greynoise 2.1.0__tar.gz → 2.3.0__tar.gz

{greynoise-2.1.0 → greynoise-2.3.0}/CHANGELOG.rst

@@ -2,6 +2,51 @@
 Changelog
 =========
 
+Version `2.3.0`_
+================
+**Date**: July 30, 2024
+
+* API client:
+
+  * Add `cve` command to query the CVE lookup API
+
+* CLI:
+
+  * Add `cve` command to display result from CVE lookup API
+
+* Dependencies:
+
+  * Updated cachetools to version 5.4.0
+
+Version `2.2.0`_
+================
+**Date**: June 11, 2024
+
+* API client:
+
+  * Update `analyze` command to use analysis endpoint
+  * Add `persona_details` command to pull a sensor persona's details based on ID
+  * Add `sensor_list` command to pull list of sensors from a users workspace, based on API key used
+  * Add `sensor_activity` command to pull sensor activity feed from users workspace
+  * Add `sensor_activity_ips` command to pull list of source ips from sensor activity feed
+
+* CLI:
+
+  * Update `analyze` output to match that of new endpoint response
+  * Add `persona-details` command to display command response
+  * Add `sensor-list` command to display command response
+  * Add `sensor-activity` command to display command response
+
+* Dependencies:
+
+  * Updated Clic to version 8.1.7
+  * Updated ansimarkup to version 2.1.0
+  * Updated click-repl to version 0.3.0
+  * Updated dict2xml to version 1.7.5
+  * Updated jinja2 to version 3.1.4
+  * Updated more-itertools to version 10.3.0 (for py3.8 and above only)
+  * Updated requests to version 2.32.3
+
 Version `2.1.0`_
 ================
 **Date**: February 07, 2024
@@ -380,6 +425,8 @@ Version `0.2.0`_
 .. _`1.2.0`: https://github.com/GreyNoise-Intelligence/pygreynoise/compare/v1.1.0...1.2.0
 .. _`1.2.1`: https://github.com/GreyNoise-Intelligence/pygreynoise/compare/v1.2.0...1.2.1
 .. _`1.3.0`: https://github.com/GreyNoise-Intelligence/pygreynoise/compare/v1.2.1...1.3.0
-.. _`2.0.0`: https://github.com/GreyNoise-Intelligence/pygreynoise/compare/v1.3.0...HEAD
+.. _`2.0.0`: https://github.com/GreyNoise-Intelligence/pygreynoise/compare/v1.3.0...2.0.0
 .. _`2.0.1`: https://github.com/GreyNoise-Intelligence/pygreynoise/compare/v2.0.0...2.0.1
 .. _`2.1.0`: https://github.com/GreyNoise-Intelligence/pygreynoise/compare/v2.0.1...2.1.0
+.. _`2.2.0`: https://github.com/GreyNoise-Intelligence/pygreynoise/compare/v2.1.0...2.2.0
+.. _`2.3.0`: https://github.com/GreyNoise-Intelligence/pygreynoise/compare/v2.2.0...HEAD

{greynoise-2.1.0/src/greynoise.egg-info → greynoise-2.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: greynoise
-Version: 2.1.0
+Version: 2.3.0
 Summary: Abstraction to interact with GreyNoise API.
 Home-page: https://greynoise.io/
 Download-URL: https://github.com/GreyNoise-Intelligence/pygreynoise
@@ -124,6 +124,51 @@ Usage
 Changelog
 =========
 
