IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

fetching virus total through api using network shell command for multiple values

  • 1.  fetching virus total through api using network shell command for multiple values

    Posted Mon May 05, 2025 09:21 AM

    IT IS coded given in server 

    import requests
    import base64
    import json
    import sys

    API_KEY = '690d0f852f6a8761f6eed2e86aea1b0bdd4037dc600ecf49968d4bdfb925d4ca'
    BASE_URL = 'https://www.virustotal.com/api/v3/'

    def get_virus_total_results(input_type, values):
        if input_type == 'ip':
            return fetch_virus_total_data('ip_addresses', values)
        elif input_type == 'url':
            url_ids = []
            for i in values:
                url_id = base64.urlsafe_b64encode(i.encode()).decode().strip("=")
                url_ids.append(url_id)
            return fetch_virus_total_data('urls', url_ids)
        elif input_type == 'domain':
            return fetch_virus_total_data('domains', values)
        elif input_type in ['file', 'sha256', 'md5', 'sha1']:
            return fetch_virus_total_data('files', values)
        else:
            return f"Unsupported input type: {input_type}"

    def fetch_virus_total_data(item_type, values):
        headers = {
            'accept':'application/json',
            'x-apikey': API_KEY
        }

        results = {}
        for value in values:
            url = f"{BASE_URL}{item_type}/{value}"
            response = requests.get(url, headers=headers)

            if response.status_code == 200:
                results[value] = response.json()
            else:
                results[value] = f"Error: {response.status_code}"

        return results

    def process_input(input_data):
        all_results = {}

        # Loop dynamically for whatever is present
        for input_type, values in input_data.items():
            if not values:
                continue

            if isinstance(values, str):
                values = [values]
            elif isinstance(values, list):
                pass
            else:
                print(f"Unsupported value type for {input_type}")
                continue

            results = get_virus_total_results(input_type, values)
            all_results[input_type] = results

        return all_results

    if __name__ == "__main__":
        if len(sys.argv) < 2:
            print("usage:Virustotal.py '<json-input>'")
            sys.exit(1)

        try:
            input_data = json.loads(sys.argv[1])
        except json.JSONDecodeError as e:
            print(f"Invalid JSON input: {e}")
            sys.exit(1)

        all_results = process_input(input_data)

        print(json.dumps(all_results, indent=4))

    input commands through nework utilis
    note:[virus_total fetch= python3 /opt/virus_total.py "{{network_utilities_remote_computer}}"

    import json
    inputs.network_utilities_shell_command="virus_total_fetch"

    inputs.network_utilities_remote_computer="remote_computer"

    type1="ip"
    value1=["10.1.1.13","172.1.1.23"]

    if value1=='None':
      inputs.network_utilities_shell_params='{"'+type1+'": "'+value1+'"}'

    else:
      inputs.network_utilities_shell_params=json.dumps({type1: value1})

    i am getting error like this

    {'version': 2.0, 'success': True, 'reason': None, 'content': {'commandline': "python3 /opt/virus_total.py ''", 'start': 1745939042682, 'end': 1745939043089, 'elapsed': 406, 'exitcode': 1, 'stdout': 'Invalid JSON input: Expecting value: line 1 column 1 (char 0)\n', 'stderr': '', 'stdout_json': None, 'stderr_json': None}, 'raw': None, 'inputs': {'network_utilities_remote_computer': 'remote_computer', 'network_utilities_shell_command': 'virus_total_fetch', 'network_utilities_shell_params': '{"ip": ["10.1.1.13", "172.1.1.23"]}'}, 'metrics': {'version': '1.0', 'package': 'fn-network-utilities', 'package_version': '1.2.0', 'host': 'bb8591ce-5a6e-4326-9c5a-75c23315e591-84cc9c86d4-zc65j', 'execution_time_ms': 408, 'timestamp': '2025-04-29 15:04:03'}}



    CAN ANY ONE HELP ME WITH THIS ERROR  AND TELL ME THE CORRECTION AND WHERE CORRECT TO AVPOID THE ERROR
    I AM FRESHER  TO THIS



    ------------------------------
    Sai Kumar Reddy Dhubbaka
    ------------------------------