NERD: Added tag translation/filtration, hostname added as artifact

analyzers/NERD/nerd_analyzer.py

@@ -4,6 +4,24 @@
 import requests
 from cortexutils.analyzer import Analyzer
 
+# Map of tag IDs to (name,level)-tuple used in summary (tags not listed here are not shown)
+tag_map = {
+    'reconscanning': ('Scanner', 'suspicious'),
+    'attemptexploit': ('Exploit', 'malicious'),
+    'attemptlogin': ('Login', 'malicious'),
+    'malware': ('Malware', 'malicious'),
+    'availabilitydos': ('DDoS', 'malicious'),
+    'researchscanners': ('Research scanner', 'safe'),
+    'vpn': ('VPN', 'info'),
+    'nat': ('NAT', 'info'),
+    'dsl': ('DSL', 'info'),
+    'dynamicIP': ('Dynamic IP', 'info'),
+    'tor': ('Tor exit node', 'info'),
+    'spam': ('Spam', 'malicious'),
+    'reserved_ip': ('Reserved IP', 'info'),
+}
+
+
 class NERDAnalyzer(Analyzer):
     def __init__(self):
         Analyzer.__init__(self)
@@ -31,14 +49,19 @@ class NERDAnalyzer(Analyzer):
 
             # Tags
             for tag in raw['tags']:
-                # TODO: filter tags, set different levels
-                taxonomies.append(self.build_taxonomy('info', 'NERD', 'Tag', tag))
+                try:
+                    tag_name, level = tag_map[tag]
+                except KeyError:
+                    continue
+                taxonomies.append(self.build_taxonomy(level, 'NERD', 'Tag', tag_name))
 
         return {'taxonomies': taxonomies}
 
     def artifacts(self, raw):
-        """Returns a list of indicators extracted from reply (empty in this case)"""
-        return [] # TODO add hostname as a new indicator?
+        """Returns a list of indicators extracted from reply (only "hostname" in this case)"""
+        if raw.get('hostname'):
+            return [{'dataType': 'fqdn', 'data': raw['hostname']}]
+        return []
 
     def run(self):
         """Main function run by Cortex to analyze an observable."""