AlienVault OTX Analyzer

[ecapuano]

Slightly more involved analyzer to query AlienVault OTX for related Pulses as well as indicator enrichment.

Can analyze ip, domain, url, and file/hash. Adds a short report that reveals how many related Pulses exist for the observable.

I feel like I might've overcomplicated in Python, but it's best I could do. If anyone has any pointers or improvements, please let me know. I am certain the reports could be done better, but the relevant info is displayed when present.

A free OTX API key will need to be added to application.conf

analyzer {
  # Directory that holds analyzers
  path = analyzers
  # Analyzer configuration
  config {
    OTXQuery {
	key="<api key>"
    }
  }
}

Sample short reports...

An observable with one or more matching OTX Pulses

And with no matching Pulses

Some sample long reports...

A file/hash query that matched an existing OTX Pulse

A URL query that returned other related URLs

A file/hash query with no Pulses, but analysis info

A domain query that returned passive DNS records

Basic error handling