Skip to content

Commit c245523

Browse files
hrbrmstrhrbrmstr
committed
initial commit
1 parent 6887612 commit c245523

22 files changed

+581
-8
lines changed

‎DESCRIPTION

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,16 @@
11
Package: xforce
22
Type: Package
3-
Title: xforce title goes here otherwise CRAN checks fail
3+
Title: Tools to Gather Threat Intelligence from 'IBM' 'X-Force'
44
Version: 0.1.0
55
Date: 2018-12-11
66
Authors@R: c(
77
person("Bob", "Rudis", email = "[email protected]", role = c("aut", "cre"),
88
comment = c(ORCID = "0000-0001-5670-2640"))
99
)
1010
Maintainer: Bob Rudis <[email protected]>
11-
Description: A good description goes here otherwise CRAN checks fail.
11+
Description: The 'IBM' 'X-Force' portal has a corresponding 'API' (<https://api.xforce.ibmcloud.com/doc/#introduction>)
12+
that provides access to threat intelligence for domains, hosts and 'IP'
13+
addresses. Tools are provided to query and manage this data.
1214
URL: https://gitlab.com/hrbrmstr/xforce
1315
BugReports: https://gitlab.com/hrbrmstr/xforce/issues
1416
Encoding: UTF-8
@@ -21,3 +23,4 @@ Depends:
2123
Imports:
2224
httr,
2325
jsonlite
26+
RoxygenNote: 6.1.1

‎NAMESPACE

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,12 @@
11
# Generated by roxygen2: do not edit by hand
22

3+
export(xforce_as_networks)
4+
export(xforce_ip_history)
5+
export(xforce_ip_malware)
6+
export(xforce_ip_report)
7+
export(xforce_resolve)
8+
export(xforce_url_malware)
9+
export(xforce_url_report)
10+
export(xforce_whois)
311
import(httr)
412
importFrom(jsonlite,fromJSON)

‎R/as-networks.R

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
#' Get Networks Assigned to an Autonomous System Number
2+
#'
3+
#' @md
4+
#' @param asn Autonomous System Number
5+
#' @param api_key,api_password IBM X-Force API Key & Password. All `xforce`
6+
#' API functions will look for these in the `XFORCE_API_KEY` and
7+
#' `XFORCE_API_PASSWORD` environment variables. You can store these
8+
#' in `~/.Renviron` and you can obtain them
9+
#' [on the IBM X-Force Portal](https://exchange.xforce.ibmcloud.com/settings/api).
10+
#' @export
11+
#' @examples \donrun{
12+
#' xforce_as_networks("3131")
13+
#' }
14+
xforce_as_networks <- function(asn, api_key=Sys.getenv("XFORCE_API_KEY"),
15+
api_password=Sys.getenv("XFORCE_API_PASSWORD")) {
16+
17+
httr::GET(
18+
url = sprintf("https://api.xforce.ibmcloud.com/ipr/asn/%s", asn),
19+
httr::accept_json(),
20+
httr::user_agent("R xforce package (https://github.com/hrbrmstr/xforce"),
21+
httr::authenticate(
22+
user = api_key,
23+
password = api_password
24+
)
25+
) -> res
26+
27+
httr::stop_for_status(res)
28+
29+
out <- httr::content(res, as = "text")
30+
31+
out <- jsonlite::fromJSON(out)
32+
33+
out
34+
35+
}

‎R/dns.R

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
#' Get DNS Records
2+
#'
3+
#' @md
4+
#' @param query IP address, domain name, or URL
5+
#' @param api_key,api_password IBM X-Force API Key & Password. All `xforce`
6+
#' API functions will look for these in the `XFORCE_API_KEY` and
7+
#' `XFORCE_API_PASSWORD` environment variables. You can store these
8+
#' in `~/.Renviron` and you can obtain them
9+
#' [on the IBM X-Force Portal](https://exchange.xforce.ibmcloud.com/settings/api).
10+
#' @export
11+
#' @examples \donrun{
12+
#' xforce_resolve("174.62.167.97")
13+
#' }
14+
xforce_resolve <- function(query, api_key=Sys.getenv("XFORCE_API_KEY"),
15+
api_password=Sys.getenv("XFORCE_API_PASSWORD")) {
16+
17+
httr::GET(
18+
url = sprintf("https://api.xforce.ibmcloud.com/resolve/%s", query),
19+
httr::accept_json(),
20+
httr::user_agent("R xforce package (https://github.com/hrbrmstr/xforce"),
21+
httr::authenticate(
22+
user = api_key,
23+
password = api_password
24+
)
25+
) -> res
26+
27+
httr::stop_for_status(res)
28+
29+
out <- httr::content(res, as = "text")
30+
31+
out <- jsonlite::fromJSON(out)
32+
33+
out
34+
35+
}

