├── .gitignore ├── Gemfile ├── README.md ├── package.json ├── co-occurrences.py ├── scripts.rb ├── scripts.py ├── node-scripts.js └── scripts.php /.gitignore: -------------------------------------------------------------------------------- 1 | node_modules/ 2 | Gemfile.lock 3 | .bundle/ 4 | -------------------------------------------------------------------------------- /Gemfile: -------------------------------------------------------------------------------- 1 | # A sample Gemfile 2 | source "https://rubygems.org" 3 | 4 | # gem "rails" 5 | 6 | gem 'rest-client' 7 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | investigate-examples 2 | ================= 3 | 4 | This repository contains coding examples for the OpenDNS Investigate API. 5 | 6 | Scripts are called by setting the environment variable INVESTIGATE\_TOKEN equal to your API token and running the script. 7 | 8 | ``` 9 | INVESTIGATE_TOKEN=%YourToken% python scripts.py 10 | ``` 11 | -------------------------------------------------------------------------------- /package.json: -------------------------------------------------------------------------------- 1 | { 2 | "name": "coding-examples", 3 | "version": "0.0.0", 4 | "description": "", 5 | "main": "node-scripts.js", 6 | "dependencies": { 7 | "request": "~2.36.0" 8 | }, 9 | "devDependencies": {}, 10 | "scripts": { 11 | "test": "echo \"Error: no test specified\" && exit 1" 12 | }, 13 | "author": "", 14 | "license": "ISC" 15 | } 16 | -------------------------------------------------------------------------------- /co-occurrences.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | 3 | import requests, argparse, os 4 | 5 | token = os.getenv('INVESTIGATE_TOKEN', False) 6 | 7 | #takes a single domain as its argument 8 | 9 | 10 | parser = argparse.ArgumentParser(description='Check a domain\'s coocurrences for malicious status') 11 | parser.add_argument('domain', action='store', type=str, help='domain to query') 12 | args = parser.parse_args() 13 | 14 | 15 | print 16 | print 'Querying Investigate for', args.domain+'\'s co-occurrences...' 17 | print 18 | 19 | initial_query = args.domain 20 | 21 | url='https://investigate.api.umbrella.com/recommendations/name/{0}.json'.format(initial_query) 22 | 23 | auth_headers = {'Authorization' : 'Bearer '+ token} 24 | 25 | q = requests.get(url, headers=auth_headers) #get co-occurrences for domain 26 | 27 | output = q.json() 28 | 29 | if output == {}: 30 | print "No co-occurrences found." 31 | print 32 | 33 | elif output['found'] == True: 34 | pfs2 = output['pfs2'] 35 | 36 | for i in range(len(pfs2)): 37 | 38 | final_cooccurrences = pfs2[i][0] #create final list of co-occurring domains 39 | url2 = 'https://investigate.api.umbrella.com/domains/categorization/{0}'.format(final_cooccurrences) 40 | domain_status = requests.get(url2, headers=auth_headers) 41 | print "Co-occuring domain:", final_cooccurrences 42 | if domain_status.json()[final_cooccurrences]['status'] == 0: 43 | print "Domain score value:", domain_status.json()[final_cooccurrences]['status'] 44 | print "No decision" 45 | print 46 | elif domain_status.json()[final_cooccurrences]['status'] == 1: 47 | print "Domain score value:", domain_status.json()[final_cooccurrences]['status'] 48 | print "In the OpenDNS whitelist" 49 | print 50 | elif domain_status.json()[final_cooccurrences]['status'] == -1: 51 | print "Domain score value:", domain_status.json()[final_cooccurrences]['status'] 52 | print "In the OpenDNS Security Labs block list" 53 | print 54 | else: 