(self, report, scandate)
return status
Process private sample report information focused on virustotal's
        behaviour information. This includes the section:
            - VirusTotal Metadata (times seen)
            - VirusTotal Reputation
        Args:
            report (dict): unprocessed main json report information from VT.

        Return: dict with keys:
            'success' (boolean),
            'message' (str),
Process private sample report information focused on virustotal's
        behaviour information. This includes the section:
            - VirusTotal Metadata (times seen)
            - VirusTotal Reputation
        Args:
            report (dict): unprocessed main json report information from VT.
Process private sample report information focused on virustotal s behaviour information . This includes the section : - VirusTotal Metadata ( times seen ) - VirusTotal Reputation Args : report ( dict ) : unprocessed main json report information from VT .
def _process_private_sample_behaviour(self, report, scandate):
        """
        Process private sample report information focused on virustotal's
        behaviour information. This includes the section:
            - VirusTotal Metadata (times seen)
            - VirusTotal Reputation
        Args:
            report (dict): unprocessed main json report information from VT.

        Return: dict with keys:
            'success' (boolean),
            'message' (str),
        """
        status = {
            'success':  False,
            'message':  []
        }
        additional_info_dict = report.get('additional_info', {})
        behaviour_dict = additional_info_dict.get('behaviour-v1', {})

        # VirusTotal Network Behavioral Data
        if behaviour_dict:
            behaviour_network_dict = behaviour_dict.get('network', {})

            if behaviour_network_dict:
                # Grab DNS data if available
                behaviour_network_dns = behaviour_network_dict.get('dns', [])
                if behaviour_network_dns:
                    for item in behaviour_network_dns:
                        # Add domain to CRITs
                        domain = item.get('hostname', None)
                        ip = item.get('ip', None)
                        self._add_result('VirusTotal Behaviour DNS', str(domain), {'IP_Address': str(ip)})
                        if domain and self.config.get('vt_add_domains', False):
                            self._process_domain(domain, ip, scandate)
                else:
                    status['message'].append("DNS behaviour information not included in VT response.")

                # Grab HTTP data if available
                behaviour_network_http = behaviour_network_dict.get('http', [])
                if behaviour_network_http:
                    for item in behaviour_network_http:
                        item_dict = {
                            'Method':       item.get('method', ''),
                            'User-agent':   item.get('user-agent', '')
                        }
                        self._add_result('VirusTotal Behaviour HTTP', item.get('url', ''), item_dict)
                else:
                    status['message'].append("HTTP behaviour information not included in VT response.")

                # Grab TCP data if available
                behaviour_network_tcp = behaviour_network_dict.get('tcp', [])
                if behaviour_network_tcp:
                    for item in behaviour_network_tcp:
                        self._add_result('VirusTotal Behaviour TCP', item)
                else:
                    status['message'].append("TCP behaviour information not included in VT response.")

                # Grab UDP data if available
                behaviour_network_udp = behaviour_network_dict.get('udp', [])
                if behaviour_network_udp:
                    for item in behaviour_network_udp:
                        self._add_result('VirusTotal Behaviour UDP', item)
                else:
                    status['message'].append("UDP behaviour information not included in VT response.")

            # VirusTotal Extra Flags
            behaviour_extra = behaviour_dict.get('extra', [])
            if behaviour_extra:
                for item in behaviour_extra:
                    self._add_result('VirusTotal Behaviour Flag', item, {'VT_Flag': 'VT_Flag'})
            else:
                status['message'].append("Behaviour flag information not included in VT response.")

            # VirusTotal Hooking Detection
            behaviour_hooking = behaviour_dict.get('hooking', [])
            if behaviour_hooking:
                for item in behaviour_hooking:
                    item_dict = {
                        'method':   item.get('method', ''),
                        'success':  item.get('success', '')
                    }
                    self._add_result('VirusTotal Hooking Detected', item.get('type', ''), item_dict)
            else:
                status['message'].append("Hooking behaviour information not included in VT response.")

        else:
            status['message'].append("Behaviour information not included in VT response.")

        # Updating status information and returning
        if not status['message']:
            status['success'] =  True
            status['message'] = "Processed private sample behaviour data."
        else:
            status['message'] = "\n".join(status['message'])

        return status
def _process_private_sample_behaviour ( self , report , scandate ) : status = { 'success' : False , 'message' : [ ] } additional_info_dict = report . get ( 'additional_info' , { } ) behaviour_dict = additional_info_dict . get ( 'behaviour-v1' , { } ) # VirusTotal Network Behavioral Data if behaviour_dict : behaviour_network_dict = behaviour_dict . get ( 'network' , { } ) if behaviour_network_dict : # Grab DNS data if available behaviour_network_dns = behaviour_network_dict . get ( 'dns' , [ ] ) if behaviour_network_dns : for item in behaviour_network_dns : # Add domain to CRITs domain = item . get ( 'hostname' , None ) ip = item . get ( 'ip' , None ) self . _add_result ( 'VirusTotal Behaviour DNS' , str ( domain ) , { 'IP_Address' : str ( ip ) } ) if domain and self . config . get ( 'vt_add_domains' , False ) : self . _process_domain ( domain , ip , scandate ) else : status [ 'message' ] . append ( "DNS behaviour information not included in VT response." ) # Grab HTTP data if available behaviour_network_http = behaviour_network_dict . get ( 'http' , [ ] ) if behaviour_network_http : for item in behaviour_network_http : item_dict = { 'Method' : item . get ( 'method' , '' ) , 'User-agent' : item . get ( 'user-agent' , '' ) } self . _add_result ( 'VirusTotal Behaviour HTTP' , item . get ( 'url' , '' ) , item_dict ) else : status [ 'message' ] . append ( "HTTP behaviour information not included in VT response." ) # Grab TCP data if available behaviour_network_tcp = behaviour_network_dict . get ( 'tcp' , [ ] ) if behaviour_network_tcp : for item in behaviour_network_tcp : self . _add_result ( 'VirusTotal Behaviour TCP' , item ) else : status [ 'message' ] . append ( "TCP behaviour information not included in VT response." ) # Grab UDP data if available behaviour_network_udp = behaviour_network_dict . get ( 'udp' , [ ] ) if behaviour_network_udp : for item in behaviour_network_udp : self . _add_result ( 'VirusTotal Behaviour UDP' , item ) else : status [ 'message' ] . append ( "UDP behaviour information not included in VT response." ) # VirusTotal Extra Flags behaviour_extra = behaviour_dict . get ( 'extra' , [ ] ) if behaviour_extra : for item in behaviour_extra : self . _add_result ( 'VirusTotal Behaviour Flag' , item , { 'VT_Flag' : 'VT_Flag' } ) else : status [ 'message' ] . append ( "Behaviour flag information not included in VT response." ) # VirusTotal Hooking Detection behaviour_hooking = behaviour_dict . get ( 'hooking' , [ ] ) if behaviour_hooking : for item in behaviour_hooking : item_dict = { 'method' : item . get ( 'method' , '' ) , 'success' : item . get ( 'success' , '' ) } self . _add_result ( 'VirusTotal Hooking Detected' , item . get ( 'type' , '' ) , item_dict ) else : status [ 'message' ] . append ( "Hooking behaviour information not included in VT response." ) else : status [ 'message' ] . append ( "Behaviour information not included in VT response." ) # Updating status information and returning if not status [ 'message' ] : status [ 'success' ] = True status [ 'message' ] = "Processed private sample behaviour data." else : status [ 'message' ] = "\n" . join ( status [ 'message' ] ) return status