Package: cofense-triage
Cofense Triage SDK for PythonThis package provides a object-oriented Python interface to the Triage API V2.
For more information about Cofense Triage, seehttps://cofense.com.Refer to your Triage API documentation for details about the data schema.This package works with Triage 1.20 and later.InstallationThis package is available on PyPI.python-mpipinstallcofense_triageUsageInitializationFirst, instantiate a Triage object.client_idandclient_secretvalues are
provided in the Triage web interface under API V2 Applications.api_versionmust be2for now, and is present to ease future upgrades.fromcofense_triageimportTriagetriage=Triage(host="https://triage.example.com",api_version=2,client_id="client_id_here",client_secret="client_secret_here",)Fetching dataYou can fetch resources by calling methods named following theget_resourcename()pattern.forreportintriage.get_reports():print(report)forthreat_indicatorintriage.get_threat_indicators():print(threat_indicator)Allget_*methods return iterators, which are evaluated lazily—Requests for
subsequent pages of results are made automatically when needed. You can force
all results to be fetched immediately by casting the iterator to a list.list(triage.get_reporters())The Triage class provides some convenience functions for common requests. Seecofense_triage/triage.pyfor more.reports=triage.get_processed_reports()reports=triage.get_processed_reports_since("2020-01-01")reports=triage.get_processed_reports_by_reporter("j.random@cofense.com")operators=triage.get_operators_by_email("j.random@cofense.com")You can also pass generic filter conditions into the baseget_*methods or the
convenience methods. Filter conditions are represented by a dict or list of
dicts, where each dict containsattr(attribute name),val(value), and
optionallyop(comparison operation, defaults toeq). See the Triage API
documentation for supported attributes and operations, as well as composition
logic.triage.get_reporters({"attr":"email","op":"not_end","val":"example.com"})triage.get_reporters([{"attr":"reports_count","op":"gt","val":"0"},{"attr":"email","op":"not_end","val":"example.com"}])CreationUse methods named following thecreate_resourcename()pattern to create
records. These methods take a single argument, which is a dict or list of dicts
describing the record(s) to be created.triage.create_rules({"name":"Great_New_Rule","priority":3,"scope":"Email","rule_context":"Phishing Tactic","content":"YARA code here","time_to_live":"1 year"})UpdatingUpdate records by assigning new values to fields. Callcommit()to send the
update request to Triage.rule=next(triage.get_rules({"attr":"name","val":"Great_New_Rule"}))rule.priority=2rule.commit()DeletionDelete records by callingdelete()followed bycommit().rule=next(triage.get_rules({"attr":"name","val":"Great_New_Rule"}))rule.delete()rule.commit()ExamplesFind all rules with "Credential" in the name and set the priority to 4.forruleintriage.get_rules({"attr":"name","val":"Credential","op":"cont"}):rule.priority=4rule.commit()Build a CSV of reporters from the last week, sorted by number of reports.importdatetimeimportitertoolsimportcsvreports=triage.get_reports([{"attr":"created_at","op":"gt","val":datetime.datetime.now()-datetime.timedelta(days=7),}])grouped_reports=itertools.groupby(reports,key=lambdareport:report.reporter.email)results=[{"address":reporter_address,"num_reports":len(list(reports)),}forreporter_address,reportsingrouped_reports]withopen("reporters_last_week.csv","w",newline="")asf:csv_writer=csv.DictWriter(f,fieldnames=results[0].keys())csv_writer.writeheader()csv_writer.writerows(results)LicenseThis software is licensed under the MIT License, included in the fileLICENSE.