threatfox

Documentation

Overview

Package threatfox provides convenience methods to access the threatfox.abuse.ch API

Index

• type IOC
• type IOCDetail
• type IOCType
• type IOCs
• type ThreatFox
  • func New() *ThreatFox
  • func (t *ThreatFox) GetIOCByID(id string) (IOCDetail, error)
  • func (t *ThreatFox) GetIOCTypes() ([]IOCType, error)
  • func (t *ThreatFox) GetIOCs(days int) ([]IOC, error)
  • func (t *ThreatFox) IsValidIOCType(iocType string) (bool, error)
  • func (t *ThreatFox) SearchIOC(term string) ([]IOC, error)
• type TimeSeen
  • func (s TimeSeen) MarshalJSON() ([]byte, error)
  • func (s *TimeSeen) UnmarshalJSON(b []byte) error

Types

type IOC

type IOC struct {
	ConfidenceLevel int `json:"confidence_level"`
	// FirstSeen       string   `json:"first_seen"`
	FirstSeen        TimeSeen `json:"first_seen"`
	ID               string   `json:"id"`
	Ioc              string   `json:"ioc"`
	IocType          string   `json:"ioc_type"`
	IocTypeDesc      string   `json:"ioc_type_desc"`
	LastSeen         *string  `json:"last_seen"`
	Malware          string   `json:"malware"`
	MalwareAlias     *string  `json:"malware_alias"`
	MalwareMalpedia  string   `json:"malware_malpedia"`
	MalwarePrintable string   `json:"malware_printable"`
	Reference        *string  `json:"reference"`
	Reporter         string   `json:"reporter"`
	Tags             []string `json:"tags"`
	ThreatType       string   `json:"threat_type"`
	ThreatTypeDesc   string   `json:"threat_type_desc"`
}

IOC indicator of compromise details returned by 'query' API call

type IOCDetail

type IOCDetail struct {
	Comment         *string `json:"comment"`
	ConfidenceLevel int     `json:"confidence_level"`
	Credits         []struct {
		CreditsAmount any    `json:"credits_amount"`
		CreditsFrom   string `json:"credits_from"`
	} `json:"credits"`
	FirstSeen        TimeSeen `json:"first_seen"`
	ID               string   `json:"id"`
	Ioc              string   `json:"ioc"`
	IocType          string   `json:"ioc_type"`
	IocTypeDesc      string   `json:"ioc_type_desc"`
	LastSeen         *string  `json:"last_seen"`
	Malware          string   `json:"malware"`
	MalwareAlias     *string  `json:"malware_alias"`
	MalwareMalpedia  string   `json:"malware_malpedia"`
	MalwarePrintable string   `json:"malware_printable"`
	MalwareSamples   []struct {
		MalwareBazaar string `json:"malware_bazaar"`
		Md5Hash       string `json:"md5_hash"`
		Sha256Hash    string `json:"sha256_hash"`
		TimeStamp     string `json:"time_stamp"`
	} `json:"malware_samples"`
	Reference      *string  `json:"reference"`
	Reporter       string   `json:"reporter"`
	Tags           []string `json:"tags"`
	ThreatType     string   `json:"threat_type"`
	ThreatTypeDesc string   `json:"threat_type_desc"`
}

type IOCType

type IOCType struct {
	Description  string `json:"description"`
	FKThreatType string `json:"fk_threat_type"`
	Type         string `json:"ioc_type"`
}

type IOCs

type IOCs struct {
	Data        []IOC  `json:"data"`
	QueryStatus string `json:"query_status"`
}

type ThreatFox

type ThreatFox struct {
	// contains filtered or unexported fields
}

func New

func New() *ThreatFox

func (*ThreatFox) GetIOCByID

func (t *ThreatFox) GetIOCByID(id string) (IOCDetail, error)

GetIOCByID queries ThreatFox for a particular IOC id sending an HTTP POST request to the Threatfox API

func (*ThreatFox) GetIOCTypes

func (t *ThreatFox) GetIOCTypes() ([]IOCType, error)

GetIOCTypes obtains a list of supported IOC / threat types from ThreatFox

func (*ThreatFox) GetIOCs

func (t *ThreatFox) GetIOCs(days int) ([]IOC, error)

GetIOCs return a copy of the current IOC dataset from ThreatFox by sending an HTTP POST request to the Threatfox API

func (*ThreatFox) IsValidIOCType

func (t *ThreatFox) IsValidIOCType(iocType string) (bool, error)

func (*ThreatFox) SearchIOC

func (t *ThreatFox) SearchIOC(term string) ([]IOC, error)

SearchIOC searches IOC for the given term

type TimeSeen

type TimeSeen time.Time

TimeSeen provides a JSON type for the fields LastSeen and FirstSeen

func (TimeSeen) MarshalJSON

func (s TimeSeen) MarshalJSON() ([]byte, error)

func (*TimeSeen) UnmarshalJSON

func (s *TimeSeen) UnmarshalJSON(b []byte) error