lambda_function.py

#!/usr/bin/env python3
'''
Lambda function handler for entry into lambdabot
'''

import os
from iocsearch import IOCSearch

from intelbot import LambdaBot
from iocsearch_lambda import IOCRequest, return_results


def handler(event, context):
    '''
    :param event:
    :param context:
    :return:
    '''
    # Note: This is hear to provide a simple way to verify
    # your function when you set up your slack bot.  Dont't remove
    #this unless you're intending to solve this a different way
    if "challenge" in event:
        return event["challenge"]
    else:
        print("incoming msg: {}".format(event))
        #instantiate bot and do things!
        bot = LambdaBot(botname=os.environ['BOT_NAME'])
        if not bot.process_event(event):
            print("event processing failed, exiting")
            return
        #make sure bot is really supposed to reply
        if bot.is_dm() or bot.has_bot_mention():
            if not bot.is_bot_msg():
                if 'test' in bot.event.event.text:
                    bot.maze_reply()
                    return

                #### Intel Bot routing
                es_host = os.environ['ES_HOST']
                print("ES: {}".format(es_host))
                event_txt = bot.event.event.text
                print("Bot message: {}".format(event_txt))
                if "ipaddress" in event_txt:
                    if "summary" in event_txt:
                        search_data = event_txt.split("summary")[1]
                        strings = search_data.split(",")
                        for string in strings:
                            iocs = IOCSearch(es_instance_host=es_host, is_lambda=True)
                            search_string = string.split("summary")[1].strip()
                            bot.reply_to_user("searching for: {}".format(search_string))
                            ans = iocs.ip_summary(search_string)
                            msg = "got: {} hits for {}.\n Unique Sources: \n{}".format(
                                ans['hits']['total'],
                                search_string,
                                [i['key'] for i in ans['aggregations']['sources']['buckets']]
                            )
                            bot.reply_to_user(msg)
                        return
                    else:
                        search_data = event_txt.split("summary")[1]
                        strings = search_data.split(",")
                        for string in strings:
                            iocs = IOCSearch(es_instance_host=es_host, is_lambda=True)
                            search_string = string.split("summary")[1].strip()
                            print(type(search_string))
                            bot.reply_to_user("searching for: {}".format(search_string))
                            ans = iocs.ip_details(search_string)
                            bot.reply_to_user(ans)
                        return
                if "stringsearch" in event_txt:
                    iocs = IOCSearch(es_instance_host=es_host, is_lambda=True)
                    if "summary" in event_txt:
                        search_data = event_txt.split("summary")[1]
                        strings = search_data.split(",")
                        for string in strings:
                            print("Running string search on: {}".format(string))
                            search_string = string.strip()
                            print(type(search_string))
                            bot.reply_to_user("searching for: {}".format(search_string))
                            ans = iocs.stringsearch_summary(search_string)
                            msg = "```got: {} hits for {}.\n Unique Sources: \n{}```".format(
                                ans['hits']['total'],
                                search_string,
                                [i['key'] for i in ans['aggregations']['sources']['buckets']]
                            )
                            bot.reply_to_user(msg)
                    else:
                        search_data = event_txt.split("stringsearch")[1]
                        strings = search_data.split(",")
                        for string in strings:
                            print("Running string search..")
                            search_string = string.strip()
                            print(type(search_string))
                            bot.reply_to_user("searching for: {}".format(search_string))
                            ans = iocs.stringsearch(search_string)
                            print(ans)
                            bot.reply_to_user(ans)

                    return
                if 'domain' in event_txt:
                    iocs = IOCSearch(es_instance_host=es_host, is_lambda=True)
                    if 'summary' in event_txt:
                        search_data = event_txt.split("summary")[1]
                        strings = search_data.split(",")
                        for string in strings:
                            print(string)
                            search_string = string.strip().split("|")[1]
                            search_string = search_string.strip(">")
                            search_string = search_string.strip("<")
                            print(type(search_string))
                            bot.reply_to_user("searching for: {}".format(search_string))
                            ans = iocs.domain_summary(search_string)
                            msg = "```got: {} hits for {}.\n Unique Sources: \n{}```".format(
                                ans['hits']['total'],
                                search_string,
                                [i['key'] for i in ans['aggregations']['sources']['buckets']]
                            )
                            bot.reply_to_user(msg)
                        return
                    else:
                        search_data = event_txt.split("domain")[1]
                        strings = search_data.split(",")
                        for string in strings:
                            msg = ""
                            search_string = string.strip().split("|")[1]
                            search_string = search_string.strip(">")
                            search_string = search_string.strip("<")
                            bot.reply_to_user("searching for: {}\n".format(search_string))
                            ans = iocs.domain_details(search_string)
                            for i in ans['hits']['hits']:
                                msg += "\n"
                                msg += "```{}\n```".format(i['_source'])
                            msg += "\n"
                            bot.reply_to_user(msg)
                        return
                else:
                    bot.dummy_response()
                return
        return