然后我的思路是这样的, 通过以下四个步骤来完成我的自动化闭环运营。
为什么使用他们？
MalwareBazaar：
抽样评估：
Abuseipdb
对新报告恶意 IP 地址进行抽样评估
某步：
某60
某信
response = requests.post('https://mb-api.abuse.ch/api/v1/', data=data, timeout=30, headers=headers,proxies=proxies)json_response = response.json()if(args.field):query = ".data[]." + args.fieldjson_response = jq(query).transform(text=json_response, text_output=True)today = datetime.today()yesterday_9 = (today - timedelta(days=1)).replace(hour=9, minute=0, second=0, microsecond=0)today_9 = today.replace(hour=9, minute=0, second=0, microsecond=0)results = []for i in range(len(json_response['data'])):data_time = datetime.strptime(json_response['data'][i]['first_seen'], '%Y-%m-%d %H:%M:%S')if yesterday_9 <= data_time < today_9:first_seen = "first_seen: " + json_response['data'][i]['first_seen']sha256_hash = "sha256_hash: " + json_response['data'][i]['sha256_hash']sha1_hash = "sha1_hash: " + json_response['data'][i]['sha1_hash']md5_hash = "md5_hash: " + json_response['data'][i]['md5_hash']file_type = "file_type: " + json_response['data'][i]['file_type']testttt = first_seen + "\n" + sha256_hash + "\n" + sha1_hash + "\n" + md5_hash + "\n" + file_type + "\n"results.extend(testttt.splitlines())
url = "https://www.abuseipdb.com/statistics"re= requests.get(url)re.encoding="utf-8"#改为utf-8格式，不然可能读取到的是乱码selector=etree.HTML(re.text)#解析网站，变成HTML格式xPath1 = "/html/body/div[3]/div/div/div/div/div[4]//text()"xPath2 = "/html/body/div[3]/div/div/div/div/div[5]//text()"xPath3 = "/html/body/div[3]/div/div/div/div/div[6]//text()"xPath4 = "/html/body/div[3]/div/div/div/div/div[7]//text()"xPath5 = "/html/body/div[3]/div/div/div/div/div[8]//text()"widelyIP=selector.xpath("/html/body/div[3]/div/div/div/div/aside[1]//text()")recentlyIP=selector.xpath(xPath1)+selector.xpath(xPath2)+selector.xpath(xPath3)+selector.xpath(xPath4)+selector.xpath(xPath5)
通过上面的自动化操作，我完成了病毒情报的自动化闭环运营。
1、每天定时自动化获取 IOC
2、存储 jira 工单便于度量
3、SOAR 自动化提取赋能安全设备
4、SOAR 自动化验证闭环 JIRA 工单。
最终效果流程如下：
