psengine 2.13.0__tar.gz → 2.14.0__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- {psengine-2.13.0 → psengine-2.14.0}/PKG-INFO +1 -1
- {psengine-2.13.0 → psengine-2.14.0}/psengine/endpoints.py +2 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/playbook_alerts/mappings.py +8 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/playbook_alerts/markdown/markdown.py +4 -0
- psengine-2.14.0/psengine/playbook_alerts/markdown/markdown_dark_web.py +146 -0
- psengine-2.14.0/psengine/playbook_alerts/markdown/markdown_social_media_impersonation.py +89 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/playbook_alerts/models/__init__.py +7 -0
- psengine-2.14.0/psengine/playbook_alerts/models/pba_dark_web_brand.py +107 -0
- psengine-2.14.0/psengine/playbook_alerts/models/pba_social_media_impersonation.py +43 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/playbook_alerts/pa_category.py +2 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/playbook_alerts/playbook_alerts.py +34 -0
- {psengine-2.13.0 → psengine-2.14.0}/pyproject.toml +1 -1
- {psengine-2.13.0 → psengine-2.14.0}/pyproject.toml.orig +1 -1
- {psengine-2.13.0 → psengine-2.14.0}/README.md +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/__init__.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/_sdk_id.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/analyst_notes/__init__.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/analyst_notes/constants.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/analyst_notes/errors.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/analyst_notes/helpers.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/analyst_notes/markdown.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/analyst_notes/models.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/analyst_notes/note.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/analyst_notes/note_mgr.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/asi/__init__.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/asi/asi.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/asi/asi_mgr.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/asi/client.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/asi/constants.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/asi/errors.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/asi/models.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/base_http_client.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/classic_alerts/__init__.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/classic_alerts/classic_alert.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/classic_alerts/classic_alert_mgr.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/classic_alerts/constants.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/classic_alerts/errors.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/classic_alerts/helpers.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/classic_alerts/markdown/__init__.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/classic_alerts/markdown/markdown.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/classic_alerts/models.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/collective_insights/__init__.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/collective_insights/collective_insights.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/collective_insights/constants.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/collective_insights/errors.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/collective_insights/insight.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/collective_insights/models.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/common_models.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/config/__init__.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/config/config.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/config/errors.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/constants.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/detection/__init__.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/detection/detection_mgr.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/detection/detection_rule.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/detection/errors.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/detection/helpers.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/detection/models.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/enrich/__init__.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/enrich/constants.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/enrich/errors.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/enrich/lookup.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/enrich/lookup_mgr.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/enrich/models/__init__.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/enrich/models/base_enriched_entity.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/enrich/models/lookup.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/enrich/models/soar.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/enrich/soar.