cyjax-cti 2.2.0

Introduction

cyjax-cti is a Python library to use Cyjax platform API. You can access different resources (incident reports, threat actors, indicators of compromise, etc.) from a Python script.

The library is available on Python Package Index.

Install

You can install the cyjax-cti library with pip:

pip install cyjax-cti

Supported resources

Examples

Set the API key

import cyjax

# set a global API key
cyjax.api_key = "346568ecf85f0b5ca98f389908e8b803"

# set a resource API key
cyjax.IndicatorOfCompromise(api_key="346568ecf85f0b5ca98f389908e8b803")

Get indicators of compromise in the last 5 minutes

import cyjax
from datetime import timedelta

cyjax.api_key = "346568ecf85f0b5ca98f389908e8b803"

indicators = cyjax.IndicatorOfCompromise().list(since=timedelta(minutes=5))
for indicator in indicators:
    print(indicator)

Get APT activity in last 6 months

import cyjax
from datetime import timedelta

cyjax.api_key = "346568ecf85f0b5ca98f389908e8b803"

reports = cyjax.IncidentReport().list(query="APT", since=timedelta(days=30*6))
for report in reports:
    print("Title: {}" % report['title'])
    print("Severity: {}" % report['severity'])
    print("Timestamp: {}" % report['last_update'])

Get leaked emails in the last 30 days

import cyjax
from datetime import timedelta

cyjax.api_key = "346568ecf85f0b5ca98f389908e8b803"

for leaked_email in cyjax.LeakedEmail().list(since=timedelta(days=30)):
    print("Email: {}" % leaked_email['email'])
    print("Source: {}" % leaked_email['source'])
    print("Timestamp: {}" % leaked_email['discovered_at'])

Get incident report by ID

import cyjax

cyjax.api_key = "346568ecf85f0b5ca98f389908e8b803"

incident_report = cyjax.IncidentReport().one(10)

print("Report title: {}" % incident_report.get('title'))
print("Report severity: {}" % incident_report.get('severity'))
print("Report content: {}" % incident_report.get('content'))