Package: uddr-client
uddr_clientA Python SDK for UltraDDRInstallationThe package can be installed using pippipinstalluddr_clientSetupFor ease of use, you can store your API key in an environment file using the client's "setup" method.importuddr_clientuddr_client.connect.setup()Alternatively, you can pass the key directly to the connection using keyword arguments.c=uddr_client.connect('api_key=<your API key>')If your API key is associated with more than one organization, you can specify which one to use by passing the organization name as a keyword argument or by setting it in your environment.importuddr_clientclient=uddr_client.connect()doh_client=client.doh()doh_client.setup()API Usageimportuddr_clientc=uddr_client.connect()# Instantiates a new instance of the client which, by default, uses the API key stored in your .envapi_client=c.api()# Creates an API client instanceresp=api_client.reports()# Call an endpointprint(resp)Available methodsThe API client currently supports the following endpoints:aggregates()bar()histogram()summary()report()reports()histogram_artifact()logs()passthrough()category()account()organization()settings()products()packages()user()organizations()decision()baseline()countries()Use Python's help function for more in-depth documentation on each method.help(c.api().logs)Response parsingAside from thereport()(application/pdf)andcategory()(list)endpoints, all methods produce a Response object which handles different outputs.Response.xml(): Outputs the response in XMLResponse.csv(): Outputs the response in CSVThe default is JSON.DoH UsageThe DNS over HTTPS (DoH) client provides an interface for directly querying the UDDR resolvers.importuddr_clientclient=uddr_client.connect()doh=client.doh()# Creates a DoH client instancelookup=doh.lookup('google.com')# Perform a lookup on google.comprint(lookup)# This will return the full json response for the lookupRecord TypesThe client stores the response for various DNS record types as properties. The following are supported.lookup.A# For A recordslookup.AAAA# For AAAA recordslookup.CNAME# For CNAME recordslookup.NS# For NS recordslookup.MX# For MX recordslookup.TXT# For TXT recordslookup.SOA# For SOA recordslookup.SRV# For SRV recordslookup.CAA# For CAA recordslookup.DS# For DS recordslookup.DNSKEY# For DNSKEY recordsReverse LookupsIf you pass an IP to the client, it will automatically perform a reverse lookup (PTR).IoC ParsingThis concept is borrowed from Michael Smith'sDDR-IOC-Checker.Indicators of compromise passed to the DOHClient as a positional argument will be run through a parser. The parser accepts the following:Domain namesURLs by means of stripping the protocol and path"Defanged" URLs which are intentionally obfuscated for security reasonsEmails - the parser will remove the prefix and @IP addressesAdditional MethodsThe following methods return information about the DoH query or specific parts of the response.status()- Returns an object with information about the status of the response. DoH provides a numerical code, this expands with a message and description.block_info()- Returns a string stating whether the domain is blocked (by checking if the A record resolves to the UDDR block page).answer()- Returns the answer section of the response, if one exists.authority()- Returns the authority section of the response, if one exists.Dependenciespandasxmltodictpython-decouplerequestsLicenseThis project is licensed under the terms of the MIT license. See LICENSE.md for more details.