cortexbot

README

Cortex bot

Simple telegram bot to check indicators' reputation based on Cortex analyzers that can be easily written for any third party feeds or your own API service.

It simply uses a password for authentication, which is probably will be changed in the future prior to a role based model.

Usage

Start bot from the source code (you can use compiled version too):

CORTEX_BOT_PASSWORD=PassphraseForAuth \
CORTEX_URL=https://your-cortex-instance \
CORTEX_API_KEY=YOUR-API-KEY \
TGBOT_API_TOKEN=TOKEN \
go run cmd/cortexbot/cortexbot.go

Work through SOCKS5 proxy

SOCKS5_URL=socks5://user:password@server:port \
CORTEX_BOT_PASSWORD=PassphraseForAuth \
CORTEX_URL=https://your-cortex-instance \
CORTEX_API_KEY=YOUR-API-KEY \
TGBOT_API_TOKEN=TOKEN \
go run cmd/cortexbot/cortexbot.go

Add bot to your contacts, enter the passphrase and here you go - submit data and wait for results.

Supported data types

By now the following data types are supported for lookup:

• Domain
• Hash
• IP
• URL
• File
• Email

PRs are welcome!

Documentation

Index

• func Debug() func(*Cortexbot) error
• func IsDNSName(str string) bool
• func IsHash(str string) bool
• func SetCortex(client *cortex.Client) func(*Cortexbot) error
• func SetCortexTimeout(t time.Duration) func(*Cortexbot) error
• func SetDBPath(n string) func(*Cortexbot) error
• func SetPAP(pap cortex.PAP) func(*Cortexbot) error
• func SetTLP(tlp cortex.TLP) func(*Cortexbot) error
• func SetupChatbot(token string, client *http.Client) func(*Cortexbot) error
• type Client
  • func NewClient() *Client
• type Cortexbot
  • func New(opts ...func(*Cortexbot) error) (*Cortexbot, error)
  • func NewFromEnv() (*Cortexbot, error)
  • func (c *Cortexbot) Auth(input *tgbotapi.Message) error
  • func (c *Cortexbot) CheckAdmin(u *tgbotapi.User) bool
  • func (c *Cortexbot) CheckAuth(u *tgbotapi.User) bool
  • func (c *Cortexbot) Run(ctx context.Context) error
• type User
• Bugs

Functions

func Debug

func Debug() func(*Cortexbot) error

Debug sets debug mode for the Cortexbot.

func IsDNSName

func IsDNSName(str string) bool

IsDNSName is a modified version of function IsDNSName from https://github.com/asaskevich/govalidator/blob/master/patterns.go

func IsHash

func IsHash(str string) bool

IsHash checks if a given string is a hash BUG(ilyaglow): not supported hashes are hashes shorter 32 letters and ssdeep

func SetCortex

func SetCortex(client *cortex.Client) func(*Cortexbot) error

SetCortex sets a cortex.Client.

func SetCortexTimeout

func SetCortexTimeout(t time.Duration) func(*Cortexbot) error

SetCortexTimeout will set the timeout that the client will wait for a response from Cortex at most.

func SetDBPath

func SetDBPath(n string) func(*Cortexbot) error

SetDBPath sets a sqlitedb path.

func SetPAP

func SetPAP(pap cortex.PAP) func(*Cortexbot) error

SetPAP sets PAP as an option.

func SetTLP

func SetTLP(tlp cortex.TLP) func(*Cortexbot) error

SetTLP sets TLP as an option.

func SetupChatbot

func SetupChatbot(token string, client *http.Client) func(*Cortexbot) error

SetupChatbot constructs a client to the messenger.

Types

type Client

type Client Cortexbot

Client defines bot's abilities to interact with services. Deprecated: use Cortexbot instead.

func NewClient

func NewClient() *Client

NewClient bootstraps the Client struct from env variables. Deprecated: Use NewFromEnv, or New method instead.

type Cortexbot

type Cortexbot struct {
	Bot      *tgbotapi.BotAPI
	Cortex   *cortex.Client
	Password string
	DB       *sql.DB

	TLP     cortex.TLP
	PAP     cortex.PAP
	Timeout time.Duration
	Debug   bool
	// contains filtered or unexported fields
}

Cortexbot defines bot's abilities to interact with services.

func New

func New(opts ...func(*Cortexbot) error) (*Cortexbot, error)

New bootstraps cortexbot configuration.

func NewFromEnv

func NewFromEnv() (*Cortexbot, error)

NewFromEnv bootstraps Cortexbot from environment variables.

func (*Cortexbot) Auth

func (c *Cortexbot) Auth(input *tgbotapi.Message) error

Auth handles simple password authentication of a user

func (*Cortexbot) CheckAdmin

func (c *Cortexbot) CheckAdmin(u *tgbotapi.User) bool

CheckAdmin checks if user is an admin.

func (*Cortexbot) CheckAuth

func (c *Cortexbot) CheckAuth(u *tgbotapi.User) bool

CheckAuth checks if user is allowed to interact with a bot.

func (*Cortexbot) Run

func (c *Cortexbot) Run(ctx context.Context) error

Run represents infinite function that waits for a message, authenticate user and process task

type User

type User struct {
	ID    int
	Admin int // sqlite doesn't have bool
	About string
}

User represents a user of the bot.

Notes

Bugs

• not supported hashes are hashes shorter 32 letters and ssdeep