[Autogenerated] One of the main goals of this course is around automation.
We can take advantage and make use of online fall reputation services,
including threat intelligence feeds,
integrations vary based on the solution in some cases a native module or
clients are available and we'll see that later on.
And in some other cases, integrations are supported via the rest.
API This is where we need to codify a client using http
requests to interact with the service.
One of the most popular solutions for file reputation
and analysis is by far virus Total.
The platform has an API which is available via native part and module
getting an EP I key requires registering for an account.
There is a free tier available for non commercial use and it
has some limitations on the number of scans you can perform
and even with the free tier,
the platform provides some pretty powerful features including the ability to
look up a file and the scare results based on the hash value.
You can also scan websites and domains as well as submit falls for scanning.
To understand the true value of this integration,
let's consider the following demo.
First.
We'll review the virus Total API documentation and API section of the service.
The api key is quite important and I'll showcase your way you can store it
securely and share some considerations to avoid being leaked.
If you decide to share your script publicly,
then we will install the virus Total API module using pape and then
we'll actually test this to retrieve information about unknown files
such as fall category and detection score.
We'll kick off this demo and first we'll cover the
documentation for the virus total Python client module.
There is a dedicated section on how to install this module and you can notice
it's as simple as using pip Next in the quick start section.
The commands are listed on how to get started using the module.
The important aspect to be aware of is that this more rule is an interface
to the existing REST API The documentation covers important aspects such as
how to get information based on a hash value,
scan a file or URL next we'll switch to virus total dot com
where I have already signed in and in the profile menu
there is a link to the API key.
This section provides insight into the details of the free tier as
well as the actual API key with this information.
We can start implementing the integration in our script but one of the most
important aspects is how to handle the api key for this purpose.
I will store the key in a dot in the fall as a variable called viti key.
Please remember that the git ignore file should contain the
dot NV files so this will not be committed next I will
install a module called Python dot n.
This will read the dot PNG file and load the VT key as an environment
variable in memory and we'll do this using pip at this stage.
I will also install the VT dash pi module as well.
Now I will start python to test if everything works
before implementing this in our script.
First I will import the load dot function from the dot NV module.
2nd I will import the VT module And next I will import to get MD
five function from the malware detect script.
Now that all dependencies have been imported I can
continue with testing the functionality.
I will first call load dot n of a function to load the VT key into memory.
I will also import the os module to be able to
interact with the environment variables.
Next I'll create a new variable called API key and assign it the
value of the environment variable v t key which has been loaded
from the dot PNG file using the function load dot env This will
enable me to create a new virus.
Total client using the API Kay to search for a foul hash I will
invoke the get MD five function for one of the samples and save
this in the foul hash variable.
I will create a variable called rest and save the
result of the get object function.
This makes a call to the dash false endpoint and
specifies the fall hash as a parameter.
The result returns information in specific fields.
One of them being meaningful name and we can see this
fall is actually called mimic cats, printing the list of talks.
We can get even more interesting information about the file
and if you want a complete list of fields,
you can check this in the documentation but you can also type rest dot
d i r and this will list all the fields available.
Now it's time to integrate this into our script.
First I will address the imports including v t n dot n in the
main part of the script I will call the load dot in function
as one of the first instructions.
Now I can create a function to retrieve the virus total data and I will
call it check V T I will make use of try except structure to take into
account all possible errors and exceptions and we'll make use of the
same instructions used previously and return a dictionary composed of
multiple fields including the malicious score and the classification
regarding our cars.
I will add another argument called check VT or svT for short.
Similar to the previous features that we implemented In an
if statement for the check VT argument using a four loop I
iterate through the files.
I'm also using the time of sleep to introduce a delay and make
sure I abide by the limitations imposed in the free tier
running the script produces an error.
Now this is a great opportunity to debug based on the error.
There is a problem with a VT dot client.
This is because client should be spelled with a capital C and running
a script again will generate a successful report.