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/enrich/soar_mgr.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/entity_lists/__init__.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/entity_lists/constants.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/entity_lists/entity_list.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/entity_lists/entity_list_mgr.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/entity_lists/errors.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/entity_lists/models.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/entity_match/__init__.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/entity_match/entity_match.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/entity_match/entity_match_mgr.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/entity_match/errors.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/entity_match/models.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/errors.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/fusion/__init__.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/fusion/errors.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/fusion/fusion_mgr.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/fusion/models.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/helpers/__init__.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/helpers/helpers.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/helpers/validation.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/identity/__init__.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/identity/constants.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/identity/errors.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/identity/identity.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/identity/identity_mgr.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/identity/models/__init__.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/identity/models/common_models.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/identity/models/detections.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/identity/models/incident_report.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/identity/models/lookup.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/links/__init__.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/links/errors.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/links/links.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/links/links_mgr.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/links/models.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/logger/__init__.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/logger/constants.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/logger/errors.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/logger/rf_logger.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/malware_intel/__init__.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/malware_intel/auto_sigma_mgr.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/malware_intel/auto_yara_mgr.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/malware_intel/constants.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/malware_intel/errors.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/malware_intel/helpers.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/malware_intel/malware_intel.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/malware_intel/malware_intel_mgr.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/malware_intel/models.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/markdown/__init__.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/markdown/markdown.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/markdown/markdown_strings.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/markdown/models.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/playbook_alerts/__init__.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/playbook_alerts/constants.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/playbook_alerts/errors.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/playbook_alerts/helpers.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/playbook_alerts/markdown/__init__.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/playbook_alerts/markdown/markdown_code_repo.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/playbook_alerts/markdown/markdown_compromised_bank_checks.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/playbook_alerts/markdown/markdown_cyber_vulnerability.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/playbook_alerts/markdown/markdown_domain_abuse.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/playbook_alerts/markdown/markdown_geopolitics_facility.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/playbook_alerts/markdown/markdown_identity_exposure.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/playbook_alerts/markdown/markdown_malicious_sites.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/playbook_alerts/markdown/markdown_malware_report.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/playbook_alerts/markdown/markdown_third_party_risk.