‎R/ip-history.R

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
#' Get IP History
2+
#'
3+
#' @md
4+
#' @param ip IP address
5+
#' @param api_key,api_password IBM X-Force API Key & Password. All `xforce`
6+
#' API functions will look for these in the `XFORCE_API_KEY` and
7+
#' `XFORCE_API_PASSWORD` environment variables. You can store these
8+
#' in `~/.Renviron` and you can obtain them
9+
#' [on the IBM X-Force Portal](api_key=Sys.getenv("XFORCE_API_KEY")).
10+
#' @export
11+
#' @examples \donrun{
12+
#' xforce_ip_history("174.62.167.97")
13+
#' }
14+
xforce_ip_history <- function(ip, api_key=Sys.getenv("XFORCE_API_KEY"),
15+
api_password=Sys.getenv("XFORCE_API_PASSWORD")) {
16+
17+
httr::GET(
18+
url = sprintf("https://api.xforce.ibmcloud.com/ipr/history/%s", ip),
19+
httr::accept_json(),
20+
httr::user_agent("R xforce package (https://github.com/hrbrmstr/xforce"),
21+
httr::authenticate(
22+
user = api_key,
23+
password = api_password
24+
)
25+
) -> res
26+
27+
httr::stop_for_status(res)
28+
29+
out <- httr::content(res, as = "text")
30+
31+
out <- jsonlite::fromJSON(out)
32+
33+
out
34+
35+
}

‎R/ip-malware.R

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
#' Get Malware Associated with the IP
2+
#'
3+
#' @md
4+
#' @param ip IP address
5+
#' @param api_key,api_password IBM X-Force API Key & Password. All `xforce`
6+
#' API functions will look for these in the `XFORCE_API_KEY` and
7+
#' `XFORCE_API_PASSWORD` environment variables. You can store these
8+
#' in `~/.Renviron` and you can obtain them
9+
#' [on the IBM X-Force Portal](https://exchange.xforce.ibmcloud.com/settings/api).
10+
#' @export
11+
#' @examples \donrun{
12+
#' xforce_ip_malware("174.62.167.97")
13+
#' }
14+
xforce_ip_malware <- function(ip, api_key=Sys.getenv("XFORCE_API_KEY"),
15+
api_password=Sys.getenv("XFORCE_API_PASSWORD")) {
16+
17+
httr::GET(
18+
url = sprintf("https://api.xforce.ibmcloud.com/ipr/malware/%s", ip),
19+
httr::accept_json(),
20+
httr::user_agent("R xforce package (https://github.com/hrbrmstr/xforce"),
21+
httr::authenticate(
22+
user = api_key,
23+
password = api_password
24+
)
25+
) -> res
26+
27+
httr::stop_for_status(res)
28+
29+
out <- httr::content(res, as = "text")
30+
31+
out <- jsonlite::fromJSON(out)
32+
33+
out
34+
35+
}

‎R/ip-report.R

Lines changed: 23 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,33 @@
33
#' @md
44
#' @param ip IP address
55
#' @param api_key,api_password IBM X-Force API Key & Password. All `xforce`
6-
#' API function will look for these in the `XFORCE_API_KEY` and
6+
#' API functions will look for these in the `XFORCE_API_KEY` and
77
#' `XFORCE_API_PASSWORD` environment variables. You can store these
88
#' in `~/.Renviron` and you can obtain them
9-
#' [on the IBM X-Force Portal](api_key=Sys.getenv("XFORCE_API_KEY")).
9+
#' [on the IBM X-Force Portal](https://exchange.xforce.ibmcloud.com/settings/api).
1010
#' @export
11+
#' @examples \donrun{
12+
#' xforce_ip_report("174.62.167.97")
13+
#' }
1114
xforce_ip_report <- function(ip, api_key=Sys.getenv("XFORCE_API_KEY"),
1215
api_password=Sys.getenv("XFORCE_API_PASSWORD")) {
1316

17+
httr::GET(
18+
url = sprintf("https://api.xforce.ibmcloud.com/ipr/%s", ip),
19+
httr::accept_json(),
20+
httr::user_agent("R xforce package (https://github.com/hrbrmstr/xforce"),
21+
httr::authenticate(
22+
user = api_key,
23+
password = api_password
24+
)
25+
) -> res
26+
27+
httr::stop_for_status(res)
28+
29+
out <- httr::content(res, as = "text")
30+
31+
out <- jsonlite::fromJSON(out)
32+
33+
out
34+
1435
}

