search

TheresAFewConors / Sooty

The SOC Analysts all-in-one CLI tool to automate and speed up workflow.
GNU General Public License v3.0
1.34k stars 209 forks source link

Generate Email Template #82

Closed axuxfxa closed 2 years ago

axuxfxa commented 3 years ago

Hello!

What is the Issue you are experiencing? Issue running the "Generate email template based on analysis" feature. When I insert an outlook email file (in .msg format), it shows the following error:

Threshold reached for VirusTotal: 60 seconds remaining... 45 seconds remaining... 30 seconds remaining... 15 seconds remaining... Traceback (most recent call last): File "Sooty.py", line 1076, in emailTemplateGen virusTotalAnalyze(result, sanitizedLink) File "Sooty.py", line 1015, in virusTotalAnalyze linksDict['%s' % sanitizedLink] = str(result['positives']) KeyError: 'positives'

During handling of the above exception, another exception occurred:

Traceback (most recent call last): File "Sooty.py", line 1224, in mainMenu() File "Sooty.py", line 181, in mainMenu switchMenu(input()) File "Sooty.py", line 62, in switchMenu phishingMenu() File "Sooty.py", line 718, in phishingMenu phishingSwitch(input()) File "Sooty.py", line 119, in phishingSwitch emailTemplateGen() File "Sooty.py", line 1088, in emailTemplateGen virusTotalAnalyze(result, sanitizedLink) File "Sooty.py", line 1015, in virusTotalAnalyze linksDict['%s' % sanitizedLink] = str(result['positives']) KeyError: 'positives'

What Operating System are you using? Windows 10, Python 3.8

Additional Information I've tried using multiple outlook emails on this feature but still receive this error. Is there something I'm not doing right? Is an API key required for this feature?

TheresAFewConors commented 3 years ago

Hi @axuxfxa,

The error you are receiving is related to VirusTotal, and does require an API key in order to function correctly. API keys are free for VirusTotal and can be obtained by signing up here.

Ill mark this as a bug though as it shouldn't be throwing an exception and get that resolved. Thanks for raising it!

axuxfxa commented 3 years ago

Ah, thank you! I have all the API keys except HIBP and PhishTank. The VirusTotal key seems to work fine for the Reputation Checker. Strange how it fails for this feature.