Add observables

Dockerfile

@@ -0,0 +1,10 @@
+FROM python:3
+
+WORKDIR /app
+
+COPY requirements.txt ./
+RUN pip install --no-cache-dir -r requirements.txt
+
+COPY imap2thehive.py ./imap2thehive.py
+
+CMD [ "python", "imap2thehive.py" ]

Dockerfile.CI

@@ -0,0 +1,10 @@
+FROM python:3
+
+WORKDIR /app
+
+COPY git_src/requirements.txt /app/requirements.txt
+COPY git_src/imap2thehive.py /app/imap2thehive.py
+
+RUN pip install --no-cache-dir -r /app/requirements.txt
+
+CMD [ "python", "imap2thehive.py" ]

README.md

@@ -1,2 +1,20 @@
-Miscelaneous Docker files for my personal usage.
-Feel free to contribute.
+# imap2thehive
+
+imap2thehive image with analyzers installed
+
+image built around: https://github.com/xme/dockers/tree/master/imap2thehive
+
+Image name: `pipedrive/imap2thehive`
+
+# Description
+This image is a K8 ready version of imap2thehive. The Python script included in the image diviates slightly from the original version of XME.
+
+
+# Live deployment
+1. [Deploy via Jenkins][1]
+2. After deploying, fetch the new tag that was pushed to Docker Hub. This is listed in the console output of the Jenkins job.
+3. Update the tag in the K8 manifests in [chef-repo][2] and in [the-hive-kube][3]
+
+[1]: https://jenkins.pipedrive.tools/job/baseimage-imap2thehive-docker/
+[2]: https://github.com/pipedrive/chef-repo
+[3]: https://github.com/pipedrive/the-hive-kube

imap2thehive/imap2thehive.py → imap2thehive.py

@@ -44,7 +44,7 @@
 
 __author__     = "Xavier Mertens"
 __license__    = "GPLv3"
-__version__    = "1.0.7"
+__version__    = "1.0.8"
 __maintainer__ = "Xavier Mertens"
 __email__      = "xavier@rootshell.be"
 __name__       = "imap2thehive"
@@ -138,7 +138,8 @@ def searchObservables(buffer, observables):
          { 'type': 'mail',   'regex': r'\b([a-z][_a-z0-9-.+]+@[a-z0-9-.]+\.[a-z]+)\b' },
          { 'type': 'hash',   'regex': r'\b([a-f0-9]{32}|[A-F0-9]{32})\b' },
          { 'type': 'hash',   'regex': r'\b([a-f0-9]{40}|[A-F0-9]{40})\b' },
-         { 'type': 'hash',   'regex': r'\b([a-f0-9]{64}|[A-F0-9]{64})\b' }
+         { 'type': 'hash',   'regex': r'\b([a-f0-9]{64}|[A-F0-9]{64})\b' },
+         { 'type': 'headers',    'regex': r'\b(([A-Za-z-]+):\s([^\r\n]+(?:\r?\n(?![A-Za-z-]+:\s)[^\r\n]+)*))\b'}
          ]
 
     # Add custom observables if any
@@ -216,8 +217,8 @@ def submitTheHive(message):
     while  i < len(headers.keys()):
         headers_string = headers_string + headers.keys()[i] + ': ' + headers.values()[i] + '\n'
         i+=1
-    # Temporary disabled
-    # observables = searchObservables(headers_string, observables)
+    # Testing email headers.
+    observables.extend(searchObservables(headers_string, observables))
 
     body = ''
     for part in msg.walk():
@@ -545,5 +546,10 @@ def main():
     return
 
 if __name__ == 'imap2thehive':
-    main()
-    sys.exit(0)
+    log = logging.getLogger(__name__)
+
+    while True:
+        log.info('Running main loop')
+        main()
+        log.info('Finished main loop, sleeping')
+        time.sleep(120)

pipeline.yml

@@ -0,0 +1,4 @@
+version: "2.0.0"
+params:
+  platform:
+    name: "docker"

repository.json

@@ -0,0 +1,8 @@
+{
+	"name": "imap2thehive",
+	"description": "CronJob to sync our AlienVault email box with TheHive",
+	"owner": "Polaris",
+	"type": "tool",
+	"status": "unreleased",
+	"region-type": null
+}

imap2thehive/requirements.txt → requirements.txt

@@ -7,3 +7,4 @@ requests
 uuid
 python-magic
 thehive4py
+chardet