‎R/url-malware.R

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
#' Get Malware for URL
2+
#'
3+
#' @md
4+
#' @param url a URL
5+
#' @param api_key,api_password IBM X-Force API Key & Password. All `xforce`
6+
#' API functions will look for these in the `XFORCE_API_KEY` and
7+
#' `XFORCE_API_PASSWORD` environment variables. You can store these
8+
#' in `~/.Renviron` and you can obtain them
9+
#' [on the IBM X-Force Portal](https://exchange.xforce.ibmcloud.com/settings/api).
10+
#' @export
11+
#' @examples \donrun{
12+
#' xforce_url_malware("mediaget.com")
13+
#' }
14+
xforce_url_malware <- function(url, api_key=Sys.getenv("XFORCE_API_KEY"),
15+
api_password=Sys.getenv("XFORCE_API_PASSWORD")) {
16+
17+
httr::GET(
18+
url = sprintf("https://api.xforce.ibmcloud.com/url/malware/%s", url),
19+
httr::accept_json(),
20+
httr::user_agent("R xforce package (https://github.com/hrbrmstr/xforce"),
21+
httr::authenticate(
22+
user = api_key,
23+
password = api_password
24+
)
25+
) -> res
26+
27+
httr::stop_for_status(res)
28+
29+
out <- httr::content(res, as = "text")
30+
31+
out <- jsonlite::fromJSON(out)
32+
33+
out
34+
35+
}

‎R/url-report.R

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
#' Get URL Report
2+
#'
3+
#' @md
4+
#' @param url a URL
5+
#' @param api_key,api_password IBM X-Force API Key & Password. All `xforce`
6+
#' API functions will look for these in the `XFORCE_API_KEY` and
7+
#' `XFORCE_API_PASSWORD` environment variables. You can store these
8+
#' in `~/.Renviron` and you can obtain them
9+
#' [on the IBM X-Force Portal](https://exchange.xforce.ibmcloud.com/settings/api).
10+
#' @export
11+
#' @examples \donrun{
12+
#' xforce_url_report("https://r-project.org/")
13+
#' }
14+
xforce_url_report <- function(url, api_key=Sys.getenv("XFORCE_API_KEY"),
15+
api_password=Sys.getenv("XFORCE_API_PASSWORD")) {
16+
17+
httr::GET(
18+
url = sprintf("https://api.xforce.ibmcloud.com/url/%s", url),
19+
httr::accept_json(),
20+
httr::user_agent("R xforce package (https://github.com/hrbrmstr/xforce"),
21+
httr::authenticate(
22+
user = api_key,
23+
password = api_password
24+
)
25+
) -> res
26+
27+
httr::stop_for_status(res)
28+
29+
out <- httr::content(res, as = "text")
30+
31+
out <- jsonlite::fromJSON(out)
32+
33+
out
34+
35+
}

‎R/whois.R

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
#' Get WHOIS Information for a Host
2+
#'
3+
#' @md
4+
#' @param host host (domain) name
5+
#' @param api_key,api_password IBM X-Force API Key & Password. All `xforce`
6+
#' API functions will look for these in the `XFORCE_API_KEY` and
7+
#' `XFORCE_API_PASSWORD` environment variables. You can store these
8+
#' in `~/.Renviron` and you can obtain them
9+
#' [on the IBM X-Force Portal](https://exchange.xforce.ibmcloud.com/settings/api).
10+
#' @export
11+
#' @examples \donrun{
12+
#' xforce_ip_report("174.62.167.97")
13+
#' }
14+
xforce_whois <- function(host, api_key=Sys.getenv("XFORCE_API_KEY"),
15+
api_password=Sys.getenv("XFORCE_API_PASSWORD")) {
16+
17+
httr::GET(
18+
url = sprintf("https://api.xforce.ibmcloud.com/whois/%s", host),
19+
httr::accept_json(),
20+
httr::user_agent("R xforce package (https://github.com/hrbrmstr/xforce"),
21+
httr::authenticate(
22+
user = api_key,
23+
password = api_password
24+
)
25+
) -> res
26+
27+
httr::stop_for_status(res)
28+
29+
out <- httr::content(res, as = "text")
30+
31+
out <- jsonlite::fromJSON(out)
32+
33+
out
34+
35+
}

0 commit comments

Comments
 (0)