msticpy.context.tiproviders.intsights module
Intsights Provider.
Input can be a single IoC observable or a pandas DataFrame containing multiple observables. Processing may require a an API key and processing performance may be limited to a specific number of requests per minute for the account type that you have.
- class msticpy.context.tiproviders.intsights.IntSights(*, timeout: int | None = None, ApiID: str | None = None, AuthKey: str | None = None, Instance: str | None = None)
Bases:
HttpTIProvider
IntSights Lookup.
Init HttpContextProvider.
- property ioc_query_defs: dict[str, Any]
Return current dictionary of IoC query/request definitions.
- Returns:
IoC query/request definitions keyed by IoCType
- Return type:
dict[str, Any]
- classmethod is_known_type(item_type: str) bool
Return True if this a known IoC Type.
- Parameters:
item_type (str) – IoCType string to test
- Returns:
True if known type.
- Return type:
bool
- is_supported_type(item_type: str | IoCType) bool
Return True if the passed type is supported.
- Parameters:
item_type (Union[str, IoCType]) – type name or instance
- Returns:
True if supported.
- Return type:
bool
- property item_query_defs: dict[str, Any]
Return current dictionary of IoC query/request definitions.
- Returns:
IoC query/request definitions keyed by IoCType
- Return type:
dict[str, Any]
- lookup_ioc(ioc: str, ioc_type: str | None = None, query_type: str | None = None, *, provider_name: str | None = None, timeout: int = 120) pd.DataFrame
Lookup from a value.
- Parameters:
ioc (str) – ioc to lookup
ioc_type (str, optional) – The Type of the ioc to lookup, by default None (type will be inferred)
query_type (str, optional) – Specify the data subtype to be queried, by default None. If not specified the default record type for the ioc will be returned.
provider_name (str, optional) – Name of the provider to query for the lookup
timeout (str, optional) – Timeout for lookup queries
- Returns:
The lookup result: result - Positive/Negative, details - Lookup Details (or status if failure), raw_result - Raw Response reference - URL of the item
- Return type:
pd.DataFrame
- Raises:
NotImplementedError – If attempting to use an HTTP method or authentication protocol that is not supported.
Notes
Note: this method uses memoization (lru_cache) to cache results for a particular item to try avoid repeated network calls for the same item.
- lookup_iocs(data: pd.DataFrame | dict[str, str] | Iterable[str], ioc_col: str | None = None, ioc_type_col: str | None = None, query_type: str | None = None) pd.DataFrame
Lookup collection of IoC observables.
- Parameters:
data (Union[pd.DataFrame, dict[str, str], Iterable[str]]) – Data input in one of three formats: 1. Pandas dataframe (you must supply the column name in ioc_col parameter) 2. Dict of observable, IoCType 3. Iterable of observables - IoCTypes will be inferred
ioc_col (str, optional) – DataFrame column to use for observables, by default None
ioc_type_col (str, optional) – DataFrame column to use for IoCTypes, by default None
query_type (str, optional) – Specify the data subtype to be queried, by default None. If not specified the default record type for the IoC type will be returned.
- Returns:
DataFrame of results.
- Return type:
pd.DataFrame
- async lookup_iocs_async(data: pd.DataFrame | dict[str, str] | Iterable[str], ioc_col: str | None = None, ioc_type_col: str | None = None, query_type: str | None = None) pd.DataFrame
Call base async wrapper.
- lookup_item(item: str, item_type: str | None = None, query_type: str | None = None) pd.DataFrame
Lookup a single item.
- Parameters:
item (str) – Item value to lookup
item_type (str, optional) – The Type of the value to lookup, by default None (type will be inferred)
query_type (str, optional) – Specify the data subtype to be queried, by default None. If not specified the default record type for the item_value will be returned.
- Returns:
The lookup result: result - Positive/Negative, details - Lookup Details (or status if failure), raw_result - Raw Response reference - URL of the item
- Return type:
pd.DataFrame
- Raises:
NotImplementedError – If attempting to use an HTTP method or authentication protocol that is not supported.
Notes
Note: this method uses memoization (lru_cache) to cache results for a particular observable to try avoid repeated network calls for the same item.
- lookup_items(data: pd.DataFrame | dict[str, str] | Iterable[str], item_col: str | None = None, item_type_col: str | None = None, query_type: str | None = None) pd.DataFrame
Lookup collection of items.
- Parameters:
data (Union[pd.DataFrame, dict[str, str], Iterable[str]]) – Data input in one of three formats: 1. Pandas dataframe (you must supply the column name in item_col parameter) 2. Dict of items 3. Iterable of items
item_col (str, optional) – DataFrame column to use for items, by default None
item_type_col (str, optional) – DataFrame column to use for types, by default None
query_type (str, optional) – Specify the data subtype to be queried, by default None. If not specified the default record type for the type will be returned.
- Returns:
DataFrame of results.
- Return type:
pd.DataFrame
- async lookup_items_async(data: pd.DataFrame | dict[str, str] | Iterable[str], item_col: str | None = None, item_type_col: str | None = None, query_type: str | None = None, *, prog_counter: ProgressCounter | None = None, item_type: str | None = None) pd.DataFrame
Lookup collection of items.
- Parameters:
data (Union[pd.DataFrame, dict[str, str], Iterable[str]]) – Data input in one of three formats: 1. Pandas dataframe (you must supply the column name in item_col parameter) 2. Dict of items, Type 3. Iterable of items - Types will be inferred
item_col (str, optional) – DataFrame column to use for items, by default None
item_type_col (str, optional) – DataFrame column to use for Types, by default None
query_type (str, optional) – Specify the data subtype to be queried, by default None. If not specified the default record type for the item will be returned.
prog_counter (ProgressCounter, Optional) – Progress Counter to display progess of IOC searches.
item_type (str, Optional) – Type of item
- Returns:
DataFrame of results.
- Return type:
pd.DataFrame
- property name: str
Return the name of the provider.
- parse_results(response: dict) tuple[bool, ResultSeverity, Any]
Return the details of the response.
- Parameters:
response (Dict) – The returned data response
- Returns:
bool = positive or negative hit ResultSeverity = enumeration of severity Object with match details
- Return type:
Tuple[bool, ResultSeverity, Any]
- static resolve_ioc_type(observable: str) str
Return IoCType determined by IoCExtract.
- Parameters:
observable (str) – IoC observable string
- Returns:
IoC Type (or unknown if type could not be determined)
- Return type:
str
- static resolve_item_type(item: str) str
Return IoCType determined by ItemExtract.
- Parameters:
item (str) – Item string
- Returns:
IoCType (or unknown if type could not be determined)
- Return type:
str
- property supported_types: list[str]
Return list of supported types for this provider.
- Returns:
List of supported type names
- Return type:
list[str]
- classmethod usage() None
Print usage of provider.