55 | print "something went wrong" 56 | -------------------------------------------------------------------------------- /scripts.rb: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env ruby 2 | 3 | require 'rubygems' if RUBY_VERSION < '1.9' 4 | require 'rest_client' 5 | 6 | token = ENV['INVESTIGATE_TOKEN'] 7 | 8 | if not token 9 | puts "ERROR: environment variable 'INVESTIGATE_TOKEN' not set. Invoke script with 'INVESTIGATE_TOKEN=%YourToken% ruby scripts.rb'" 10 | exit 11 | end 12 | # domains/categorization 13 | 14 | headers = { 15 | :authorization => 'Bearer ' + token 16 | } 17 | 18 | response = RestClient.get 'https://investigate.api.umbrella.com/domains/categorization/amazon.com', headers 19 | puts "domains/categorization: " + response 20 | 21 | 22 | # domains/categorization (POST) 23 | 24 | values = '[ 25 | "google.com", 26 | "yahoo.com" 27 | ]' 28 | 29 | headers = { 30 | :authorization => 'Bearer ' + token 31 | } 32 | 33 | response = RestClient.post 'https://investigate.api.umbrella.com/domains/categorization/ ', values, headers 34 | puts "domains/categorization(POST): " + response 35 | 36 | 37 | # domains/categorization?showLabels 38 | 39 | headers = { 40 | :authorization => 'Bearer ' + token 41 | } 42 | 43 | response = RestClient.get 'https://investigate.api.umbrella.com/domains/categorization/amazon.com?showLabels', headers 44 | puts "domains/categorization?showLabels: " + response 45 | 46 | 47 | # domains/categories 48 | 49 | headers = { 50 | :authorization => 'Bearer ' + token 51 | } 52 | 53 | response = RestClient.get 'https://investigate.api.umbrella.com/domains/categories', headers 54 | puts "domains/categories: " + response 55 | 56 | 57 | # domains/score 58 | 59 | headers = { 60 | :authorization => 'Bearer ' + token 61 | } 62 | 63 | response = RestClient.get 'https://investigate.api.umbrella.com/domains/score/example.com', headers 64 | puts "domains/score: " + response 65 | 66 | 67 | # domains/score (POST) 68 | 69 | values = '[ 70 | "example.org", 71 | "example.net", 72 | "example.com" 73 | ]' 74 | 75 | headers = { 76 | :authorization => 'Bearer ' + token 77 | } 78 | 79 | response = RestClient.post 'https://investigate.api.umbrella.com/domains/score/', values, headers 80 | puts "domains/score(POST): " + response 81 | 82 | 83 | # recommendations/name 84 | 85 | headers = { 86 | :authorization => 'Bearer ' + token 87 | } 88 | 89 | response = RestClient.get 'https://investigate.api.umbrella.com/recommendations/name/www.internetbadguys.com.json', headers 90 | puts "recommendations/name: " + response 91 | 92 | 93 | # links/name 94 | 95 | headers = { 96 | :authorization => 'Bearer ' + token 97 | } 98 | 99 | response = RestClient.get 'https://investigate.api.umbrella.com/links/name/homestarrunner.com.json', headers 100 | puts "links/name: " + response 101 | 102 | 103 | # security/name 104 | 105 | headers = { 106 | :authorization => 'Bearer ' + token 107 | } 108 | 109 | response = RestClient.get 'https://investigate.api.umbrella.com/security/name/www.internetbadguys.com.json', headers 110 | puts "security/name: " + response 111 | 112 | 113 | # latest_tags 114 | 115 | headers = { 116 | :authorization => 'Bearer ' + token 117 | } 118 | 119 | response = RestClient.get 'https://investigate.api.umbrella.com/domains/www.internetbadguys.com/latest_tags', headers 120 | puts "latest_tags: " + response 121 | 122 | 123 | # dnsdb/name 124 | 125 | headers = { 126 | :authorization => 'Bearer ' + token 127 | } 128 | 129 | response = RestClient.get 