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/playbook_alerts/models/common_models.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/playbook_alerts/models/panel_log/__init__.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/playbook_alerts/models/panel_log/code_repo.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/playbook_alerts/models/panel_log/common.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/playbook_alerts/models/panel_log/domain_abuse.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/playbook_alerts/models/panel_log/generic.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/playbook_alerts/models/panel_log/geopolitics.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/playbook_alerts/models/panel_log/malicious_sites.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/playbook_alerts/models/panel_log/panel_log_v2.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/playbook_alerts/models/panel_log/tpr.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/playbook_alerts/models/panel_log/vulnerability.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/playbook_alerts/models/panel_status.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/playbook_alerts/models/pba_code_repo_leak.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/playbook_alerts/models/pba_compromised_bank_checks.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/playbook_alerts/models/pba_cyber_vulnerability.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/playbook_alerts/models/pba_domain_abuse.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/playbook_alerts/models/pba_geopolitics_facility.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/playbook_alerts/models/pba_identity_exposures.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/playbook_alerts/models/pba_malicious_sites.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/playbook_alerts/models/pba_malware_report.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/playbook_alerts/models/pba_third_party_risk.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/playbook_alerts/models/search_endpoint.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/playbook_alerts/playbook_alert_mgr.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/rf_client.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/risk_history/__init__.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/risk_history/errors.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/risk_history/models.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/risk_history/risk_history_mgr.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/risk_rules/__init__.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/risk_rules/errors.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/risk_rules/models.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/risk_rules/risk_rule.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/risk_rules/risk_rule_mgr.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/risklists/__init__.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/risklists/constants.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/risklists/errors.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/risklists/models.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/risklists/risklist_mgr.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/sandbox/__init__.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/sandbox/client.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/sandbox/constants.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/sandbox/errors.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/sandbox/models/__init__.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/sandbox/models/analysis.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/sandbox/models/behavioral_report.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/sandbox/models/overview_report.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/sandbox/models/static_report.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/sandbox/sandbox.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/sandbox/sandbox_mgr.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/stix2/__init__.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/stix2/base_stix_entity.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/stix2/complex_entity.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/stix2/constants.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/stix2/enriched_indicator.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/stix2/errors.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/stix2/helpers.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/stix2/rf_bundle.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/stix2/simple_entity.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/stix2/util.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/threat_maps/__init__.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/threat_maps/errors.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/threat_maps/models.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/threat_maps/threat_map.py +0 -0
