From deb9b0e5ef93c677f56c2f385d223e75d9226e2f Mon Sep 17 00:00:00 2001
From: Jason Ertel <jason.ertel@securityonionsolutions.com>
Date: Mon, 28 Mar 2022 15:53:24 -0400
Subject: [PATCH] Add analyze feature

---
 salt/sensoroni/files/analyzers/virustotal.py   |   5 +++++
 .../files/analyzers/whois/__init__.py          |   0
 .../files/analyzers/whois/__init__.pyc         | Bin 0 -> 172 bytes
 salt/sensoroni/files/analyzers/whois/whois.py  |   5 +++++
 salt/sensoroni/files/sensoroni.json            |   6 ++++++
 salt/sensoroni/init.sls                        |  17 +++++++++++++++++
 salt/soc/files/soc/soc.json                    |   1 +
 7 files changed, 34 insertions(+)
 create mode 100644 salt/sensoroni/files/analyzers/virustotal.py
 create mode 100644 salt/sensoroni/files/analyzers/whois/__init__.py
 create mode 100644 salt/sensoroni/files/analyzers/whois/__init__.pyc
 create mode 100644 salt/sensoroni/files/analyzers/whois/whois.py

diff --git a/salt/sensoroni/files/analyzers/virustotal.py b/salt/sensoroni/files/analyzers/virustotal.py
new file mode 100644
index 000000000..622d6f72d
--- /dev/null
+++ b/salt/sensoroni/files/analyzers/virustotal.py
@@ -0,0 +1,5 @@
+def main():
+	print '{"foo":"bar","summary":"something here"}'
+
+if __name__ == "__main__":
+	main()
\ No newline at end of file
diff --git a/salt/sensoroni/files/analyzers/whois/__init__.py b/salt/sensoroni/files/analyzers/whois/__init__.py
new file mode 100644
index 000000000..e69de29bb
diff --git a/salt/sensoroni/files/analyzers/whois/__init__.pyc b/salt/sensoroni/files/analyzers/whois/__init__.pyc
new file mode 100644
index 0000000000000000000000000000000000000000..bf102819a54f45fa9e79666db49ebd9b09296104
GIT binary patch
literal 172
zcmZ9FK?=e^3`M8tLIm&8mD!7kCva1`9>!_JlyOofDKZ||3wQxjaAn}Xz=PzkKD+I^
zIb5UrO=J6Pk+orPu4@-_X$|fV(wl=`un3G;6cbE^M~o^U80SJ-ITL4)kknKbE+*hc
j2?at9slJxu=bcHwd&;EV@29F8`+R)xFef}M{c3SvQI{*1

literal 0
HcmV?d00001

diff --git a/salt/sensoroni/files/analyzers/whois/whois.py b/salt/sensoroni/files/analyzers/whois/whois.py
new file mode 100644
index 000000000..0ecb925bc
--- /dev/null
+++ b/salt/sensoroni/files/analyzers/whois/whois.py
@@ -0,0 +1,5 @@
+def main():
+	print '{"result":{ "requestId": "something-generated-by-whois", "someother_field": "more data" }, "summary": "botsrv.btc-goblin.ru"}'
+
+if __name__ == "__main__":
+	main()
\ No newline at end of file
diff --git a/salt/sensoroni/files/sensoroni.json b/salt/sensoroni/files/sensoroni.json
index 743021a7d..53b3122a7 100644
--- a/salt/sensoroni/files/sensoroni.json
+++ b/salt/sensoroni/files/sensoroni.json
@@ -2,6 +2,8 @@
 {%- set DESCRIPTION = salt['pillar.get']('sensoroni:node_description', '') %}
 {%- set MODEL = salt['grains.get']('sosmodel', '') %}
 {%- set ADDRESS = salt['pillar.get']('sensoroni:node_address') %}
+{%- set ANALYZE_TIMEOUT_MS = salt['pillar.get']('sensoroni:analyze_timeout_ms', 900000) %}
+{%- set ANALYZE_PARALLEL_LIMIT = salt['pillar.get']('sensoroni:analyze_parallel_limit', 5) %}
 {%- set SENSORONIKEY = salt['pillar.get']('global:sensoronikey', '') %}
 {%- set CHECKININTERVALMS = salt['pillar.get']('sensoroni:node_checkin_interval_ms', 10000) %}
 {%- set ROLE = grains.id.split('_') | last %}
@@ -24,6 +26,10 @@
     "serverUrl": "https://{{ URLBASE }}/sensoroniagents",
     "verifyCert": false,
     "modules": {
+      "analyze": {
+        "timeoutMs": {{ ANALYZE_TIMEOUT_MS }},
+        "parallelLimit": {{ ANALYZE_PARALLEL_LIMIT }},
+      },
       "importer": {},
       "statickeyauth": {
         "apiKey": "{{ SENSORONIKEY }}"
diff --git a/salt/sensoroni/init.sls b/salt/sensoroni/init.sls
index 1405c72bf..2622e065c 100644
--- a/salt/sensoroni/init.sls
+++ b/salt/sensoroni/init.sls
@@ -18,6 +18,13 @@ sensoroniagentconf:
     - mode: 600
     - template: jinja
 
+analyzersdir:
+  file.directory:
+    - name: /opt/so/conf/soc/analyzers
+    - user: 939
+    - group: 939
+    - makedirs: True
+
 sensoronilog:
   file.directory:
     - name: /opt/so/log/sensoroni
@@ -25,6 +32,15 @@ sensoronilog:
     - group: 939
     - makedirs: True
 
+analyzerscripts:
+  file.recurse:
+    - name: /opt/so/conf/soc/analyzers
+    - user: 939
+    - group: 939
+    - file_mode: 755
+    - template: jinja
+    - source: salt://sensoroni/files/analyzers
+
 so-sensoroni:
   docker_container.running:
     - image: {{ MANAGER }}:5000/{{ IMAGEREPO }}/so-soc:{{ VERSION }}
@@ -35,6 +51,7 @@ so-sensoroni:
       - /nsm/import:/nsm/import:rw
       - /nsm/pcapout:/nsm/pcapout:rw
       - /opt/so/conf/sensoroni/sensoroni.json:/opt/sensoroni/sensoroni.json:ro
+      - /opt/so/conf/sensoroni/analyzers:/opt/sensoroni/analyzers:ro
       - /opt/so/log/sensoroni:/opt/sensoroni/logs:rw
     - watch:
       - file: /opt/so/conf/sensoroni/sensoroni.json
diff --git a/salt/soc/files/soc/soc.json b/salt/soc/files/soc/soc.json
index 9b034ad57..7f08b79ba 100644
--- a/salt/soc/files/soc/soc.json
+++ b/salt/soc/files/soc/soc.json
@@ -217,6 +217,7 @@
       "case": {
         "mostRecentlyUsedLimit": 5,
         "renderAbbreviatedCount": 30,
+        "analyzerNodeId": "{{ grains.host | lower }}",
         "presets": {
           "artifactType": {{ presets_artifacttype | json }},
           "category": {{ presets_category | json }},