'https://investigate.api.umbrella.com/dnsdb/name/a/homestarrunner.com.json', headers 130 | puts "dnsdb/name: " + response 131 | 132 | 133 | # dnsdb/ip 134 | 135 | token = ENV['INVESTIGATE_TOKEN'] 136 | 137 | headers = { 138 | :authorization => 'Bearer ' + token 139 | } 140 | 141 | response = RestClient.get 'https://investigate.api.umbrella.com/dnsdb/ip/a/208.67.222.222.json', headers 142 | puts "dnsdb/ip: " + response 143 | 144 | 145 | # latest_domains 146 | 147 | headers = { 148 | :authorization => 'Bearer ' + token 149 | } 150 | 151 | response = RestClient.get 'https://investigate.api.umbrella.com/ips/208.67.222.222/latest_domains', headers 152 | puts "latest_domains: " + response 153 | -------------------------------------------------------------------------------- /scripts.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/python 2 | 3 | from urllib2 import Request, urlopen 4 | import os, sys 5 | 6 | token = os.getenv('INVESTIGATE_TOKEN', False) 7 | 8 | if not token: 9 | print "ERROR: environment variable \'INVESTIGATE_TOKEN\' not set. Invoke script with \'INVESTIGATE_TOKEN=%YourToken% python scripts.py\'" 10 | sys.exit(1) 11 | 12 | # domains/categorization 13 | 14 | headers = { 15 | 'Authorization': 'Bearer ' + token 16 | } 17 | request = Request('https://investigate.api.umbrella.com/domains/categorization/amazon.com', headers=headers) 18 | 19 | response_body = urlopen(request).read() 20 | print "domains/categorization: " + response_body 21 | 22 | 23 | # domains/categorization (POST) 24 | 25 | values = """ 26 | [ 27 | "google.com", 28 | "yahoo.com" 29 | ] 30 | """ 31 | 32 | headers = { 33 | 'Authorization': 'Bearer ' + token 34 | } 35 | request = Request('https://investigate.api.umbrella.com/domains/categorization/ ', data=values, headers=headers) 36 | 37 | response_body = urlopen(request).read() 38 | print "domains/categorization(POST): " + response_body 39 | 40 | 41 | # domains/categorization?showLabels 42 | 43 | headers = { 44 | 'Authorization': 'Bearer ' + token 45 | } 46 | request = Request('https://investigate.api.umbrella.com/domains/categorization/amazon.com?showLabels', headers=headers) 47 | 48 | response_body = urlopen(request).read() 49 | print "domains/categorization?showLabels: " + response_body 50 | 51 | 52 | # domains/categories 53 | 54 | headers = { 55 | 'Authorization': 'Bearer ' + token 56 | } 57 | request = Request('https://investigate.api.umbrella.com/domains/categories', headers=headers) 58 | 59 | response_body = urlopen(request).read() 60 | print "domains/categories: " + response_body 61 | 62 | 63 | # domains/score 64 | 65 | headers = { 66 | 'Authorization': 'Bearer ' + token 67 | } 68 | request = Request('https://investigate.api.umbrella.com/domains/score/example.com', headers=headers) 69 | 70 | response_body = urlopen(request).read() 71 | print "domains/score: " + response_body 72 | 73 | 74 | # domains/score (POST) 75 | 76 | values = """ 77 | [ 78 | "example.org", 79 | "example.net", 80 | "example.com" 81 | ] 82 | """ 83 | 84 | headers = { 85 | 'Authorization': 'Bearer ' + token 86 | } 87 | request = Request('https://investigate.api.umbrella.com/domains/score/', data=values, headers=headers) 88 | 89 | response_body = urlopen(request).read() 90 | print "domains/score(POST): " + response_body 91 | 92 | 93 | # recommendations/name 94 | 95 | headers = { 96 | 'Authorization': 'Bearer ' + token 97 | } 98 | request = Request('https://investigate.api.umbrella.com/recommendations/name/www.internetbadguys.com.json', headers=headers) 99 | 100 | response_body = urlopen(request).read() 101 | print "recommendations/name: " + response_body 102 | 103 | 104 | # links/name 105 | 106 | headers = { 107 | 'Authorization': 'Bearer ' + token 108 | } 109 | request = Request('https://investigate.api.umbrella.com/links/name/homestarrunner.com.json', headers=headers) 110 | 111 | response_body = urlopen(request).read() 112 | print "links/name: " + response_body 113 | 114 | 115 | # security/name 116 | 117 | headers = { 118 | 'Authorization': 'Bearer ' + token 119 | } 120 | request = Request('https://investigate.api.umbrella.com/security/name/www.internetbadguys.com.json', headers=headers) 121 | 122 | response_body = urlopen(request).read() 123 | print "security/name: " + response_body 124 | 125 | 126 | # latest_tags 127 | 128 | headers = { 129 | 'Authorization': 'Bearer ' + token 130 | } 131 | request = Request('https://investigate.api.umbrella.com/domains/www.internetbadguys.com/latest_tags', headers=headers) 132 | 133 | response_body = urlopen(request).read() 134 | print "latest_tags: " + response_body 135 | 136 | 137 | # dnsdb/name 138 | 139 | headers = { 140 | 'Authorization': 'Bearer ' + token 141 | } 142 | request = Request('https://investigate.api.umbrella.com/dnsdb/name/a/homestarrunner.com.json', headers=headers) 143 | 144 | response_body = urlopen(request).read() 145 | print "dnsdb/name: " + response_body 146 | 147 | 148 | # dnsdb/ip 149 | 150 | headers = { 151 | 'Authorization': 'Bearer ' + token 152 | } 153 | request = Request('https://investigate.api.umbrella.com/dnsdb/ip/a/208.67.222.222.json', headers=headers) 154 | 155 | response_body = urlopen(request).read() 156 | print "dnsdb/ip: " + response_body 157 | 158 | 159 | # latest_domains 160 | 161 | headers = { 162 | 'Authorization': 'Bearer ' + token 163 | } 164 | request = Request('https://investigate.api.umbrella.com/ips/208.67.222.222/latest_domains', headers=headers) 165 | 166 | response_body = urlopen(request).read() 167 | print "latest_domains: " + response_body 168 | -------------------------------------------------------------------------------- /node-scripts.js: -------------------------------------------------------------------------------- 1 | var request = require('request'), 2 | token = process.env.INVESTIGATE_TOKEN 3 | ; 4 | 5 | if (!token) { 6 | console.log("ERROR: environment variable 'INVESTIGATE_TOKEN' not set. Invoke script with 'INVESTIGATE_TOKEN=%YourToken% node node-scripts.js'"); 7 | process.exit(1); 8 | } 9 | // domains/categorization 10 | 11 | request({ 12 | method: 'GET', 13 | url: 'https://investigate.api.umbrella.com/domains/categorization/amazon.com', 14 | headers: { 15 | 'Authorization': 'Bearer ' + token 16 | } 17 | }, function (error, response, body) { 18 | console.log('domains/categorization:', body); 19 | }); 20 | 21 | 22 | // domains/categorization (POST) 23 | 24 | request({ 25 | method: 'POST', 26 | url: 'https://investigate.api.umbrella.com/domains/categorization/ ', 27 | headers: { 28 | 'Authorization': 'Bearer ' + token 29 | }, 30 | body: "[ \"google.com\", \"yahoo.com\"]" 31 | }, function (error, response, body) { 32 | console.log('domains/categorization(POST):', body); 33 | }); 34 | 35 | 36 | // domains/categorization?showLabels 37 | 38 | request({ 39 | method: 'GET', 40 | url: 'https://investigate.api.umbrella.com/domains/categorization/amazon.com?showLabels', 41 | headers: { 42 | 'Authorization': 'Bearer ' + token 43 | } 44 | }, function (error, response, body) { 45 | console.log('domains/categorization:', body); 