- {psengine-2.13.0 → psengine-2.14.0}/psengine/threat_maps/threat_map_mgr.py +0 -0
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
Metadata-Version: 2.4
|
|
2
2
|
Name: psengine
|
|
3
|
-
Version: 2.
|
|
3
|
+
Version: 2.14.0
|
|
4
4
|
Summary: psengine is a simple, yet elegant, library for rapid development of integrations with Recorded Future.
|
|
5
5
|
Keywords: API,Recorded Future,Cyber Security Engineering,Threat Intelligence
|
|
6
6
|
Author: Moise Medici, Patrick Kinsella, Ernest Bartosevic
|
|
@@ -62,6 +62,8 @@ EP_PLAYBOOK_ALERT_MALICIOUS_SITES = EP_PLAYBOOK_ALERT + '/malicious_sites'
|
|
|
62
62
|
EP_PLAYBOOK_ALERT_MALICIOUS_SITES_CREATE = EP_PLAYBOOK_ALERT_MALICIOUS_SITES + '/create'
|
|
63
63
|
EP_PLAYBOOK_ALERT_THIRD_PARTY_RISK = EP_PLAYBOOK_ALERT + '/third_party_risk'
|
|
64
64
|
EP_PLAYBOOK_ALERT_MALWARE_REPORT = EP_PLAYBOOK_ALERT + '/malware_report'
|
|
65
|
+
EP_PLAYBOOK_ALERT_DARK_WEB_BRAND = EP_PLAYBOOK_ALERT + '/dark_web_brand'
|
|
66
|
+
EP_PLAYBOOK_ALERT_SOCIAL_MEDIA_IMPERSONATION = EP_PLAYBOOK_ALERT + '/social_media_impersonation'
|
|
65
67
|
|
|
66
68
|
###############################################################################
|
|
67
69
|
# Entity Match Endpoint
|
|
@@ -15,11 +15,13 @@ from ..endpoints import (
|
|
|
15
15
|
EP_PLAYBOOK_ALERT_CODE_REPO_LEAKAGE,
|
|
16
16
|
EP_PLAYBOOK_ALERT_COMPROMISED_BANK_CHECKS,
|
|
17
17
|
EP_PLAYBOOK_ALERT_CYBER_VULNERABILITY,
|
|
18
|
+
EP_PLAYBOOK_ALERT_DARK_WEB_BRAND,
|
|
18
19
|
EP_PLAYBOOK_ALERT_DOMAIN_ABUSE,
|
|
19
20
|
EP_PLAYBOOK_ALERT_GEOPOLITICS_FACILITY,
|
|
20
21
|
EP_PLAYBOOK_ALERT_IDENTITY_NOVEL_EXPOSURES,
|
|
21
22
|
EP_PLAYBOOK_ALERT_MALICIOUS_SITES,
|
|
22
23
|
EP_PLAYBOOK_ALERT_MALWARE_REPORT,
|
|
24
|
+
EP_PLAYBOOK_ALERT_SOCIAL_MEDIA_IMPERSONATION,
|
|
23
25
|
EP_PLAYBOOK_ALERT_THIRD_PARTY_RISK,
|
|
24
26
|
)
|
|
25
27
|
from .pa_category import PACategory
|
|
@@ -27,11 +29,13 @@ from .playbook_alerts import (
|
|
|
27
29
|
PBA_CodeRepoLeakage,
|
|
28
30
|
PBA_CompromisedBankChecks,
|
|
29
31
|
PBA_CyberVulnerability,
|
|
32
|
+
PBA_DarkWebBrand,
|
|
30
33
|
PBA_DomainAbuse,
|
|
31
34
|
PBA_GeopoliticsFacility,
|
|
32
35
|
PBA_IdentityNovelExposure,
|
|
33
36
|
PBA_MaliciousSites,
|
|
34
37
|
PBA_MalwareReport,
|
|
38
|
+
PBA_SocialMediaImpersonation,
|
|
35
39
|
PBA_ThirdPartyRisk,
|
|
36
40
|
)
|
|
37
41
|
|
|
@@ -45,6 +49,8 @@ CATEGORY_ENDPOINTS = {
|
|
|
45
49
|
PACategory.THIRD_PARTY_RISK.value: EP_PLAYBOOK_ALERT_THIRD_PARTY_RISK,
|
|
46
50
|
PACategory.MALWARE_REPORT.value: EP_PLAYBOOK_ALERT_MALWARE_REPORT,
|
|
47
51
|
PACategory.MALICIOUS_SITES.value: EP_PLAYBOOK_ALERT_MALICIOUS_SITES,
|
|
52
|
+
PACategory.DARK_WEB_BRAND.value: EP_PLAYBOOK_ALERT_DARK_WEB_BRAND,
|
|
53
|
+
PACategory.SOCIAL_MEDIA_IMPERSONATION.value: EP_PLAYBOOK_ALERT_SOCIAL_MEDIA_IMPERSONATION,
|
|
48
54
|
}
|
|
49
55
|
|
|
50
56
|
CATEGORY_TO_OBJECT_MAP = {
|
|
@@ -57,4 +63,6 @@ CATEGORY_TO_OBJECT_MAP = {
|
|
|
57
63
|
PACategory.THIRD_PARTY_RISK.value: PBA_ThirdPartyRisk,
|
|
58
64
|
PACategory.MALWARE_REPORT.value: PBA_MalwareReport,
|
|
59
65
|
PACategory.MALICIOUS_SITES.value: PBA_MaliciousSites,
|
|
66
|
+
PACategory.DARK_WEB_BRAND.value: PBA_DarkWebBrand,
|
|
67
|
+
PACategory.SOCIAL_MEDIA_IMPERSONATION.value: PBA_SocialMediaImpersonation,
|
|
60
68
|
}
|
|
@@ -21,11 +21,13 @@ from ..pa_category import PACategory
|
|
|
21
21
|
from .markdown_code_repo import _code_repo_markdown
|
|
22
22
|
from .markdown_compromised_bank_checks import _compromised_bank_check_markdown
|
|
23
23
|
from .markdown_cyber_vulnerability import _cyber_vulnerability_markdown
|
|
24
|
+
from .markdown_dark_web import _dark_web_markdown
|
|
24
25
|
from .markdown_domain_abuse import _domain_abuse_markdown
|
|
25
26
|
from .markdown_geopolitics_facility import _geopolitics_facility_markdown
|
|
26
27
|
from .markdown_identity_exposure import _identity_exposure_markdown
|
|
27
28
|
from .markdown_malicious_sites import _malicious_sites_markdown
|
|
28
29
|
from .markdown_malware_report import _malware_report_markdown
|
|
30
|
+
from .markdown_social_media_impersonation import _social_media_impersonation_markdown
|
|
29
31
|
from .markdown_third_party_risk import _third_party_risk_markdown
|
|
30
32
|
|
|
31
33
|
PORTAL_URL = 'https://app.recordedfuture.com/portal/playbook-alerts/{}'
|
|
@@ -42,6 +44,8 @@ MARKDOWN_BY_PBA_TYPE = {
|
|
|
42
44
|
PACategory.MALWARE_REPORT.value: _malware_report_markdown,
|
|
43
45
|
PACategory.MALICIOUS_SITES.value: _malicious_sites_markdown,
|
|
44
46
|
PACategory.COMPROMISED_BANK_CHECKS.value: _compromised_bank_check_markdown,
|
|
47
|
+
PACategory.DARK_WEB_BRAND.value: _dark_web_markdown,
|
|
48
|
+
PACategory.SOCIAL_MEDIA_IMPERSONATION.value: _social_media_impersonation_markdown,
|
|
45
49
|
}
|
|
46
50
|
|
|
47
51
|
|
|
@@ -0,0 +1,146 @@
|
|
|
1
|
+
##################################### TERMS OF USE ###########################################
|
|
2
|
+
# The following code is provided for demonstration purpose only, and should not be used #
|
|
3
|
+
# without independent verification. Recorded Future makes no representations or warranties, #
|
|
4
|
+
# express, implied, statutory, or otherwise, regarding any aspect of this code or of the #
|
|
5
|
+
