| 1 | import httpx |
| 2 | from fastapi import HTTPException |
| 3 | from loguru import logger |
| 4 | |
| 5 | from app.threat_intel.schema.epss import EpssData |
| 6 | from app.threat_intel.schema.epss import EpssThreatIntelRequest |
| 7 | from app.threat_intel.schema.epss import EpssThreatIntelResponse |
| 8 | |
| 9 | |
| 10 | async def invoke_epss_api( |
| 11 | url: str, |
| 12 | request: EpssThreatIntelRequest, |
| 13 | ) -> dict: |
| 14 | """ |
| 15 | Invokes the Socfortress Process Analysis API with the provided API key, URL, and request parameters. |
| 16 | |
| 17 | Args: |
| 18 | api_key (str): The API key for authentication. |
| 19 | url (str): The URL of the Socfortress Intel URL |
| 20 | request (SocfortressProcessNameAnalysisRequest): The request object containing the Process Name |
| 21 | |
| 22 | Returns: |
| 23 | dict: The JSON response from the Process Name Analysis API. |
| 24 | |
| 25 | Raises: |
| 26 | httpx.HTTPStatusError: If the API request fails with a non-successful status code. |
| 27 | """ |
| 28 | headers = {"content-type": "application/json"} |
| 29 | params = {"cve": f"{request.cve}"} |
| 30 | logger.info(f"Invoking EPSS with params: {params} and headers: {headers} and url: {url}") |
| 31 | async with httpx.AsyncClient() as client: |
| 32 | response = await client.get(url, headers=headers, params=params) |
| 33 | return response.json() |
| 34 | |
| 35 | |
| 36 | async def collect_epss_score( |
| 37 | request: EpssThreatIntelRequest, |
| 38 | ) -> EpssThreatIntelResponse: |
| 39 | """ |
| 40 | Retrieves IoC response from Socfortress Threat Intel API. |
| 41 | |
| 42 | Args: |
| 43 | request (SocfortressProcessNameAnalysisRequest): The request object containing the IoC data. |
| 44 | session (AsyncSession): The async session object for making HTTP requests. |
| 45 | |
| 46 | Returns: |
| 47 | SocfortressProcessNameAnalysisResponse: The response object containing the IoC data and success status. |
| 48 | """ |
| 49 | url = "https://api.first.org/data/v1/epss" |
| 50 | response_data = await invoke_epss_api(url, request) |
| 51 | |
| 52 | # If status-code is not 200, raise an HTTPException |
| 53 | if response_data.get("status-code") != 200: |
| 54 | raise HTTPException( |
| 55 | status_code=500, |
| 56 | detail="Failed to retrieve EPSS score", |
| 57 | ) |
| 58 | |
| 59 | # Using .get() with default values |
| 60 | data = [EpssData(**item) for item in response_data.get("data", [])] |
| 61 | |
| 62 | return EpssThreatIntelResponse(data=data, success=True, message="EPSS score retrieved successfully") |