| 1 | import ipaddress |
| 2 | import re |
| 3 | from typing import Any |
| 4 | from typing import Dict |
| 5 | from typing import List |
| 6 | from typing import Optional |
| 7 | from typing import Tuple |
| 8 | |
| 9 | from pydantic import BaseModel |
| 10 | from pydantic import Field |
| 11 | from pydantic import model_validator |
| 12 | |
| 13 | HASH_REGEX = re.compile( |
| 14 | r"[a-fA-F\d]{32}|[a-fA-F\d]{64}", |
| 15 | ) # Update this regex to match your specific hash format |
| 16 | DOMAIN_REGEX = re.compile( |
| 17 | r"^(?:[a-z0-9](?:[a-z0-9\-]{0,61}[a-z0-9])?\.)+[a-z]{2,6}$", |
| 18 | ) # Update this regex to match your specific domain format |
| 19 | |
| 20 | |
| 21 | class AnalyzersResponse(BaseModel): |
| 22 | analyzers: List[str] |
| 23 | message: str |
| 24 | success: bool |
| 25 | |
| 26 | |
| 27 | class RunAnalyzerBody(BaseModel): |
| 28 | analyzer_name: str = Field(..., description="Name of the analyzer to be run.") |
| 29 | analyzer_data: str = Field( |
| 30 | ..., |
| 31 | description="The Indicator of Compromise (IoC) to be analyzed.", |
| 32 | ) |
| 33 | data_type: Optional[str] = Field( |
| 34 | default=None, |
| 35 | description="Data type determined after validation", |
| 36 | ) |
| 37 | |
| 38 | @model_validator(mode="after") |
| 39 | def validate_and_set_data_type(self): |
| 40 | is_valid, data_type = self.is_valid_datatype(self.analyzer_data) |
| 41 | if not is_valid: |
| 42 | raise ValueError(f"Invalid data type: {data_type}") |
| 43 | self.data_type = data_type |
| 44 | return self |
| 45 | |
| 46 | @classmethod |
| 47 | def is_valid_datatype(cls, value: str) -> Tuple[bool, str]: |
| 48 | if cls._is_valid_ipv4(value): |
| 49 | return True, "ip" |
| 50 | elif cls._is_valid_hash(value): |
| 51 | return True, "hash" |
| 52 | elif cls._is_valid_domain(value): |
| 53 | return True, "domain" |
| 54 | else: |
| 55 | return False, "Unknown" |
| 56 | |
| 57 | @staticmethod |
| 58 | def _is_valid_ipv4(value: str) -> bool: |
| 59 | try: |
| 60 | ipaddress.IPv4Address(value) |
| 61 | return True |
| 62 | except ValueError: |
| 63 | return False |
| 64 | |
| 65 | @staticmethod |
| 66 | def _is_valid_hash(value: str) -> bool: |
| 67 | return bool(HASH_REGEX.match(value)) |
| 68 | |
| 69 | @staticmethod |
| 70 | def _is_valid_domain(value: str) -> bool: |
| 71 | return bool(DOMAIN_REGEX.match(value)) |
| 72 | |
| 73 | |
| 74 | class RunAnalyzerResponse(BaseModel): |
| 75 | report: Dict[str, Any] |
| 76 | message: str |
| 77 | success: bool |
| 78 | |
| 79 | |
| 80 | class AnalyzerJobData(BaseModel): |
| 81 | data: str = Field( |
| 82 | ..., |
| 83 | description="The Indicator of Compromise (IoC) to be analyzed.", |
| 84 | ) |
| 85 | dataType: str = Field( |
| 86 | ..., |
| 87 | description="The type of the IoC (e.g., 'IP', 'hash', 'domain').", |
| 88 | ) |
| 89 | tlp: int = Field(1, description="Traffic Light Protocol (TLP) level.") |
| 90 | message: str = Field( |
| 91 | "custom message sent to analyzer", |
| 92 | description="Custom message.", |
| 93 | ) |