# information it may retrieve, and provides it both strictly “as-is” and without assuming #
|
|
6
|
+
# responsibility for any information it may retrieve. Recorded Future shall not be liable #
|
|
7
|
+
# for, and you assume all risk of using, the foregoing. By using this code, Customer #
|
|
8
|
+
# represents that it is solely responsible for having all necessary licenses, permissions, #
|
|
9
|
+
# rights, and/or consents to connect to third party APIs, and that it is solely responsible #
|
|
10
|
+
# for having all necessary licenses, permissions, rights, and/or consents to any data #
|
|
11
|
+
# accessed from any third party API. #
|
|
12
|
+
##############################################################################################
|
|
13
|
+
|
|
14
|
+
from typing import TYPE_CHECKING
|
|
15
|
+
|
|
16
|
+
from ...constants import TIMESTAMP_STR
|
|
17
|
+
from ...markdown import MarkdownMaker
|
|
18
|
+
from ...markdown.markdown_strings import bold
|
|
19
|
+
|
|
20
|
+
if TYPE_CHECKING:
|
|
21
|
+
from ...playbook_alerts.playbook_alerts import PBA_DarkWebBrand
|
|
22
|
+
|
|
23
|
+
|
|
24
|
+
def _add_panel_triage(pba: 'PBA_DarkWebBrand', md_maker: MarkdownMaker):
|
|
25
|
+
triage_details = []
|
|
26
|
+
if pba.panel_analysis_report:
|
|
27
|
+
triage_details.append(f'{bold("Assessment")}: {pba.panel_triage.assessment.name}')
|
|
28
|
+
triage_details.append(f'{bold("Criticality")}: {pba.panel_triage.assessment.criticality}')
|
|
29
|
+
triage_details.append(f'{bold("Rational")}: {pba.panel_triage.rationale}')
|
|
30
|
+
|
|
31
|
+
if triage_details:
|
|
32
|
+
md_maker.add_section('AI Triage', triage_details)
|
|
33
|
+
|
|
34
|
+
|
|
35
|
+
def _add_matched_assets_assessments(pba: 'PBA_DarkWebBrand', md_maker: MarkdownMaker):
|
|
36
|
+
matched_assets_assessment = []
|
|
37
|
+
if pba.panel_evidence_summary.matched_assets:
|
|
38
|
+
matched_assets_assessment.extend(
|
|
39
|
+
f'{bold("Matched Asset")}: {matched_asset.name}\n'
|
|
40
|
+
for matched_asset in pba.panel_evidence_summary.matched_assets
|
|
41
|
+
)
|
|
42
|
+
|
|
43
|
+
if pba.panel_evidence_summary.assessments:
|
|
44
|
+
assessments = [assessment.name for assessment in pba.panel_evidence_summary.assessments]
|
|
45
|
+
matched_assets_assessment.append(f'{bold("Assessments")}: {", ".join(assessments)}')
|
|
46
|
+
|
|
47
|
+
if matched_assets_assessment:
|
|
48
|
+
md_maker.add_section('Matched Asset(s)', matched_assets_assessment)
|
|
49
|
+
|
|
50
|
+
|
|
51
|
+
def _add_post_details_ransomware(pba: 'PBA_DarkWebBrand', md_maker: MarkdownMaker):
|
|
52
|
+
post_details = []
|
|
53
|
+
details = pba.panel_evidence_summary.details
|
|
54
|
+
|
|
55
|
+
if details.source:
|
|
56
|
+
post_details.append(f'{bold("Source")}: {details.source.name}')
|
|
57
|
+
|
|
58
|
+
if details.post_details:
|
|
59
|
+
post_details.append(f'{bold("Post Details")}: {details.post_details}')
|
|
60
|
+
|
|
61
|
+
if details.post_date:
|
|
62
|
+
post_details.append(f'{bold("Date")}: {details.post_date.strftime(TIMESTAMP_STR)}')
|
|
63
|
+
|
|
64
|
+
if post_details:
|
|
65
|
+
md_maker.add_section('Incident Details', post_details)
|
|
66
|
+
|
|
67
|
+
|
|
68
|
+
def _add_post_details_telegram(pba: 'PBA_DarkWebBrand', md_maker: MarkdownMaker):
|
|
69
|
+
post_details = []
|
|
70
|
+
details = pba.panel_evidence_summary.details
|
|
71
|
+
if details.source:
|
|
72
|
+
post_details.append(f'{bold("Source")}: {details.source.name}')
|
|
73
|
+
|
|
74
|
+
if details.telegram_channel_title:
|
|
75
|
+
post_details.append(f'{bold("Channel Title")}: {details.telegram_channel_title}')
|
|
76
|
+
|
|
77
|
+
if details.post:
|
|
78
|
+
post_details.append(f'{bold("Post")}: {pba.panel_evidence_summary.details.post}')
|
|
79
|
+
|
|
80
|
+
if pba.panel_evidence_summary.details.publish_date:
|
|
81
|
+
post_details.append(f'{bold("Date")}: {details.publish_date.strftime(TIMESTAMP_STR)}')
|
|
82
|
+
|
|
83
|
+
if post_details:
|
|
84
|
+
md_maker.add_section('Incident Details', post_details)
|
|
85
|
+
|
|
86
|
+
|
|
87
|
+
def _add_post_details_forum_mention(pba: 'PBA_DarkWebBrand', md_maker: MarkdownMaker):
|
|
88
|
+
post_details = []
|
|
89
|
+
details = pba.panel_evidence_summary.details
|
|
90
|
+
if details.post_title:
|
|
91
|
+
post_details.append(f'{bold("Title")}: {details.post_title}')
|
|
92
|
+
|
|
93
|
+
if details.post:
|
|
94
|
+
post_details.append(f'{bold("Content")}: {details.post}')
|
|
95
|
+
|
|
96
|
+
if details.post_date:
|
|
97
|
+
post_details.append(f'{bold("Date")}: {details.post_date.strftime(TIMESTAMP_STR)}')
|
|
98
|
+
|
|
99
|
+
if post_details:
|
|
100
|
+
md_maker.add_section('Post Details', post_details)
|
|
101
|
+
|
|
102
|
+
|
|
103
|
+
def _add_post_details_market_mention(pba: 'PBA_DarkWebBrand', md_maker: MarkdownMaker):
|
|
104
|
+
post_details = []
|
|
105
|
+
details = pba.panel_evidence_summary.details
|
|
106
|
+
if details.source:
|
|
107
|
+
post_details.append(f'{bold("Source")}: {details.source.name}')
|
|
108
|
+
|
|
109
|
+
if details.listing_title:
|
|
110
|
+
post_details.append(f'{bold("Listing Title")}: {details.listing_title}')
|
|
111
|
+
|
|
112
|
+
if details.listing_content:
|
|
113
|
+
post_details.append(f'{bold("Listing Content")}: {details.listing_content}')