+Version `2.3.0`_
+================
+**Date**: July 30, 2024
+
+* API client:
+
+  * Add `cve` command to query the CVE lookup API
+
+* CLI:
+
+  * Add `cve` command to display result from CVE lookup API
+
+* Dependencies:
+
+  * Updated cachetools to version 5.4.0
+
+Version `2.2.0`_
+================
+**Date**: June 11, 2024
+
+* API client:
+
+  * Update `analyze` command to use analysis endpoint
+  * Add `persona_details` command to pull a sensor persona's details based on ID
+  * Add `sensor_list` command to pull list of sensors from a users workspace, based on API key used
+  * Add `sensor_activity` command to pull sensor activity feed from users workspace
+  * Add `sensor_activity_ips` command to pull list of source ips from sensor activity feed
+
+* CLI:
+
+  * Update `analyze` output to match that of new endpoint response
+  * Add `persona-details` command to display command response
+  * Add `sensor-list` command to display command response
+  * Add `sensor-activity` command to display command response
+
+* Dependencies:
+
+  * Updated Clic to version 8.1.7
+  * Updated ansimarkup to version 2.1.0
+  * Updated click-repl to version 0.3.0
+  * Updated dict2xml to version 1.7.5
+  * Updated jinja2 to version 3.1.4
+  * Updated more-itertools to version 10.3.0 (for py3.8 and above only)
+  * Updated requests to version 2.32.3
+
 Version `2.1.0`_
 ================
 **Date**: February 07, 2024
@@ -502,6 +547,8 @@ Version `0.2.0`_
 .. _`1.2.0`: https://github.com/GreyNoise-Intelligence/pygreynoise/compare/v1.1.0...1.2.0
 .. _`1.2.1`: https://github.com/GreyNoise-Intelligence/pygreynoise/compare/v1.2.0...1.2.1
 .. _`1.3.0`: https://github.com/GreyNoise-Intelligence/pygreynoise/compare/v1.2.1...1.3.0
-.. _`2.0.0`: https://github.com/GreyNoise-Intelligence/pygreynoise/compare/v1.3.0...HEAD
+.. _`2.0.0`: https://github.com/GreyNoise-Intelligence/pygreynoise/compare/v1.3.0...2.0.0
 .. _`2.0.1`: https://github.com/GreyNoise-Intelligence/pygreynoise/compare/v2.0.0...2.0.1
 .. _`2.1.0`: https://github.com/GreyNoise-Intelligence/pygreynoise/compare/v2.0.1...2.1.0
+.. _`2.2.0`: https://github.com/GreyNoise-Intelligence/pygreynoise/compare/v2.1.0...2.2.0
+.. _`2.3.0`: https://github.com/GreyNoise-Intelligence/pygreynoise/compare/v2.2.0...HEAD

{greynoise-2.1.0 → greynoise-2.3.0}/setup.py

@@ -20,14 +20,14 @@ INSTALL_REQUIRES = [
     "click-repl",
     "dict2xml",
     "jinja2",
-    "more-itertools",
+    "more-itertools>=8.14.0",
     "requests",
     "six",
 ]
 
 setup(
     name="greynoise",
-    version="2.1.0",
+    version="2.3.0",
     description="Abstraction to interact with GreyNoise API.",
     url="https://greynoise.io/",
     author="GreyNoise Intelligence",

{greynoise-2.1.0 → greynoise-2.3.0}/src/greynoise/__version__.py

@@ -5,4 +5,4 @@ __license__ = "MIT"
 __maintainer__ = "GreyNoise Intelligence"
 __email__ = "hello@greynoise.io"
 __status__ = "BETA"
-__version__ = "2.1.0"
+__version__ = "2.3.0"

{greynoise-2.1.0 → greynoise-2.3.0}/src/greynoise/api/__init__.py

@@ -2,6 +2,8 @@
 
 import logging
 import re
+import sys
+import time
 from collections import OrderedDict
 
 import cachetools
@@ -9,11 +11,11 @@ import more_itertools
 import requests
 
 from greynoise.__version__ import __version__
-from greynoise.api.analyzer import Analyzer
 from greynoise.api.filter import Filter
 from greynoise.exceptions import RateLimitError, RequestFailure
 from greynoise.util import (
     load_config,
+    validate_cve_id,
     validate_ip,
     validate_similar_min_score,
     validate_timeline_days,
@@ -31,7 +33,6 @@ def initialize_cache(cache_max_size, cache_ttl):
 
 
 class GreyNoise(object):  # pylint: disable=R0205,R0902
-
     """GreyNoise API client.
 
