misp-modules 2.4.196__py3-none-any.whl

misp_modules/modules/expansion/trustar_enrich.py

@@ -0,0 +1,235 @@
+import json
+import pymisp
+from base64 import b64encode
+from collections import OrderedDict
+from . import check_input_attribute, checking_error, standard_error_message
+from pymisp import MISPAttribute, MISPEvent, MISPObject
+from trustar import TruStar, Indicator
+from urllib.parse import quote
+
+misperrors = {'error': "Error"}
+mispattributes = {
+    'input': ["btc", "domain", "email-src", "filename", "hostname", "ip-src", "ip-dst", "malware-type", "md5", "sha1",
+              "sha256", "url"], 'format': 'misp_standard'}
+
+moduleinfo = {
+    'version': '0.1',
+    'author': 'Jesse Hedden',
+    'description': 'Module to get enrich indicators with TruSTAR.',
+    'module-type': ['hover', 'expansion'],
+    'name': 'TruSTAR Enrich',
+    'logo': 'trustar.png',
+    'requirements': [],
+    'features': 'This module enriches MISP attributes with scoring and metadata from TruSTAR.\n\nThe TruSTAR indicator summary is appended to the attributes along with links to any associated reports.',
+    'references': ['https://docs.trustar.co/api/v13/indicators/get_indicator_summaries.html'],
+    'input': 'Any of the following MISP attributes:\n- btc\n- domain\n- email-src\n- filename\n- hostname\n- ip-src\n- ip-dst\n- md5\n- sha1\n- sha256\n- url',
+    'output': 'MISP attributes enriched with indicator summary data from the TruSTAR API. Data includes a severity level score and additional source and scoring info.',
+}
+
+moduleconfig = ["user_api_key", "user_api_secret", "enclave_ids"]
+
+MAX_PAGE_SIZE = 100  # Max allowable page size returned from /1.3/indicators/summaries endpoint
+
+
+class TruSTARParser:
+    ENTITY_TYPE_MAPPINGS = {
+        'BITCOIN_ADDRESS': "btc",
+        'CIDR_BLOCK': "ip-src",
+        'CVE': "vulnerability",
+        'URL': "url",
+        'EMAIL_ADDRESS': "email-src",
+        'SOFTWARE': "filename",
+        'IP': "ip-src",
+        'MALWARE': "malware-type",
+        'MD5': "md5",
+        'REGISTRY_KEY': "regkey",
+        'SHA1': "sha1",
+        'SHA256': "sha256"
+    }
+
+    # Relevant fields from each TruSTAR endpoint
+    SUMMARY_FIELDS = ["severityLevel", "source", "score", "attributes"]
+    METADATA_FIELDS = ["sightings", "firstSeen", "lastSeen", "tags"]
+
+    REPORT_BASE_URL = "https://station.trustar.co/constellation/reports/{}"
+
+    CLIENT_METATAG = f"MISP-{pymisp.__version__}"
+
+    def __init__(self, attribute, config):
+        config['enclave_ids'] = config.get('enclave_ids', "").strip().split(',')
+        config['client_metatag'] = self.CLIENT_METATAG
+        self.ts_client = TruStar(config=config)
+
+        self.misp_event = MISPEvent()
+        self.misp_attribute = MISPAttribute()
+        self.misp_attribute.from_dict(**attribute)
+        self.misp_event.add_attribute(**self.misp_attribute)
+
+    def get_results(self):
+        """
+        Returns the MISP Event enriched with TruSTAR indicator summary data.
+        """
+        try:
+            event = json.loads(self.misp_event.to_json())
+            results = {key: event[key] for key in ('Attribute', 'Object') if (key in event and event[key])}
+            return {'results': results}
+        except Exception as e:
+            misperrors['error'] += f" -- Encountered issue serializing enrichment data -- {e}"
+            return misperrors
+
+    def generate_trustar_link(self, entity_type, entity_value):
+        """
+        Generates link to TruSTAR report of entity.
+
+        :param entity_type: <str> Type of entity.
+        :param entity_value: <str> Value of entity.
+        :return: <str> Link to indicator report in TruSTAR platform.
+        """
+        report_id = b64encode(quote(f"{entity_type}|{entity_value}").encode()).decode()
+
+        return self.REPORT_BASE_URL.format(report_id)
+
+    @staticmethod
+    def extract_tags(enrichment_report):
+        """
+        Extracts tags from the enrichment report in order to add them
+        to the TruSTAR MISP Object. Removes tags from report to avoid
+        redundancy.
