [
+                {
+                  "$ref": "#/components/schemas/service"
+                },
+                {
+                  "description": "The service you want to query"
+                }
+              ]
+            }
+          },
+          {
+            "name": "resource",
+            "in": "query",
+            "description": "The resource you want to query",
+            "required": true,
+            "style": "form",
+            "explode": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "description": "",
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ReputationRequest"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "description": "OK",
+            "headers": {},
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ReputationResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Bad Request - Check your resource",
+            "headers": {},
+            "content": {}
+          },
+          "401": {
+            "description": "Invalid Client-Key header",
+            "headers": {},
+            "content": {}
+          },
+          "403": {
+            "description": "Invalid token header",
+            "headers": {},
+            "content": {}
+          },
+          "429": {
+            "description": "Quota exceeded",
+            "headers": {},
+            "content": {}
+          }
+        },
+        "deprecated": false
+      }
+    }
+  },
+  "components": {
+    "schemas": {
+      "ReputationSingleRequest": {
+        "title": "ReputationSingleRequest",
+        "type": "object",
+        "properties": {
+          "resource": {
+            "type": "string"
+          }
+        }
+      },
+      "ReputationRequest": {
+        "title": "ReputationRequest",
+        "required": [
+          "request"
+        ],
+        "type": "object",
+        "properties": {
+          "request": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/ReputationSingleRequest"
+            },
+            "description": ""
+          }
+        }
+      },
+      "ReputationResponse": {
+        "title": "ReputationResponse",
+        "type": "object",
+        "properties": {
+          "risk": {
+            "type": "number",
+            "example": 0
+          },
+          "resource": {
+            "type": "string",
+            "example": "http://google.com"
+          },
+          "reputation": {
+            "$ref": "#/components/schemas/ReputationClassification"
+          },
+          "status": {
+            "$ref": "#/components/schemas/ReputationStatus"
+          },
+          "context": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/ReputationResponseContext"
+              },
+              {
+                "description": "In parentheses, the service returning the field"
+              }
+            ]
+          }
+        }
+      },
+      "ReputationClassification": {
+        "title": "ReputationClassification",
+        "type": "object",
+        "properties": {
+          "classification": {
+            "type": "string",
+            "example": "Benign"
+          },
+          "severity": {
+            "$ref": "#/components/schemas/Severity"
+          },
+          "Confidence": {
+            "$ref": "#/components/schemas/Confidence"
+          }
+        }
+      },
+      "ReputationStatus": {
+        "title": "ReputationStatus",
+        "type": "object",
+        "properties": {
+          "code": {
+            "$ref": "#/components/schemas/Code"
+          },
+          "label": {
+            "$ref": "#/components/schemas/Label"
+          },
+          "message": {
+            "$ref": "#/components/schemas/Message"
+          }
+        }
+      },
+      "ReputationResponseContext": {
+        "title": "ReputationResponseContext",
+        "type": "object",
+        "properties": {
+          "asn": {
+            "type": "number",
+            "description": "ASN of the IP (IP)"
+          },
+          "as_owner": {
+            "type": "string",
+            "description": "ASN owner of the IP (IP)"
+          },
+          "safe": {
+            "type": "boolean",
+            "description": "exists and true if certified safe (URL)"
+          },
+          "malware_family": {
+            "type": "string",
+            "description": "the malware family associated with the resource  (URL/FILE/IP)"
+          },
+          "protection_name": {
+            "type": "string",
+            "description": "The protection name returned from Malware Service / AntiVirus (URL/FILE)"
+          },
+          "redirections": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "The redirections of the resource (URL)"
+          },
+          "malware_types": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "The malware types based on VT scans (FILE)"
+          },
+          "categories": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "URLF categories (URL)"
+          },
+          "google_safe_browsing_categories": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Google safe browsing categories (URL)"
+          },
+          "location": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/Location"
+              },
+              {
+                "description": "geo location information  (IP)"
+              }
+            ]
+          },
+          "related_resources": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/RelatedResources"
+              },
+              {
+                "description": "(FILE)"
+              }
+            ]
+          },
+          "phishing": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/Phishing"
+              },
+              {
+                "description": "(URL)"
+              }
+            ]
+          }
+        },
+        "description": "In parentheses, the service returning the field"
+      },
+      "Code": {
+        "title": "Code",
+        "enum": [
+          2001,
+          2002,
+          2003
+        ],
+        "type": "integer"
+      },
+      "Confidence": {
+        "title": "Confidence",
+        "enum": [
+          "Low",
+          "Medium",
+          "High"
+        ],
+        "type": "string"
+      },
+      "Label": {
+        "title": "Label",
+        "enum": [
+          "SUCCESS",
+          "PARTIAL_SUCCESS",
+          "FAILED"
+        ],
+        "type": "string"
+      },
+      "Location": {
+        "title": "Location",
+        "type": "object",
+        "properties": {
+          "region": {
+            "type": "string"
+          },
+          "city": {
+            "type": "string"
+          },
+          "postalCode": {
+            "type": "string"
+          },
+          "latitude": {
+            "type": "number"
+          },
+          "longitude": {
+            "type": "number"
+          },
+          "dma_code": {
+            "type": "integer",
+            "format": "int32"
+          },
+          "area_code": {
+            "type": "integer",
+            "format": "int32"
+          },
+          "metro_code": {
+            "type": "integer",
+            "format": "int32"
+          }
+        },
+        "description": "geo location information  (IP)"
+      },
+      "Message": {
+        "title": "Message",
+        "enum": [
+          "Succeeded to generate reputation",
+          "Some vendors are unavailable",
+          "Failed to process"
+        ],
+        "type": "string"
+      },
+      "Phishing": {
+        "title": "Phishing",
+        "type": "object",
+        "properties": {
+          "brand": {
+            "type": "string",
+            "description": "brand of the phishing resource"
+          },
+          "type": {
+            "type": "string",
+            "description": "type of brand"
+          },
+          "domain": {
+            "type": "string",
+            "description": "the primary domain"
+          }
+        },
+        "description": "(URL)"
+      },
+      "RelatedResources": {
+        "title": "RelatedResources",
+        "type": "object",
+        "properties": {
+          "similar_files_found": {
+            "type": "number",
+            "description": "How many similar files found"
+          },
+          "similar_files_details": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/SimilarFilesDetails"
+              },
+              {
+                "description": "Information about the similar file"
+              }
+            ]
+          }
+        },
+        "description": "(FILE)"
+      },
+      "service": {
+        "title": "service",
+        "enum": [
+          "url",
+          "ip",
+          "file"
+        ],
+        "type": "string"
+      },
+      "Severity": {
+        "title": "Severity",
+        "enum": [
+          "N/A",
+          "Low",
+          "Medium",
+          "High",
+          "Critical"
+        ],
+        "type": "string"
+      },
+      "SimilarFilesDetails": {
+        "title": "SimilarFilesDetails",
+        "type": "object",
+        "properties": {
+          "md5": {
+            "type": "string"
+          },
+          "ssdeep": {
+            "type": "string"
+          },
+          "ssdeep_similarity": {
+            "type": "string"
+          },
+          "file_type": {
+            "type": "string"
+          },
+          "classification": {
+            "type": "string"
+          },
+          "malware_family": {
+            "type": "string"
+          },
+          "confidence": {
+            "type": "string"
+          }
+        },
+        "description": "Information about the similar file"
+      }
+    }
+  },
+  "tags": [
+    {
+      "name": "Authentication",
+      "description": ""
+    },
+    {
+      "name": "Query",
+      "description": ""
+    }
+  ]
+}