|
|
114
|
+
|
|
115
|
+
if details.post_date:
|
|
116
|
+
post_details.append(f'{bold("Date")}: {details.post_date.strftime(TIMESTAMP_STR)}')
|
|
117
|
+
|
|
118
|
+
if post_details:
|
|
119
|
+
md_maker.add_section('Post Details', post_details)
|
|
120
|
+
|
|
121
|
+
|
|
122
|
+
def _dark_web_markdown(
|
|
123
|
+
pba: 'PBA_DarkWebBrand',
|
|
124
|
+
md_maker: MarkdownMaker,
|
|
125
|
+
*args, # noqa: ARG001
|
|
126
|
+
):
|
|
127
|
+
_add_panel_triage(pba, md_maker)
|
|
128
|
+
_add_matched_assets_assessments(pba, md_maker)
|
|
129
|
+
|
|
130
|
+
details = pba.panel_evidence_summary.details
|
|
131
|
+
|
|
132
|
+
if details is None:
|
|
133
|
+
pass
|
|
134
|
+
elif details.type == 'ransomware_extortion_site':
|
|
135
|
+
_add_post_details_ransomware(pba, md_maker)
|
|
136
|
+
|
|
137
|
+
elif details.type == 'telegram_mention':
|
|
138
|
+
_add_post_details_telegram(pba, md_maker)
|
|
139
|
+
|
|
140
|
+
elif details.type == 'dark_web_forum_mention':
|
|
141
|
+
_add_post_details_forum_mention(pba, md_maker)
|
|
142
|
+
|
|
143
|
+
elif details.type == 'dark_web_market_mention':
|
|
144
|
+
_add_post_details_market_mention(pba, md_maker)
|
|
145
|
+
|
|
146
|
+
return md_maker.format_output()
|
|
@@ -0,0 +1,89 @@
|
|
|
1
|
+
##################################### TERMS OF USE ###########################################
|
|
2
|
+
# The following code is provided for demonstration purpose only, and should not be used #
|
|
3
|
+
# without independent verification. Recorded Future makes no representations or warranties, #
|
|
4
|
+
# express, implied, statutory, or otherwise, regarding any aspect of this code or of the #
|
|
5
|
+
# information it may retrieve, and provides it both strictly “as-is” and without assuming #
|
|
6
|
+
# responsibility for any information it may retrieve. Recorded Future shall not be liable #
|
|
7
|
+
# for, and you assume all risk of using, the foregoing. By using this code, Customer #
|
|
8
|
+
# represents that it is solely responsible for having all necessary licenses, permissions, #
|
|
9
|
+
# rights, and/or consents to connect to third party APIs, and that it is solely responsible #
|
|
10
|
+
# for having all necessary licenses, permissions, rights, and/or consents to any data #
|
|
11
|
+
# accessed from any third party API. #
|
|
12
|
+
##############################################################################################
|
|
13
|
+
from typing import TYPE_CHECKING
|
|
14
|
+
|
|
15
|
+
from ...constants import TIMESTAMP_STR
|
|
16
|
+
from ...markdown import MarkdownMaker
|
|
17
|
+
from ...markdown.markdown_strings import bold
|
|
18
|
+
|
|
19
|
+
if TYPE_CHECKING:
|
|
20
|
+
from ...playbook_alerts.playbook_alerts import PBA_SocialMediaImpersonation
|
|
21
|
+
|
|
22
|
+
|
|
23
|
+
def _add_matched_assets_assessment(pba: 'PBA_SocialMediaImpersonation', md_maker: MarkdownMaker):
|
|
24
|
+
matched_assets_assessment = []
|
|
25
|
+
if pba.panel_evidence_summary.matched_assets:
|
|
26
|
+
matched_assets_assessment.extend(
|
|
27
|
+
f'{bold("Matched Asset")}: {matched_asset.name}\n'
|
|
28
|
+
for matched_asset in pba.panel_evidence_summary.matched_assets
|
|
29
|
+
)
|
|
30
|
+
|
|
31
|
+
if pba.panel_evidence_summary.assessments:
|
|
32
|
+
assessments = [assessment.name for assessment in pba.panel_evidence_summary.assessments]
|
|
33
|
+
matched_assets_assessment.append(f'{bold("Assessments")}: {", ".join(assessments)}')
|
|
34
|
+
|
|
35
|
+
if matched_assets_assessment:
|
|
36
|
+
md_maker.add_section('Summary', matched_assets_assessment)
|
|
37
|
+
|
|
38
|
+
|
|
39
|
+
def _add_post_details(pba: 'PBA_SocialMediaImpersonation', md_maker: MarkdownMaker):
|
|
40
|
+
post_details = []
|
|
41
|
+
if pba.panel_evidence_summary.user_name:
|
|
42
|
+
post_details.append(f'{bold("Username")}: {pba.panel_evidence_summary.user_name}')
|
|
43
|
+
|
|
44
|
+
if pba.panel_evidence_summary.user_handle:
|
|
45
|
+
post_details.append(f'{bold("Username")}: {pba.panel_evidence_summary.user_handle}')
|
|
46
|
+
|
|
47
|
+
if pba.panel_evidence_summary.description:
|
|
48
|
+
post_details.append(
|
|
49
|
+
f'{bold("Bio/About/Description")}: {pba.panel_evidence_summary.description}'
|
|
50
|
+
)
|
|
51
|
+
|
|
52
|
+
if pba.panel_evidence_summary.created_date:
|
|
53
|
+
post_details.append(
|
|
54
|
+
f'{bold("Page Creation Date")}: '
|
|
55
|
+
f'{pba.panel_evidence_summary.created_date.strftime(TIMESTAMP_STR)}'
|
|
56
|
+
)
|
|
57
|
+
|
|
58
|
+
if pba.panel_evidence_summary.number_of_followers:
|
|
59
|
+
post_details.append(
|
|
60
|
+
f'{bold("Follower Count")}: {pba.panel_evidence_summary.number_of_followers}'
|
|
61
|
+
)
|
|
62
|
+
|
|
63
|
+
if pba.panel_evidence_summary.number_of_posts:
|
|
64
|
+
post_details.append(f'{bold("Posts")}: {pba.panel_evidence_summary.number_of_posts}')
|
|
65
|
+
|
|
66
|
+
if pba.panel_evidence_summary.private_profile:
|
|
67
|
+
post_details.append(
|
|
68
|
+
f'{bold("Private Account")}: {pba.panel_evidence_summary.private_profile}'
|
|
69
|
+
)
|
|
70
|
+
|
|
71
|
+
if pba.panel_evidence_summary.profile_url_id:
|
|
72
|
+
post_details.append(
|
|
73
|
+
f'{bold("Account URL")}: '
|
|
74
|
+