+
+        :param: <OrderedDict> Enrichment data.
+        :return: <list> List of tags.
+        """
+        if enrichment_report and enrichment_report.get('tags'):
+            return [tag.get('name') for tag in enrichment_report.pop('tags')]
+        return None
+
+    def generate_enrichment_report(self, summary, metadata):
+        """
+        Extracts desired fields from summary and metadata reports and
+        generates an enrichment report.
+
+        :param summary: <trustar.IndicatorSummary> Indicator summary report.
+        :param metadata: <trustar.Indicator> Indicator metadata report.
+        :return: <str> Enrichment report.
+        """
+        # Preserve order of fields as they exist in SUMMARY_FIELDS and METADATA_FIELDS
+        enrichment_report = OrderedDict()
+
+        if summary:
+            summary_dict = summary.to_dict()
+            enrichment_report.update(
+                {field: summary_dict[field] for field in self.SUMMARY_FIELDS if summary_dict.get(field)})
+
+        if metadata:
+            metadata_dict = metadata.to_dict()
+            enrichment_report.update(
+                {field: metadata_dict[field] for field in self.METADATA_FIELDS if metadata_dict.get(field)})
+
+        return enrichment_report
+
+    def parse_indicator_summary(self, indicator, summary, metadata):
+        """
+        Pulls enrichment data from the TruSTAR /indicators/summaries and /indicators/metadata endpoints
+        and creates a MISP trustar_report.
+
+        :param indicator: <str> Value of the attribute
+        :summary: <trustar.IndicatorSummary> Indicator summary response object.
+        :metadata: <trustar.Indicator> Indicator response object.
+        """
+
+        # Verify that the indicator type is supported by TruSTAR
+        if summary and summary.indicator_type in self.ENTITY_TYPE_MAPPINGS:
+            indicator_type = summary.indicator_type
+        elif metadata and metadata.type in self.ENTITY_TYPE_MAPPINGS:
+            indicator_type = metadata.type
+        else:
+            misperrors['error'] += " -- Attribute not found or not supported"
+            raise Exception
+
+        try:
+            # Extract most relevant fields from indicator summary and metadata responses
+            enrichment_report = self.generate_enrichment_report(summary, metadata)
+            tags = self.extract_tags(enrichment_report)
+
+            if enrichment_report:
+                # Create MISP trustar_report object and populate it with enrichment data
+                trustar_obj = MISPObject('trustar_report')
+                trustar_obj.add_attribute(indicator_type, attribute_type=self.ENTITY_TYPE_MAPPINGS[indicator_type],
+                                          value=indicator)
+                trustar_obj.add_attribute("INDICATOR_SUMMARY", attribute_type="text",
+                                          value=json.dumps(enrichment_report, indent=4))
+
+                report_link = self.generate_trustar_link(indicator_type, indicator)
+                trustar_obj.add_attribute("REPORT_LINK", attribute_type="link", value=report_link)
+
+                self.misp_event.add_object(**trustar_obj)
+            elif not tags:
+                # If enrichment report is empty and there are no tags, nothing to add to attribute
+                raise Exception("No relevant data found")
+
+            if tags:
+                for tag in tags:
+                    self.misp_event.add_attribute_tag(tag, indicator)
+
+        except Exception as e:
+            misperrors['error'] += f" -- Error enriching attribute {indicator} -- {e}"
+            raise e
+
+
+def handler(q=False):
+    """
+    MISP handler function. A user's API key and secret will be retrieved from the MISP
+    request and used to create a TruSTAR API client. If enclave IDs are provided, only
+    those enclaves will be queried for data. Otherwise, all of the enclaves a user has
+    access to will be queried.
+    """
+
+    if q is False:
+        return False
+
+    request = json.loads(q)
+
+    config = request.get('config', {})
+    if not config.get('user_api_key') or not config.get('user_api_secret'):
+        misperrors['error'] = "Your TruSTAR API key and secret are required for indicator enrichment."