     :param api_key: Key use to access the API.
@@ -58,6 +59,12 @@ class GreyNoise(object):  # pylint: disable=R0205,R0902
     EP_META_METADATA = "v2/meta/metadata"
     EP_PING = "ping"
     EP_RIOT = "v2/riot/{ip_address}"
+    EP_SENSOR_ACTIVITY = "v1/workspaces/{workspace_id}/sensors/activity"
+    EP_SENSOR_LIST = "v1/workspaces/{workspace_id}/sensors"
+    EP_PERSONA_DETAILS = "v1/personas/{persona_id}"
+    EP_CVE_LOOKUP = "v1/cve/{cve_id}"
+    EP_ANALYZE_UPLOAD = "v2/analyze/upload"
+    EP_ANALYZE = "v2/analyze/{id}"
     EP_NOT_IMPLEMENTED = "v2/request/{subcommand}"
     UNKNOWN_CODE_MESSAGE = "Code message unknown: {}"
     CODE_MESSAGES = {
@@ -143,7 +150,15 @@ class GreyNoise(object):  # pylint: disable=R0205,R0902
             self.ip_quick_check_cache = initialize_cache(cache_max_size, cache_ttl)
             self.ip_context_cache = initialize_cache(cache_max_size, cache_ttl)
 
-    def _request(self, endpoint, params=None, json=None, method="get"):
+    def _request(
+        self,
+        endpoint,
+        params=None,
+        json=None,
+        files=None,
+        method="get",
+        include_headers=False,
+    ):
         """Handle the requesting of information from the API.
 
         :param endpoint: Endpoint to send the request to
@@ -152,6 +167,8 @@ class GreyNoise(object):  # pylint: disable=R0205,R0902
         :type param: dict
         :param json: Request's JSON payload
         :type json: dict
+        :param files: Request's file for update
+        :type files: text file
         :param method: Request method name
         :type method: str
         :returns: Response's JSON payload
@@ -179,6 +196,7 @@ class GreyNoise(object):  # pylint: disable=R0205,R0902
         LOGGER.debug("Sending API request...headers: %s", headers)
         LOGGER.debug("Sending API request...params: %s", params)
         LOGGER.debug("Sending API request...json: %s", json)
+        LOGGER.debug("Sending API request...files: %s", files)
         LOGGER.debug("Sending API request...proxy: %s", self.proxy)
 
         request_method = getattr(self.session, method)
@@ -190,13 +208,20 @@ class GreyNoise(object):  # pylint: disable=R0205,R0902
                 timeout=self.timeout,
                 params=params,
                 json=json,
+                files=files,
                 proxies=proxies,
             )
         else:
             response = request_method(
-                url, headers=headers, timeout=self.timeout, params=params, json=json
+                url,
+                headers=headers,
+                timeout=self.timeout,
+                params=params,
+                json=json,
+                files=files,
             )
         content_type = response.headers.get("Content-Type", "")
+        headers = response.headers
         if "application/json" in content_type:
             body = response.json()
         else:
@@ -208,8 +233,10 @@ class GreyNoise(object):  # pylint: disable=R0205,R0902
             raise RateLimitError()
         if response.status_code >= 400 and response.status_code != 404:
             raise RequestFailure(response.status_code, body)
-
-        return body
+        if include_headers:
+            return body, headers
+        else:
+            return body
 
     def analyze(self, text):
         """Aggregate stats related to IP addresses from a given text.
@@ -221,14 +248,48 @@ class GreyNoise(object):  # pylint: disable=R0205,R0902
 
         """
         if self.offering == "community":
-            response = [
-                {"message": "Quick Lookup not supported with Community offering"}
-            ]
+            text_stats = [{"message": "Analyze not supported with Community offering"}]
         else:
-            analyzer = Analyzer(self)
-            response = analyzer.analyze(text)
+            text_stats = {
+                "query": [],
+                "count": 0,
+                "stats": {},
+            }
 
