GreedyBear Ingestor (Closes #2355)

api_app/ingestors_manager/ingestors/greedybear.py

@@ -0,0 +1,90 @@
+import logging
+from typing import Any, Iterable
+from unittest.mock import patch
+
+import requests
+
+from api_app.ingestors_manager.classes import Ingestor
+from api_app.ingestors_manager.exceptions import IngestorRunException
+from tests.mock_utils import MockUpResponse, if_mock_connections
+
+logger = logging.getLogger(__name__)
+
+
+class GreedyBear(Ingestor):
+
+    url: str
+    feed_type: str
+    attack_type: str
+    age: str
+
+    VALID_FEED_TYPES = {"log4j", "cowrie", "all"}
+    VALID_ATTACK_TYPES = {"scanner", "payload_request", "all"}
+    VALID_AGE = {"recent", "persistent"}
+
+    @classmethod
+    def update(cls) -> bool:
+        pass
+
+    def run(self) -> Iterable[Any]:
+        if self.feed_type not in self.VALID_FEED_TYPES:
+            raise ValueError(
+                f"Invalid feed_type: {self.feed_type}. Must be one of {self.VALID_FEED_TYPES}"
+            )
+        if self.attack_type not in self.VALID_ATTACK_TYPES:
+            raise ValueError(
+                f"Invalid attack_type: {self.attack_type}. Must be one of {self.VALID_ATTACK_TYPES}"
+            )
+        if self.age not in self.VALID_AGE:
+            raise ValueError(
+                f"Invalid age: {self.age}. Must be one of {self.VALID_AGE}"
+            )
+
+        self.url = f"https://greedybear.honeynet.org/api/feeds/{self.feed_type}/{self.attack_type}/{self.age}.json"
+
+        result = requests.get(self.url)
+        result.raise_for_status()
+        content = result.json()
+        if not isinstance(content.get("iocs"), list):
+            raise IngestorRunException(f"Content {content} not expected")
+
+        limit = min(len(content["iocs"]), self.limit)
+        for elem in content["iocs"][:limit]:
+            yield elem["value"]
+
+    @classmethod
+    def _monkeypatch(cls):
+        patches = [
+            if_mock_connections(
+                patch(
+                    "requests.get",
+                    return_value=MockUpResponse(
+                        {
+                            "license": "https://github.com/honeynet/GreedyBear/blob/main/FEEDS_LICENSE.md",
+                            "iocs": [
+                                {
+                                    "feed_type": "suricata",
+                                    "value": "91.205.219.185",
+                                    "scanner": True,
+                                    "payload_request": False,
+                                    "first_seen": "2024-05-29",
+                                    "last_seen": "2025-02-01",
+                                    "times_seen": 6437,
+                                },
+                                {
+                                    "feed_type": "suricata",
+                                    "value": "88.210.32.15",
+                                    "scanner": True,
+                                    "payload_request": False,
+                                    "first_seen": "2024-07-30",
+                                    "last_seen": "2025-02-01",
+                                    "times_seen": 61,
+                                },
+                            ],
+                        },
+                        200,
+                    ),
+                ),
+            )
+        ]
+        return super()._monkeypatch(patches=patches)