+        return misperrors
+
+    if not request.get('attribute') or not check_input_attribute(request['attribute'], requirements=('type', 'value')):
+        return {'error': f'{standard_error_message}, {checking_error}.'}
+    attribute = request['attribute']
+    if attribute['type'] not in mispattributes['input']:
+        return {'error': 'Unsupported attribute type.'}
+    trustar_parser = TruSTARParser(attribute, config)
+    metadata = None
+    summary = None
+
+    try:
+        metadata = trustar_parser.ts_client.get_indicators_metadata([Indicator(value=attribute['value'])])[0]
+    except IndexError:
+        misperrors['error'] += f" -- No metadata found for indicator {attribute['value']}"
+    except Exception as e:
+        misperrors['error'] += f" -- Could not retrieve indicator metadata from TruSTAR {e}"
+
+    try:
+        summary = list(
+            trustar_parser.ts_client.get_indicator_summaries([attribute['value']], page_size=MAX_PAGE_SIZE))[0]
+    except IndexError:
+        misperrors['error'] += f" -- No summary data found for indicator {attribute['value']}"
+    except Exception as e:
+        misperrors['error'] += f" -- Unable to retrieve TruSTAR summary data: {e}"
+
+    try:
+        trustar_parser.parse_indicator_summary(attribute['value'], summary, metadata)
+    except Exception:
+        return misperrors
+
+    return trustar_parser.get_results()
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo

misp_modules/modules/expansion/urlhaus.py

@@ -0,0 +1,164 @@
+# -*- coding: utf-8 -*-
+import json
+import requests
+from . import check_input_attribute, standard_error_message
+from pymisp import MISPAttribute, MISPEvent, MISPObject
+
+misperrors = {'error': 'Error'}
+mispattributes = {'input': ['domain', 'hostname', 'ip-src', 'ip-dst', 'md5', 'sha256', 'url'],
+                  'output': ['url', 'filename', 'md5', 'sha256'],
+                  'format': 'misp_standard'}
+moduleinfo = {
+    'version': '0.1',
+    'author': 'Christian Studer',
+    'description': 'Query of the URLhaus API to get additional information about the input attribute.',
+    'module-type': ['expansion', 'hover'],
+    'name': 'URLhaus Lookup',
+    'logo': 'urlhaus.png',
+    'requirements': [],
+    'features': 'Module using the new format of modules able to return attributes and objects.\n\nThe module takes one of the attribute type specified as input, and query the URLhaus API with it. If any result is returned by the API, attributes and objects are created accordingly.',
+    'references': ['https://urlhaus.abuse.ch/'],
+    'input': 'A domain, hostname, url, ip, md5 or sha256 attribute.',
+    'output': 'MISP attributes & objects fetched from the result of the URLhaus API query.',
+}
+moduleconfig = []
+
+file_keys = ('filename', 'response_size', 'response_md5', 'response_sha256')
+file_relations = ('filename', 'size-in-bytes', 'md5', 'sha256')
+vt_keys = ('result', 'link')
+vt_types = ('text', 'link')
+vt_relations = ('detection-ratio', 'permalink')
+
+
+class URLhaus():
+    def __init__(self):
+        super(URLhaus, self).__init__()
+        self.misp_event = MISPEvent()
+
+    @staticmethod
+    def _create_vt_object(virustotal):
+        vt_object = MISPObject('virustotal-report')
+        for key, vt_type, relation in zip(vt_keys, vt_types, vt_relations):
+            vt_object.add_attribute(relation, **{'type': vt_type, 'value': virustotal[key]})
+        return vt_object
+
+    def get_result(self):
+        event = json.loads(self.misp_event.to_json())
+        results = {key: event[key] for key in ('Attribute', 'Object') if (key in event and event[key])}
+        return {'results': results}
+
+    def parse_error(self, query_status):
+        if query_status == 'no_results':
+            return {'error': f'No results found on URLhaus for this {self.attribute.type} attribute'}
+        return {'error': f'Error encountered during the query of URLhaus: {query_status}'}
+
+
+class HostQuery(URLhaus):
+    def __init__(self, attribute):
+        super(HostQuery, self).__init__()
+        self.attribute = MISPAttribute()
+        self.attribute.from_dict(**attribute)
+        self.url = 'https://urlhaus-api.abuse.ch/v1/host/'
+
+    def query_api(self):
+        response = requests.post(self.url, data={'host': self.attribute.value}).json()
+        if response['query_status'] != 'ok':
+            return self.parse_error(response['query_status'])
+        if 'urls' in response and response['urls']:
+            for url in response['urls']:
+                self.misp_event.add_attribute(type='url', value=url['url'])
+        return self.get_result()
+
+
+class PayloadQuery(URLhaus):
+    def __init__(self, attribute):
+        super(PayloadQuery, self).__init__()
+        self.attribute = MISPAttribute()
+        self.attribute.from_dict(**attribute)
+        self.url = 'https://urlhaus-api.abuse.ch/v1/payload/'
