search

intelowlproject / IntelOwl

IntelOwl: manage your Threat Intelligence at scale
https://intelowlproject.github.io
GNU Affero General Public License v3.0
3.84k stars 439 forks source link

RIPE API analyzer #56

Closed mlodic closed 2 years ago

mlodic commented 4 years ago

Get WHOIS for a specific IP with the RIPE API:

https://github.com/RIPE-NCC/whois/wiki/WHOIS-REST-API https://www.ripe.net/manage-ips-and-asns/db/support/documentation/ripe-database-query-reference-manual#tables-of-query-types-supported-by-the-ripe-database http://jaluther.blogspot.com/2016/04/python-for-network-engineers-part-2.html

0x0elliot commented 3 years ago

can you assign this issue to me? i can work on this but i am not sure what is to be done with the fetched WHOIS after it is fetched. kindly elaborate :>

CITIZENDOT commented 3 years ago

Hey another Mr.Robot fan, Take a look here, on how to add new analyzer. You can see some analyzers as an example. Basically, After quering and getting the data, you have to return it from run() function inside the Analyzer class. Everything else is taken care by the classes.

0x0elliot commented 3 years ago

nice! when i have time i will try contributing to it. thanks for pointing me in the right direction :D

0x0elliot commented 3 years ago

i am still a little confused as to how i can accept the IP address as the parameter to use. any guidance?

CITIZENDOT commented 3 years ago

IP address and type of the observable (whether it is IP/domain/URL) is passed as self.observable_name and self.observable_classification respectively.

0x0elliot commented 3 years ago

currently i am having a problem where the results are not showing up at /pages/scan/result/1 for my addition specifically. it isn't even in the list.

mlodic commented 3 years ago

If you like you can join the Honeynet Slack channel where you can have a faster chat than here if you require some technical help during development.

0x0elliot commented 3 years ago

thanks! i have it joined. i will communicate there when i can ^^