46 | }); 47 | 48 | 49 | // domains/categories 50 | 51 | request({ 52 | method: 'GET', 53 | url: 'https://investigate.api.umbrella.com/domains/categories', 54 | headers: { 55 | 'Authorization': 'Bearer ' + token 56 | } 57 | }, function (error, response, body) { 58 | console.log('domains/categories:', body); 59 | }); 60 | 61 | 62 | // domains/score 63 | 64 | request({ 65 | method: 'GET', 66 | url: 'https://investigate.api.umbrella.com/domains/score/example.com', 67 | headers: { 68 | 'Authorization': 'Bearer ' + token 69 | } 70 | }, function (error, response, body) { 71 | console.log('domains/score:', body); 72 | }); 73 | 74 | 75 | // domains/score (POST) 76 | 77 | request({ 78 | method: 'POST', 79 | url: 'https://investigate.api.umbrella.com/domains/score/', 80 | headers: { 81 | 'Authorization': 'Bearer ' + token 82 | }, 83 | body: "[ \"example.org\", \"example.net\", \"example.com\"]" 84 | }, function (error, response, body) { 85 | console.log('domains/score(POST):', body); 86 | }); 87 | 88 | 89 | // recommendations/name 90 | 91 | request({ 92 | method: 'GET', 93 | url: 'https://investigate.api.umbrella.com/recommendations/name/www.internetbadguys.com.json', 94 | headers: { 95 | 'Authorization': 'Bearer ' + token 96 | }, 97 | body: "{ \"name\": \"example.com\"}" 98 | }, function (error, response, body) { 99 | console.log('recommendations/name:', body); 100 | }); 101 | 102 | 103 | // links/name 104 | 105 | request({ 106 | method: 'GET', 107 | url: 'https://investigate.api.umbrella.com/links/name/example.com.json', 108 | headers: { 109 | 'Authorization': 'Bearer ' + token 110 | } 111 | }, function (error, response, body) { 112 | console.log('links/name:', body); 113 | }); 114 | 115 | 116 | // security/name 117 | 118 | request({ 119 | method: 'GET', 120 | url: 'https://investigate.api.umbrella.com/security/name/www.internetbadguys.com.json', 121 | headers: { 122 | 'Authorization': 'Bearer ' + token 123 | }, 124 | }, function (error, response, body) { 125 | console.log('security/name:', body); 126 | }); 127 | 128 | 129 | // latest_tags 130 | 131 | request({ 132 | method: 'GET', 133 | url: 'https://investigate.api.umbrella.com/domains/www.internetbadguys.com/latest_tags', 134 | headers: { 135 | 'Authorization': 'Bearer ' + token 136 | } 137 | }, function (error, response, body) { 138 | console.log('latest_tags:', body); 139 | }); 140 | 141 | 142 | // dnsdb/name 143 | 144 | request({ 145 | method: 'GET', 146 | url: 'https://investigate.api.umbrella.com/dnsdb/name/a/homestarrunner.com.json', 147 | headers: { 148 | 'Authorization': 'Bearer ' + token 149 | } 150 | }, function (error, response, body) { 151 | console.log('dnsdb/name:', body); 152 | }); 153 | 154 | 155 | // dnsdb/ip 156 | 157 | request({ 158 | method: 'GET', 159 | url: 'https://investigate.api.umbrella.com/dnsdb/ip/a/208.67.222.222.json', 160 | headers: { 161 | 'Authorization': 'Bearer ' + token 162 | } 163 | }, function (error, response, body) { 164 | console.log('dnsdb/ip:', body); 165 | }); 166 | 167 | 168 | // latest_domains 169 | 170 | request({ 171 | method: 'GET', 172 | url: 'https://investigate.api.umbrella.com/ips/208.67.222.222/latest_domains', 173 | headers: { 174 | 'Authorization': 'Bearer ' + token 175 | } 176 | }, function (error, response, body) { 177 | console.log('latest_domains:', body); 178 | }); 179 | -------------------------------------------------------------------------------- /scripts.php: -------------------------------------------------------------------------------- 1 |