+
+    def query_api(self):
+        hash_type = self.attribute.type
+        file_object = MISPObject('file')
+        if hasattr(self.attribute, 'object_id') and hasattr(self.attribute, 'event_id') and self.attribute.event_id != '0':
+            file_object.id = self.attribute.object_id
+        response = requests.post(self.url, data={'{}_hash'.format(hash_type): self.attribute.value}).json()
+        if response['query_status'] != 'ok':
+            return self.parse_error(response['query_status'])
+        other_hash_type = 'md5' if hash_type == 'sha256' else 'sha256'
+        for key, relation in zip(('{}_hash'.format(other_hash_type), 'file_size'), (other_hash_type, 'size-in-bytes')):
+            if response[key]:
+                file_object.add_attribute(relation, **{'type': relation, 'value': response[key]})
+        if response['virustotal']:
+            vt_object = self._create_vt_object(response['virustotal'])
+            file_object.add_reference(vt_object.uuid, 'analyzed-with')
+            self.misp_event.add_object(**vt_object)
+        _filename_ = 'filename'
+        for url in response['urls']:
+            attribute = MISPAttribute()
+            attribute.from_dict(type='url', value=url['url'])
+            self.misp_event.add_attribute(**attribute)
+            file_object.add_reference(attribute.uuid, 'retrieved-from')
+            if url[_filename_]:
+                file_object.add_attribute(_filename_, **{'type': _filename_, 'value': url[_filename_]})
+        if any((file_object.attributes, file_object.references)):
+            self.misp_event.add_object(**file_object)
+        return self.get_result()
+
+
+class UrlQuery(URLhaus):
+    def __init__(self, attribute):
+        super(UrlQuery, self).__init__()
+        self.attribute = MISPAttribute()
+        self.attribute.from_dict(**attribute)
+        self.url = 'https://urlhaus-api.abuse.ch/v1/url/'
+
+    @staticmethod
+    def _create_file_object(payload):
+        file_object = MISPObject('file')
+        for key, relation in zip(file_keys, file_relations):
+            if payload[key]:
+                file_object.add_attribute(relation, **{'type': relation, 'value': payload[key]})
+        return file_object
+
+    def query_api(self):
+        response = requests.post(self.url, data={'url': self.attribute.value}).json()
+        if response['query_status'] != 'ok':
+            return self.parse_error(response['query_status'])
+        if 'payloads' in response and response['payloads']:
+            for payload in response['payloads']:
+                file_object = self._create_file_object(payload)
+                if payload['virustotal']:
+                    vt_object = self._create_vt_object(payload['virustotal'])
+                    file_object.add_reference(vt_object.uuid, 'analyzed-with')
+                    self.misp_event.add_object(**vt_object)
+                if any((file_object.attributes, file_object.references)):
+                    self.misp_event.add_object(**file_object)
+        return self.get_result()
+
+
+_misp_type_mapping = {'url': UrlQuery, 'md5': PayloadQuery, 'sha256': PayloadQuery,
+                      'domain': HostQuery, 'hostname': HostQuery,
+                      'ip-src': HostQuery, 'ip-dst': HostQuery}
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    request = json.loads(q)
+    if not request.get('attribute') or not check_input_attribute(request['attribute']):
+        return {'error': f'{standard_error_message}, which should contain at least a type, a value and an uuid.'}
+    attribute = request['attribute']
+    if attribute['type'] not in mispattributes['input']:
+        return {'error': 'Unsupported attribute type.'}
+    urlhaus_parser = _misp_type_mapping[attribute['type']](attribute)
+    return urlhaus_parser.query_api()
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo

misp_modules/modules/expansion/urlscan.py

@@ -0,0 +1,269 @@
+import json
+import requests
+import logging
+import sys
+import time
+
+log = logging.getLogger('urlscan')
+log.setLevel(logging.DEBUG)
+ch = logging.StreamHandler(sys.stdout)
+ch.setLevel(logging.DEBUG)
+formatter = logging.Formatter('%(asctime)s - %(name)s - %(levelname)s - %(message)s')
+ch.setFormatter(formatter)
+log.addHandler(ch)
+
+moduleinfo = {
+    'version': '0.1',
+    'author': 'Dave Johnson',
+    'description': 'An expansion module to query urlscan.io.',
+    'module-type': ['expansion'],
+    'name': 'URLScan Lookup',
+    'logo': 'urlscan.jpg',
+    'requirements': ['An access to the urlscan.io API'],
+    'features': 'This module takes a MISP attribute as input and queries urlscan.io with it.\n\nThe result of this query is then parsed and some data is mapped into MISP attributes in order to enrich the input attribute.',
+    'references': ['https://urlscan.io/'],
+    'input': 'A domain, hostname or url attribute.',