f'{pba.panel_evidence_summary.profile_url_id.replace("url:", "")}'
|
|
75
|
+
)
|
|
76
|
+
|
|
77
|
+
if post_details:
|
|
78
|
+
md_maker.add_section('Post Details', post_details)
|
|
79
|
+
|
|
80
|
+
|
|
81
|
+
def _social_media_impersonation_markdown(
|
|
82
|
+
pba: 'PBA_SocialMediaImpersonation',
|
|
83
|
+
md_maker: MarkdownMaker,
|
|
84
|
+
*args, # noqa: ARG001
|
|
85
|
+
):
|
|
86
|
+
_add_matched_assets_assessment(pba, md_maker)
|
|
87
|
+
_add_post_details(pba, md_maker)
|
|
88
|
+
|
|
89
|
+
return md_maker.format_output()
|
|
@@ -26,6 +26,12 @@ from .pba_cyber_vulnerability import (
|
|
|
26
26
|
CyberVulnerabilityPanelEvidence,
|
|
27
27
|
CyberVulnerabilityPanelStatus,
|
|
28
28
|
)
|
|
29
|
+
from .pba_dark_web_brand import (
|
|
30
|
+
DarkWebPanelAnalysisReport,
|
|
31
|
+
DarkWebPanelCachedContent,
|
|
32
|
+
DarkWebPanelEvidenceSummary,
|
|
33
|
+
DarkWebPanelTriage,
|
|
34
|
+
)
|
|
29
35
|
from .pba_domain_abuse import (
|
|
30
36
|
DomainAbusePanelEvidenceDns,
|
|
31
37
|
DomainAbusePanelEvidenceSummary,
|
|
@@ -49,5 +55,6 @@ from .pba_malicious_sites import (
|
|
|
49
55
|
MaliciousSitesPanelStatus,
|
|
50
56
|
)
|
|
51
57
|
from .pba_malware_report import MalwareReportPanelEvidence, MalwareReportPanelStatus
|
|
58
|
+
from .pba_social_media_impersonation import SocialMediaImpersonationPanelEvidenceSummary
|
|
52
59
|
from .pba_third_party_risk import TPRAssessment, TPRPanelEvidence, TPRPanelStatus
|
|
53
60
|
from .search_endpoint import DatetimeRange, SearchCounts, SearchData, SearchResponse, SearchStatus
|
|
@@ -0,0 +1,107 @@
|
|
|
1
|
+
##################################### TERMS OF USE ###########################################
|
|
2
|
+
# The following code is provided for demonstration purpose only, and should not be used #
|
|
3
|
+
# without independent verification. Recorded Future makes no representations or warranties, #
|
|
4
|
+
# express, implied, statutory, or otherwise, regarding any aspect of this code or of the #
|
|
5
|
+
# information it may retrieve, and provides it both strictly “as-is” and without assuming #
|
|
6
|
+
# responsibility for any information it may retrieve. Recorded Future shall not be liable #
|
|
7
|
+
# for, and you assume all risk of using, the foregoing. By using this code, Customer #
|
|
8
|
+
# represents that it is solely responsible for having all necessary licenses, permissions, #
|
|
9
|
+
# rights, and/or consents to connect to third party APIs, and that it is solely responsible #
|
|
10
|
+
# for having all necessary licenses, permissions, rights, and/or consents to any data #
|
|
11
|
+
# accessed from any third party API. #
|
|
12
|
+
##############################################################################################
|
|
13
|
+
|
|
14
|
+
from datetime import datetime
|
|
15
|
+
from typing import Annotated, Literal
|
|
16
|
+
|
|
17
|
+
from pydantic import Field, HttpUrl
|
|
18
|
+
|
|
19
|
+
from ...common_models import RFBaseModel
|
|
20
|
+
|
|
21
|
+
|
|
22
|
+
class Assessment(RFBaseModel):
|
|
23
|
+
name: str | None = None
|
|
24
|
+
criticality: str | None = None
|
|
25
|
+
|
|
26
|
+
|
|
27
|
+
class Entity(RFBaseModel):
|
|
28
|
+
entity_id: str
|
|
29
|
+
name: str | None = None
|
|
30
|
+
|
|
31
|
+
|
|
32
|
+
class DarkWebPanelCachedContent(RFBaseModel):
|
|
33
|
+
title: str
|
|
34
|
+
downloaded: str
|
|
35
|
+
original_url: str | None = None
|
|
36
|
+
content: str
|
|
37
|
+
|
|
38
|
+
|
|
39
|
+
class DarkWebPanelTriage(RFBaseModel):
|
|
40
|
+
rationale: str | None = None
|
|
41
|
+
assessment: Assessment | None = Field(default_factory=Assessment)
|
|
42
|
+
|
|
43
|
+
|
|
44
|
+
class DarkWebPanelAnalysisReport(RFBaseModel):
|
|
45
|
+
title: str | None = None
|
|
46
|
+
source: Entity | None = None
|
|
47
|
+
created: datetime | None = None
|
|
48
|
+
content: str | None = None
|
|
49
|
+
|
|
50
|
+
|
|
51
|
+
class DarkWebMatchedAssets(RFBaseModel):
|
|
52
|
+
type: str
|
|
53
|
+
entity_id: str
|
|
54
|
+
name: str | None = None
|
|
55
|
+
|
|
56
|
+
|
|
57
|
+
class DarkWebBrandRansomwareDetails(RFBaseModel):
|
|
58
|
+
type: Literal['ransomware_extortion_site']
|
|
59
|
+
ransomware_group: Entity
|
|
60
|
+
source: Entity
|
|
61
|
+
incident_url: str | None = None
|
|
62
|
+
post_details: str | None = None
|
|
63
|
+
post_date: datetime
|
|
64
|
+
|
|
65
|
+
|
|
66
|
+
class DarkWebTelegramDetails(RFBaseModel):
|
|
67
|
+
type: Literal['telegram_mention']
|
|
68
|
+
telegram_channel_title: str
|
|
69
|
+
source: Entity
|
|
70
|
+
message_url: HttpUrl
|
|
71
|
+
post: str | None = None
|
|
72
|
+
publish_date: datetime
|
|
73
|
+
|
|
74
|
+
|
|
75
|
+
class DarkWebForumMentionDetails(RFBaseModel):
|
|
76
|
+
type: Literal['dark_web_forum_mention']
|
|
77
|
+
source: Entity
|
|
78
|
+
post_title: str
|
|
79
|
+
post: str | None = None
|
|
80
|
+
post_date: datetime
|
|
81
|
+
post_url: str | None = None
|
|
82
|
+
|
|
83
|
+
|
|
84
|
+
class DarkWebMarketDetails(RFBaseModel):
|
|
85
|
+
type: Literal['dark_web_market_mention']
|
|
86
|
+
source: Entity
|
|
87
|
+
market_url: str
|
|
88
|
+
listing_title: str
|
|
89
|
+
listing_content: str | None = None
|
|
90
|
+
post_date: datetime
|
|
91
|
+
post_url: HttpUrl | None = None
