fix analyzers and upgrade deps

salt/sensoroni/defaults.yaml

@@ -34,6 +34,8 @@ sensoroni:
         api_version: community
       localfile:
         file_path: []
+      malwarebazaar:
+        api_key:
       otx:
         base_url: https://otx.alienvault.com/api/v1/
         api_key:
@@ -49,12 +51,16 @@ sensoroni:
         live_flow: False
         mailbox_email_address:
         message_source_id:
+      threatfox:
+        api_key:
       urlscan:
         base_url: https://urlscan.io/api/v1/
         api_key:
         enabled: False
         visibility: public
         timeout: 180
+      urlhaus:
+        api_key:
       virustotal:
         base_url: https://www.virustotal.com/api/v3/search?query=
         api_key:

salt/sensoroni/files/analyzers/README.md

@@ -35,15 +35,15 @@ Many analyzers require authentication, via an API key or similar. The table belo
 [EchoTrail](https://www.echotrail.io/docs/quickstart)            |✓|
 [EmailRep](https://emailrep.io/key)                  |✓|
 [Elasticsearch](https://www.elastic.co/guide/en/elasticsearch/reference/7.17/setting-up-authentication.html)            |✓|
-[GreyNoise](https://www.greynoise.io/plans/community)                 |✓|
+[GreyNoise (community)](https://www.greynoise.io/plans/community)                 |✗|
 [LocalFile](https://github.com/Security-Onion-Solutions/securityonion/tree/fix/sublime_analyzer_documentation/salt/sensoroni/files/analyzers/localfile)                 |✗|
 [Malware Hash Registry](https://hash.cymru.com/docs_whois)    |✗|
-[MalwareBazaar](https://bazaar.abuse.ch/)            |✗|
+[MalwareBazaar](https://bazaar.abuse.ch/)            |✓|
 [Pulsedive](https://pulsedive.com/api/)                 |✓|
 [Spamhaus](https://www.spamhaus.org/dbl/)                  |✗|
 [Sublime Platform](https://sublime.security)              |✓| 
-[ThreatFox](https://threatfox.abuse.ch/)            |✗|
-[Urlhaus](https://urlhaus.abuse.ch/)                   |✗|
+[ThreatFox](https://threatfox.abuse.ch/)            |✓|
+[Urlhaus](https://urlhaus.abuse.ch/)                   |✓|
 [Urlscan](https://urlscan.io/docs/api/)                   |✓|
 [VirusTotal](https://developers.virustotal.com/reference/overview)                |✓|
 [WhoisLookup](https://github.com/meeb/whoisit)           |✗|

salt/sensoroni/files/analyzers/greynoise/greynoise.json

@@ -1,6 +1,6 @@
 {
   "name": "Greynoise IP Analyzer",
-  "version": "0.1",
+  "version": "0.2",
   "author": "Security Onion Solutions",
   "description": "This analyzer queries Greynoise for context around an IP address",
   "supportedTypes" :  ["ip"]

salt/sensoroni/files/analyzers/greynoise/greynoise.py

@@ -7,6 +7,10 @@
 
 
 def checkConfigRequirements(conf):
+    # Community API doesn't require API key
+    if conf.get('api_version') == 'community':
+        return True
+    # Other API versions require API key
     if "api_key" not in conf or len(conf['api_key']) == 0:
         sys.exit(126)
     else:
@@ -17,10 +21,12 @@ def sendReq(conf, meta, ip):
     url = conf['base_url']
     if conf['api_version'] == 'community':
         url = url + 'v3/community/' + ip
-    elif conf['api_version'] == 'investigate' or 'automate':
+        # Community API doesn't use API key
+        response = requests.request('GET', url=url)
+    elif conf['api_version'] in ['investigate', 'automate']:
         url = url + 'v2/noise/context/' + ip
-    headers = {"key": conf['api_key']}
-    response = requests.request('GET', url=url, headers=headers)
+        headers = {"key": conf['api_key']}
+        response = requests.request('GET', url=url, headers=headers)
     return response.json()
 
 

salt/sensoroni/files/analyzers/greynoise/greynoise_test.py

@@ -31,13 +31,31 @@ def test_checkConfigRequirements_not_present(self):
             greynoise.checkConfigRequirements(conf)
         self.assertEqual(cm.exception.code, 126)
 
+    def test_checkConfigRequirements_community_no_key(self):
+        conf = {"api_version": "community"}
+        # Should not raise exception for community version
+        result = greynoise.checkConfigRequirements(conf)
+        self.assertTrue(result)
+
+    def test_checkConfigRequirements_investigate_no_key(self):
+        conf = {"api_version": "investigate"}
+        with self.assertRaises(SystemExit) as cm:
+            greynoise.checkConfigRequirements(conf)
+        self.assertEqual(cm.exception.code, 126)
+
+    def test_checkConfigRequirements_investigate_with_key(self):
+        conf = {"api_version": "investigate", "api_key": "test_key"}
+        result = greynoise.checkConfigRequirements(conf)
+        self.assertTrue(result)
+
     def test_sendReq_community(self):
         with patch('requests.request', new=MagicMock(return_value=MagicMock())) as mock:
             meta = {}
-            conf = {"base_url": "https://myurl/", "api_key": "abcd1234", "api_version": "community"}
+            conf = {"base_url": "https://myurl/", "api_version": "community"}
             ip = "192.168.1.1"
             response = greynoise.sendReq(conf=conf, meta=meta, ip=ip)
-            mock.assert_called_once_with("GET", headers={'key': 'abcd1234'}, url="https://myurl/v3/community/192.168.1.1")
+            # Community API should not include headers
+            mock.assert_called_once_with("GET", url="https://myurl/v3/community/192.168.1.1")
             self.assertIsNotNone(response)
 
     def test_sendReq_investigate(self):
@@ -115,3 +133,16 @@ def test_analyze(self):
             results = greynoise.analyze(conf, artifactInput)
             self.assertEqual(results["summary"], "suspicious")
             mock.assert_called_once()
+
+    def test_analyze_community_no_key(self):
+        output = {"ip": "8.8.8.8", "noise": "false", "riot": "true",
+                  "classification": "benign", "name": "Google Public DNS",
+                  "link": "https://viz.gn.io", "last_seen": "2022-04-26",
+                  "message": "Success"}
+        artifactInput = '{"value":"8.8.8.8","artifactType":"ip"}'
+        conf = {"base_url": "myurl/", "api_version": "community"}
+        with patch('greynoise.greynoise.sendReq', new=MagicMock(return_value=output)) as mock:
+            results = greynoise.analyze(conf, artifactInput)
+            self.assertEqual(results["summary"], "harmless")
+            self.assertEqual(results["status"], "ok")
+            mock.assert_called_once()

salt/sensoroni/files/analyzers/malwarebazaar/malwarebazaar.json

@@ -1,6 +1,6 @@
 {
     "name": "Malwarebazaar",
-    "version": "0.1",
+    "version": "0.2",
     "author": "Security Onion Solutions",
     "description": "This analyzer queries Malwarebazaar to see if a hash, gimphash, tlsh, or telfhash is considered malicious.",
     "supportedTypes" :  ["gimphash","hash","tlsh", "telfhash"],