+    'output': 'MISP attributes mapped from the result of the query on urlscan.io.',
+}
+
+moduleconfig = ['apikey']
+misperrors = {'error': 'Error'}
+mispattributes = {
+    'input': ['hostname', 'domain', 'ip-src', 'ip-dst', 'url'],
+    'output': ['hostname', 'domain', 'ip-src', 'ip-dst', 'url', 'text', 'link', 'hash']
+}
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    request = json.loads(q)
+    if not request.get('config') or not request['config'].get('apikey'):
+        misperrors['error'] = 'Urlscan apikey is missing'
+        return misperrors
+    client = urlscanAPI(request['config']['apikey'])
+
+    r = {'results': []}
+
+    if 'ip-src' in request:
+        r['results'] += lookup_indicator(client, request['ip-src'])
+    if 'ip-dst' in request:
+        r['results'] += lookup_indicator(client, request['ip-dst'])
+    if 'domain' in request:
+        r['results'] += lookup_indicator(client, request['domain'])
+    if 'hostname' in request:
+        r['results'] += lookup_indicator(client, request['hostname'])
+    if 'url' in request:
+        r['results'] += lookup_indicator(client, request['url'])
+
+    # Return any errors generated from lookup to the UI and remove duplicates
+
+    uniq = []
+    log.debug(r['results'])
+    for item in r['results']:
+        log.debug(item)
+        if 'error' in item:
+            misperrors['error'] = item['error']
+            return misperrors
+        if item not in uniq:
+            uniq.append(item)
+    r['results'] = uniq
+    return r
+
+
+def lookup_indicator(client, query):
+    result = client.search_url(query)
+    log.debug('RESULTS: ' + json.dumps(result))
+    r = []
+    misp_comment = "{}: Enriched via the urlscan module".format(query)
+
+    # Determine if the page is reachable
+    for request in result['data']['requests']:
+        if request['response'].get('failed'):
+            if request['response']['failed']['errorText']:
+                log.debug('The page could not load')
+                r.append(
+                    {'error': 'Domain could not be resolved: {}'.format(request['response']['failed']['errorText'])})
+
+    if result.get('page'):
+        if result['page'].get('domain'):
+            misp_val = result['page']['domain']
+            r.append({'types': 'domain',
+                      'categories': ['Network activity'],
+                      'values': misp_val,
+                      'comment': misp_comment})
+
+        if result['page'].get('ip'):
+            misp_val = result['page']['ip']
+            r.append({'types': 'ip-dst',
+                      'categories': ['Network activity'],
+                      'values': misp_val,
+                      'comment': misp_comment})
+
+        if result['page'].get('country'):
+            misp_val = 'country: ' + result['page']['country']
+            if result['page'].get('city'):
+                misp_val += ', city: ' + result['page']['city']
+            r.append({'types': 'text',
+                      'categories': ['External analysis'],
+                      'values': misp_val,
+                      'comment': misp_comment})
+
+        if result['page'].get('asn'):
+            misp_val = result['page']['asn']
+            r.append({'types': 'AS', 'categories': ['External analysis'], 'values': misp_val, 'comment': misp_comment})
+
+        if result['page'].get('asnname'):
+            misp_val = result['page']['asnname']
+            r.append({'types': 'text',
+                      'categories': ['External analysis'],
+                      'values': misp_val,
+                      'comment': misp_comment})
+
+    if result.get('stats'):
+        if result['stats'].get('malicious'):
+            log.debug('There is something in results > stats > malicious')
+            threat_list = set()
+
+            if 'matches' in result['meta']['processors']['gsb']['data']:
+                for item in result['meta']['processors']['gsb']['data']['matches']:
+                    if item['threatType']:
+                        threat_list.add(item['threatType'])
+
+            threat_list = ', '.join(threat_list)
+            log.debug('threat_list values are: \'' + threat_list + '\'')
+
+            if threat_list:
+                misp_val = '{} threat(s) detected'.format(threat_list)
+                r.append({'types': 'text',
+                          'categories': ['External analysis'],
+                          'values': misp_val,
+                          'comment': misp_comment})
+
+    if result.get('lists'):
+        if result['lists'].get('urls'):
+            for url in result['lists']['urls']:
+                url = url.lower()
+                if 'office' in url:
+                    misp_val = "Possible Office-themed phishing"
+                elif 'o365' in url or '0365' in url:
+                    misp_val = "Possible O365-themed phishing"
