lib/tasks/threat/search_blcheck_list.rb
def check_blcheck inves, dns_obj, blacklists
    # Reverse the IP to match the Dbl rules for checks
    revip = inves.to_s.split(/\./).reverse.join(".")
    i = 1
    f = []
    # Perform nslookup vs every bl in the list
    blacklists.each do |data|
      #puts data["dnsbl"]
      query = revip +"."+ data["dnsbl"]
      f = dns_obj.getaddresses(query)
      _log "#{i}/ 122  checks vs #{data["dnsbl"]} ... "
      # Get the source of the blocker

      # Getting multiple addresses results from the nslookup
      f.each do |j|
        # Investigate if the response is similar to 127.0.0. # for confirming the listing
        if j.to_s.include? "127."
          # Create an issue if the IP is blacklisted
          if data["query"] == true
            source = "#{data["reference"]}#{inves}"
          else
            source = data["reference"]
          end
            #_log "creating issue ... #{source}"

          _create_linked_issue("suspicious_activity_detected", {
            status: "confirmed",
            description: "Suspicious activity was detcted on this entity.",
            proof: "This IP was found in the #{data["dnsbl"]} list",
            source: source,
            confidence: data["confidence"]
          })
          # Also store it on the entity
          blocked_list = @entity.get_detail("suspicious_activity_detected") || []
          @entity.set_detail("suspicious_activity_detected", blocked_list.concat([{source: source}]))
        end
      end
      i += 1
    end
  end
# Check the BlackLists database for suspicious or malicious IP addresses or domains
Check the BlackLists database for suspicious or malicious IP addresses or domains
Check the BlackLists database for suspicious or malicious IP addresses or domains
def check_blcheck inves, dns_obj, blacklists
    revip = inves.to_s.split(/\./).reverse.join(".")
    i = 1
    f = []
    blacklists.each do |data|
      query = revip +"."+ data["dnsbl"]
      f = dns_obj.getaddresses(query)
      _log "#{i}/ 122  checks vs #{data["dnsbl"]} ... "
      f.each do |j|
        if j.to_s.include? "127."
          if data["query"] == true
            source = "#{data["reference"]}#{inves}"
          else
            source = data["reference"]
          end
          _create_linked_issue("suspicious_activity_detected", {
            status: "confirmed",
            description: "Suspicious activity was detcted on this entity.",
            proof: "This IP was found in the #{data["dnsbl"]} list",
            source: source,
            confidence: data["confidence"]
          })
          blocked_list = @entity.get_detail("suspicious_activity_detected") || []
          @entity.set_detail("suspicious_activity_detected", blocked_list.concat([{source: source}]))
        end
      end
      i += 1
    end
  end
def check_blcheck inves , dns_obj , blacklists revip = inves . to_s . split ( / \. / ) . reverse . join ( "." ) i = 1 f = [ ] blacklists . each do | data | query = revip + "." + data [ "dnsbl" ] f = dns_obj . getaddresses ( query ) _log "#{i}/ 122  checks vs #{data["dnsbl"]} ... " f . each do | j | if j . to_s . include? "127." if data [ "query" ] == true source = "#{data["reference"]}#{inves}" else source = data [ "reference" ] end _create_linked_issue ( "suspicious_activity_detected" , { status : "confirmed" , description : "Suspicious activity was detcted on this entity." , proof : "This IP was found in the #{data["dnsbl"]} list" , source : source , confidence : data [ "confidence" ] } ) blocked_list = @entity . get_detail ( "suspicious_activity_detected" ) || [ ] @entity . set_detail ( "suspicious_activity_detected" , blocked_list . concat ( [ { source : source } ] ) ) end end i += 1 end end
Check the BlackLists database for suspicious or malicious IP addresses or domains
Check the BlackLists database for suspicious or malicious IP addresses or domains
# Reverse the IP to match the Dbl rules for checks # Perform nslookup vs every bl in the list #puts data["dnsbl"] # Get the source of the blocker # Getting multiple addresses results from the nslookup # Investigate if the response is similar to 127.0.0. # for confirming the listing # Create an issue if the IP is blacklisted #_log "creating issue ... #{source}" # Also store it on the entity
inves
dns_obj
blacklists