-        return response
+            files = {"file": text}
+            upload = self._request(self.EP_ANALYZE_UPLOAD, files=files, method="post")
+
+            if "uuid" in upload:
+                uuid = upload["uuid"]
+                state = upload["state"]
+                while state != "completed":
+                    url = self.EP_ANALYZE.format(id=uuid)
+                    response = self._request(url)
+                    state = response["state"]
+                    time.sleep(5)
+                unique_ip_list = (
+                    response["details"].get("noise_ips_found", [])
+                    + response["details"].get("unknown_ips", [])
+                    + response["details"].get("riot_ips_found", [])
+                )
+
+                text_stats["summary"] = {
+                    "ip_count": response["details"].get("unique_ips", 0),
+                    "noise_ip_count": response["details"].get("noise_ips", 0),
+                    "not_noise_ip_count": response["details"].get("non_noise_ips", 0),
+                    "riot_ip_count": response["details"].get("riot_ips", 0),
+                    "noise_ip_ratio": response["details"].get(
+                        "percentage_of_noise_ips", 0
+                    ),
+                    "riot_ip_ratio": response["details"].get(
+                        "percentage_of_riot_ips", 0
+                    ),
+                }
+                text_stats["stats"] = response.get("stats")
+                text_stats["query"] = unique_ip_list
+                text_stats["count"] = response["details"].get("unique_ips", 0)
+
+        return text_stats
 
     def filter(self, text, noise_only=False, riot_only=False):
         """Filter lines that contain IP addresses from a given text.
@@ -580,6 +641,114 @@ class GreyNoise(object):  # pylint: disable=R0205,R0902
 
         return response
 
+    def sensor_activity(
+        self,
+        workspace_id,
+        file_format=None,
+        start_time=None,
+        end_time=None,
+        persona_id=None,
+        source_ip=None,
+        size=None,
+        scroll=None,
+        include_headers=False,
+    ):
+        """Get session data from sensors"""
+        LOGGER.debug(
+            "Running Sensor Activity: %s %s %s %s %s %s %s %s...",
+            workspace_id,
+            file_format,
+            start_time,
+            end_time,
+            persona_id,
+            source_ip,
+            size,
+            scroll,
+        )
+        if file_format is None or file_format == "json":
+            params = {"format": "json"}
+        elif file_format == "csv":
+            params = {"format": file_format}
+        else:
+            LOGGER.error(
+                f"Value for file_format is not valid (valid: json, csv): {file_format}"
+            )
+            sys.exit(1)
+
+        if start_time is not None:
+            params["start_time"] = start_time
+        if end_time is not None:
+            params["end_time"] = end_time
+        if persona_id is not None:
+            params["persona_id"] = persona_id
+        if source_ip is not None:
+            params["source_ip"] = source_ip
+        if size is not None:
+            params["size"] = size
+        if scroll is not None:
+            params["scroll"] = scroll
+        endpoint = self.EP_SENSOR_ACTIVITY.format(workspace_id=workspace_id)
+        response, headers = self._request(endpoint, params=params, include_headers=True)
+
+        if include_headers:
+            return response, headers
+        else:
+            return response
+
+    def sensor_activity_ips(
+        self,
+        workspace_id,
+        file_format=None,
+        start_time=None,
+        end_time=None,
+        persona_id=None,
+        source_ip=None,
+        size=None,
+        scroll=None,
+    ):
+        """Get session data from sensors"""
+        LOGGER.debug(
+            "Running Sensor Activity: %s %s %s %s %s %s %s %s...",
+            workspace_id,
+            file_format,
+            start_time,
+            end_time,
+            persona_id,
+            source_ip,
+            size,
+            scroll,
+        )
+        if file_format is None or file_format == "json":
+            params = {"format": "json"}
+        elif file_format == "csv":
+            params = {"format": file_format}
+        else:
+            LOGGER.error(
+                f"Value for file_format is not valid (valid: json, csv): {file_format}"
+            )
+            sys.exit(1)
+
+        if start_time is not None:
+            params["start_time"] = start_time
+        if end_time is not None:
+            params["end_time"] = end_time
+        if persona_id is not None:
+            params["persona_id"] = persona_id
+        if source_ip is not None:
+            params["source_ip"] = source_ip
+        if size is not None:
+            params["size"] = size
+        if scroll is not None:
+            params["scroll"] = scroll
+        endpoint = self.EP_SENSOR_ACTIVITY.format(workspace_id=workspace_id)
+        response = self._request(endpoint, params=params)
+        ip_list = []
+        for item in response:
+            ip_list.append(item.get("source_ip", ""))
+        final_ip_list = list(set(ip_list))
+
+        return final_ip_list
+
     def similar(self, ip_address, limit=None, min_score=None):
         """Query IP on the IP Similarity API
 