+                elif 'microsoft' in url:
+                    misp_val = "Possible Microsoft-themed phishing"
+                elif 'paypal' in url:
+                    misp_val = "Possible PayPal-themed phishing"
+                elif 'onedrive' in url:
+                    misp_val = "Possible OneDrive-themed phishing"
+                elif 'docusign' in url:
+                    misp_val = "Possible DocuSign-themed phishing"
+                r.append({'types': 'text',
+                          'categories': ['External analysis'],
+                          'values': misp_val,
+                          'comment': misp_comment})
+
+    if result.get('task'):
+        if result['task'].get('reportURL'):
+            misp_val = result['task']['reportURL']
+            r.append({'types': 'link',
+                      'categories': ['External analysis'],
+                      'values': misp_val,
+                      'comment': misp_comment})
+
+        if result['task'].get('screenshotURL'):
+            image_url = result['task']['screenshotURL']
+            r.append({'types': 'link',
+                      'categories': ['External analysis'],
+                      'values': image_url,
+                      'comment': misp_comment})
+            # ## TO DO ###
+            # ## Add ability to add an in-line screenshot of the target website into an attribute
+            # screenshot = requests.get(image_url).content
+            # r.append({'types': ['attachment'],
+            #           'categories': ['External analysis'],
+            #           'values': image_url,
+            #           'image': str(base64.b64encode(screenshot), 'utf-8'),
+            #           'comment': 'Screenshot of website'})
+
+    return r
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo
+
+
+class urlscanAPI():
+    def __init__(self, apikey=None, uuid=None):
+        self.key = apikey
+        self.uuid = uuid
+
+    def request(self, query):
+        log.debug('From request function with the parameter: ' + query)
+        payload = {'url': query}
+        headers = {'API-Key': self.key,
+                   'Content-Type': "application/json",
+                   'Cache-Control': "no-cache"}
+
+        # Troubleshooting problems with initial search request
+        log.debug('PAYLOAD: ' + json.dumps(payload))
+        log.debug('HEADERS: ' + json.dumps(headers))
+
+        search_url_string = "https://urlscan.io/api/v1/scan/"
+        response = requests.request("POST",
+                                    search_url_string,
+                                    data=json.dumps(payload),
+                                    headers=headers)
+
+        # HTTP 400 - Bad Request
+        if response.status_code == 400:
+            raise Exception('HTTP Error 400 - Bad Request')
+
+        # HTTP 404 - Not found
+        if response.status_code == 404:
+            raise Exception('HTTP Error 404 - These are not the droids you\'re looking for')
+
+        # Any other status code
+        if response.status_code != 200:
+            raise Exception('HTTP Error ' + str(response.status_code))
+
+        if response.text:
+            response = json.loads(response.content.decode("utf-8"))
+            time.sleep(3)
+            self.uuid = response['uuid']
+
+            # Strings for to check for errors on the results page
+            # Null response string for any unavailable resources
+            null_response_string = '"status": 404'
+            # Redirect string accounting for 301/302/303/307/308 status codes
+            redirect_string = '"status": 30'
+            # Normal response string with 200 status code
+            normal_response_string = '"status": 200'
+
+            results_url_string = "https://urlscan.io/api/v1/result/" + self.uuid
+            log.debug('Results URL: ' + results_url_string)
+
+            # Need to wait for results to process and check if they are valid
+            tries = 10
+            while tries >= 0:
+                results = requests.request("GET", results_url_string)
+                log.debug('Made a GET request')
+                results = results.content.decode("utf-8")
+                # checking if there is a 404 status code and no available resources
+                if null_response_string in results and \
+                        redirect_string not in results and \
+                        normal_response_string not in results:
+                    log.debug('Results not processed. Please check again later.')
+                    time.sleep(3)
+                    tries -= 1
+                else:
+                    return json.loads(results)
+
+            raise Exception('Results contained a 404 status error and could not be processed.')
+
+    def search_url(self, query):
+        log.debug('From search_url with parameter: ' + query)
+        return self.request(query)