|
|
92
|
+
|
|
93
|
+
|
|
94
|
+
class DarkWebPanelEvidenceSummary(RFBaseModel):
|
|
95
|
+
matched_assets: list[DarkWebMatchedAssets] | None = []
|
|
96
|
+
assessments: list[Assessment] | None = []
|
|
97
|
+
screenshot_ids: list[str] | None = []
|
|
98
|
+
details: (
|
|
99
|
+
Annotated[
|
|
100
|
+
DarkWebBrandRansomwareDetails
|
|
101
|
+
| DarkWebTelegramDetails
|
|
102
|
+
| DarkWebForumMentionDetails
|
|
103
|
+
| DarkWebMarketDetails,
|
|
104
|
+
Field(discriminator='type'),
|
|
105
|
+
]
|
|
106
|
+
| None
|
|
107
|
+
) = None
|
|
@@ -0,0 +1,43 @@
|
|
|
1
|
+
##################################### TERMS OF USE ###########################################
|
|
2
|
+
# The following code is provided for demonstration purpose only, and should not be used #
|
|
3
|
+
# without independent verification. Recorded Future makes no representations or warranties, #
|
|
4
|
+
# express, implied, statutory, or otherwise, regarding any aspect of this code or of the #
|
|
5
|
+
# information it may retrieve, and provides it both strictly “as-is” and without assuming #
|
|
6
|
+
# responsibility for any information it may retrieve. Recorded Future shall not be liable #
|
|
7
|
+
# for, and you assume all risk of using, the foregoing. By using this code, Customer #
|
|
8
|
+
# represents that it is solely responsible for having all necessary licenses, permissions, #
|
|
9
|
+
# rights, and/or consents to connect to third party APIs, and that it is solely responsible #
|
|
10
|
+
# for having all necessary licenses, permissions, rights, and/or consents to any data #
|
|
11
|
+
# accessed from any third party API. #
|
|
12
|
+
##############################################################################################
|
|
13
|
+
|
|
14
|
+
from datetime import datetime
|
|
15
|
+
|
|
16
|
+
from pydantic import Field
|
|
17
|
+
|
|
18
|
+
from ...common_models import RFBaseModel
|
|
19
|
+
|
|
20
|
+
|
|
21
|
+
class SocialMediaMatchedAssets(RFBaseModel):
|
|
22
|
+
type: str
|
|
23
|
+
entity_id: str
|
|
24
|
+
name: str | None = None
|
|
25
|
+
|
|
26
|
+
|
|
27
|
+
class Assessment(RFBaseModel):
|
|
28
|
+
name: str
|
|
29
|
+
criticality: str
|
|
30
|
+
|
|
31
|
+
|
|
32
|
+
class SocialMediaImpersonationPanelEvidenceSummary(RFBaseModel):
|
|
33
|
+
matched_assets: list[SocialMediaMatchedAssets] | None = []
|
|
34
|
+
assessments: list[Assessment] | None = []
|
|
35
|
+
profile_url_id: str | None = None
|
|
36
|
+
platform_id: str | None = None
|
|
37
|
+
user_name: str | None = Field(alias='username', default=None)
|
|
38
|
+
user_handle: str | None = None
|
|
39
|
+
description: str | None = None
|
|
40
|
+
created_date: datetime | None = None
|
|
41
|
+
number_of_posts: int | None = None
|
|
42
|
+
number_of_followers: int | None = None
|
|
43
|
+
private_profile: bool | None = None
|
|
@@ -38,6 +38,10 @@ from .models import (
|
|
|
38
38
|
CompromisedBankCheckPanelStatus,
|
|
39
39
|
CyberVulnerabilityPanelEvidence,
|
|
40
40
|
CyberVulnerabilityPanelStatus,
|
|
41
|
+
DarkWebPanelAnalysisReport,
|
|
42
|
+
DarkWebPanelCachedContent,
|
|
43
|
+
DarkWebPanelEvidenceSummary,
|
|
44
|
+
DarkWebPanelTriage,
|
|
41
45
|
DatetimeRange,
|
|
42
46
|
DomainAbusePanelEvidenceDns,
|
|
43
47
|
DomainAbusePanelEvidenceSummary,
|
|
@@ -55,6 +59,7 @@ from .models import (
|
|
|
55
59
|
MaliciousSitesPanelStatus,
|
|
56
60
|
MalwareReportPanelEvidence,
|
|
57
61
|
MalwareReportPanelStatus,
|
|
62
|
+
SocialMediaImpersonationPanelEvidenceSummary,
|
|
58
63
|
TPRAssessment,
|
|
59
64
|
TPRPanelEvidence,
|
|
60
65
|
TPRPanelStatus,
|
|
@@ -782,6 +787,35 @@ class PBA_MalwareReport(PBA_Generic):
|
|
|
782
787
|
)
|
|
783
788
|
|
|
784
789
|
|
|
790
|
+
class PBA_DarkWebBrand(PBA_Generic):
|
|
791
|
+
"""Model for Dark Web Brand. Inherit behaviors from `PBA_Generic`."""
|
|
792
|
+
|
|
793
|
+
__doc__ = __doc__ + '\n\n' + PBA_Generic.__doc__ # noqa: A003
|
|
794
|
+
|
|
795
|
+
category: str = PACategory.DARK_WEB_BRAND.value
|
|
796
|
+
|
|
797
|
+
panel_evidence_summary: DarkWebPanelEvidenceSummary | None = Field(
|
|
798
|
+
default_factory=DarkWebPanelEvidenceSummary
|
|
799
|
+
)
|
|
800
|
+
panel_cached_content: DarkWebPanelCachedContent | None = None
|
|
801
|
+
panel_triage: DarkWebPanelTriage | None = Field(default_factory=DarkWebPanelTriage)
|
|
802
|
+
panel_analysis_report: DarkWebPanelAnalysisReport | None = Field(
|
|
803
|
+
default_factory=DarkWebPanelAnalysisReport
|
|
804
|
+
)
|
|
805
|
+
|
|
806
|
+
|
|
807
|
+
class PBA_SocialMediaImpersonation(PBA_Generic):
|
|
808
|
+
"""Model for Social Media Impersonation. Inherits behaviors from `PBA_Generic`."""
|
|
809
|
+
|
|
810
|
+
__doc__ = __doc__ + '\n\n' + PBA_Generic.__doc__ # noqa: A003
|
|
811
|
+
|
|
812
|
+
category: str = PACategory.SOCIAL_MEDIA_IMPERSONATION.value
|
|
813
|
+
|
|
814
|
+
panel_evidence_summary: SocialMediaImpersonationPanelEvidenceSummary | None = Field(
|
|
815
|
+
default_factory=SocialMediaImpersonationPanelEvidenceSummary
|
|
816
|
+
)
|
|
817
|
+
|
|
818
|
+
|
|
785
819
|
class SearchIn(RFBaseModel):
|
|
786
820
|
"""Model for payload sent to `/search` endpoint."""
|
|
787
821
|
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|