@@ -746,3 +915,75 @@ class GreyNoise(object):  # pylint: disable=R0205,R0902
                 response["ip"] = ip_address
 
         return response
+
+    def sensor_list(self, workspace_id=None):
+        """Get list of current sensors for Workspace
+
+        :param workspace_id: ID of Workspace
+        :type workspace_id: str
+
+
+        """
+        if self.offering == "community":
+            response = {
+                "message": "Sensors List is not supported with Community offering"
+            }
+        else:
+            LOGGER.debug("Getting Sensor List for Workspace ID: %s...", workspace_id)
+
+            endpoint = self.EP_SENSOR_LIST.format(workspace_id=workspace_id)
+            response = self._request(endpoint)
+        new_response = {}
+        if "items" in response:
+            new_response["items"] = []
+            for sensor in response["items"]:
+                persona = self.persona_details(sensor["persona"])
+                sensor["persona_name"] = persona.get("name", "")
+                new_response["items"].append(sensor)
+        else:
+            new_response = response
+
+        return new_response
+
+    def persona_details(self, persona_id=None):
+        """Get persona details by ID
+
+        :param persona_id: ID of Persona
+        :type persona_id: str
+
+
+        """
+        if self.offering == "community":
+            response = {
+                "message": "Persona Details is not supported with Community offering"
+            }
+        else:
+            LOGGER.debug("Getting Persona Details for Workspace ID: %s...", persona_id)
+
+            endpoint = self.EP_PERSONA_DETAILS.format(persona_id=persona_id)
+            response = self._request(endpoint)
+
+        return response
+
+    def cve(self, cve_id=None):
+        """Get CVE details by CVE ID
+
+        :param cve_id: ID of CVE
+        :type cve_id: str
+
+
+        """
+        if self.offering == "community":
+            response = {
+                "message": "CVE lookup is not supported with Community offering"
+            }
+        else:
+            LOGGER.debug("Getting Details for CVE ID: %s...", cve_id)
+
+            # check if CVE submitted is in correct format
+            validate_cve_id(cve_id)
+
+            endpoint = self.EP_CVE_LOOKUP.format(cve_id=cve_id)
+            response = self._request(endpoint)
+
+        return response

{greynoise-2.1.0 → greynoise-2.3.0}/src/greynoise/cli/decorator.py

@@ -3,6 +3,7 @@
 Decorators used to add common functionality to subcommands.
 
 """
+
 import functools
 import logging
 
@@ -62,11 +63,14 @@ def handle_exceptions(function):
         try:
             return function(*args, **kwargs)
         except RequestFailure as exception:
+            status = exception.args[0]
             body = exception.args[1]
             if "message" in body:
                 error_message = "API error: {}".format(body["message"])
             elif "error" in body:
                 error_message = "API error: {}".format(body["error"])
+            elif not body:
+                error_message = "API error: {}".format(status)
             else:
                 error_message = "API error: {}".format(body)
             LOGGER.error(error_message)
@@ -233,3 +237,158 @@ def not_implemented_command(function):
             raise SubcommandNotImplemented(command_name)
 
