New analyzer to check URL categories #24
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Great job! Tested it out this morning and it is great! |
|
This pull request will be merged directly into release/2.9.1 branch |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Go easy on me, this is my first pull request (ever).
This is a very simple analyzer that checks a
domainorurlartifact against Fortinet's website category service. I initially wrote it to also check Bluecoat, but then soon found that Bluecoat started using Captchas after so many queries so I pulled that chunk out.I will add additional services as I can find ones that permit automated query.
I imagine this could be useful for SOCs that utilize a proxy, NGFW or UTM that filters URLs using the databases queried by this analyzer (currently only Fortinet). If an analyst see thats Fortigate classifies the site as
Malicious Websites(example), then no action need be taken assuming the network is defended by a Fortinet firewall and (hopefully) automatically blocking URLs of that category. Analyst Time Saved!On the other hand, if a malicious site is being miscategorized or is otherwise
Not Rated(example), the analyzer report provides a quick link to "Request Recategorization" (see below). Threat intel shared!Small Report Example
Large Report Example