     return wrapper
+
+
+def workspace_command(function):
+    """Decorator that groups decorators common to workspace subcommands."""
+
+    @click.command()
+    @click.argument("workspace_id", required=True)
+    @click.option("-k", "--api-key", help="Key to include in API requests")
+    @click.option(
+        "-O",
+        "--offering",
+        help="Which API offering to use, enterprise or community, "
+        "defaults to enterprise",
+    )
+    @click.option("-i", "--input", "input_file", type=click.File(), help="Input file")
+    @click.option(
+        "-o", "--output", "output_file", type=click.File(mode="w"), help="Output file"
+    )
+    @click.option(
+        "-f",
+        "--format",
+        "output_format",
+        type=click.Choice(["json", "txt", "xml"]),
+        default="txt",
+        help="Output format",
+    )
+    @click.option("-v", "--verbose", count=True, help="Verbose output")
+    @pass_api_client
+    @click.pass_context
+    @echo_result
+    @handle_exceptions
+    @functools.wraps(function)
+    def wrapper(*args, **kwargs):
+        return function(*args, **kwargs)
+
+    return wrapper
+
+
+def sensor_activity_command(function):
+    """Decorator that groups decorators common to sensor activity subcommands."""
+
+    @click.command()
+    @click.argument("workspace_id", required=True)
+    @click.option(
+        "--start_time", "start_time", help="Earliest session start time to return"
+    )
+    @click.option("--end_time", "end_time", help="Latest session start time to return")
+    @click.option(
+        "--file_format", "file_format", help="Format for output file", default="json"
+    )
+    @click.option("--persona_id", "persona_id", help="Id for the desired persona")
+    @click.option("--source_ip", "source_ip", help="Ip for the desired source")
+    @click.option("--size", "size", help="Max number of results to return")
+    @click.option("--scroll", "scroll", help="Scroll token for pagination")
+    @click.option("-k", "--api-key", help="Key to include in API requests")
+    @click.option(
+        "-O",
+        "--offering",
+        help="Which API offering to use, enterprise or community, "
+        "defaults to enterprise",
+    )
+    @click.option("-i", "--input", "input_file", type=click.File(), help="Input file")
+    @click.option(
+        "-o", "--output", "output_file", type=click.File(mode="w"), help="Output file"
+    )
+    @click.option(
+        "-f",
+        "--format",
+        "output_format",
+        type=click.Choice(["json", "txt", "xml"]),
+        default="txt",
+        help="Output format",
+    )
+    @click.option("-v", "--verbose", count=True, help="Verbose output")
+    @pass_api_client
+    @click.pass_context
+    @echo_result
+    @handle_exceptions
+    @functools.wraps(function)
+    def wrapper(*args, **kwargs):
+        return function(*args, **kwargs)
+
+    return wrapper
+
+
+def persona_command(function):
+    """Decorator that groups decorators common to persona subcommands."""
+
+    @click.command()
+    @click.argument("persona_id", required=True)
+    @click.option("-k", "--api-key", help="Key to include in API requests")
+    @click.option(
+        "-O",
+        "--offering",
+        help="Which API offering to use, enterprise or community, "
+        "defaults to enterprise",
+    )
+    @click.option("-i", "--input", "input_file", type=click.File(), help="Input file")
+    @click.option(
+        "-o", "--output", "output_file", type=click.File(mode="w"), help="Output file"
+    )
+    @click.option(
+        "-f",
+        "--format",
+        "output_format",
+        type=click.Choice(["json", "txt", "xml"]),
+        default="txt",
+        help="Output format",
+    )
+    @click.option("-v", "--verbose", count=True, help="Verbose output")
+    @pass_api_client
+    @click.pass_context
+    @echo_result
+    @handle_exceptions
+    @functools.wraps(function)
+    def wrapper(*args, **kwargs):
+        return function(*args, **kwargs)
+
+    return wrapper
+
+
+def cve_command(function):
+    """Decorator that groups decorators common to cve subcommand."""
+
+    @click.command()
+    @click.argument("cve_id", required=True)
+    @click.option("-k", "--api-key", help="Key to include in API requests")
+    @click.option(
+        "-O",
+        "--offering",
+        help="Which API offering to use, enterprise or community, "
+        "defaults to enterprise",
+    )
+    @click.option("-i", "--input", "input_file", type=click.File(), help="Input file")
+    @click.option(
+        "-o", "--output", "output_file", type=click.File(mode="w"), help="Output file"
+    )
+    @click.option(
+        "-f",
+        "--format",
+        "output_format",
+        type=click.Choice(["json", "txt", "xml"]),
+        default="txt",
+        help="Output format",
+    )
+    @click.option("-v", "--verbose", count=True, help="Verbose output")
+    @pass_api_client
+    @click.pass_context
+    @echo_result
+    @handle_exceptions
+    @functools.wraps(function)
+    def wrapper(*args, **kwargs):
+        return function(*args, **kwargs)
+
+    return wrapper