AlienVault OTXにPulseを作成する際、URLまたはドメインが書かれたファイルからJSONを作成する

create_indicators_with_types.py

#!/usr/bin/python3
import re
import sys
import json

def read_lines(file_path):
    """テキストファイルからURLまたはドメインリストを読み取る"""
    try:
        with open(file_path, "r") as file:
            lines = file.read().splitlines()
        return [line.strip() for line in lines if line.strip()]
    except FileNotFoundError:
        print(f"Error: File '{file_path}' not found.")
        sys.exit(1)

def is_url(line):
    """行が完全なURLかどうかを判定"""
    url_pattern = re.compile(
        r'^(https?:\/\/)'  # 必ずプロトコルが含まれる
        r'([a-zA-Z0-9.-]+\.[a-zA-Z]{2,})'  # ドメイン名
        r'(\/.*)?$'  # パス (オプション)
    )
    return bool(url_pattern.match(line))

def is_domain(line):
    """行がドメイン名かどうかを判定"""
    domain_pattern = re.compile(
        r'^([a-zA-Z0-9.-]+\.[a-zA-Z]{2,})$'  # 単なるドメイン名
    )
    return bool(domain_pattern.match(line))

def create_indicators(lines):
    """URLまたはドメインのリストをインジケーター形式に変換"""
    indicators = []
    for line in lines:
        if is_url(line):
            indicators.append({"indicator": line, "type": "URL", "title": "SBI SECURITIES", "role": "phishing"})
        elif is_domain(line):
            indicators.append({"indicator": line, "type": "domain", "title": "SBI SECURITIES", "role": "phishing"})
        else:
            print(f"Warning: Skipping unrecognized line: {line}")
    return indicators

def save_to_json_with_commas(indicators, output_file):
    """インジケーターをAlienVault OTXのPulse形式で保存"""
    try:
        with open(output_file, "w") as file:
            file.write("[\n")
            for i, indicator in enumerate(indicators):
                json_line = json.dumps(indicator)
                if i < len(indicators) - 1:
                    file.write(f"    {json_line},\n")  # カンマ付き
                else:
                    file.write(f"    {json_line}\n")   # 最後の行はカンマなし
            file.write("]\n")
        print(f"Indicators JSON file created successfully: {output_file}")
    except Exception as e:
        print(f"Error writing to file: {e}")
        sys.exit(1)

def main():
    if len(sys.argv) != 3:
        print("Usage: python create_pulse_indicators_json_fixed.py <path_to_input_file> <output_json_file>")
        sys.exit(1)
    
    input_file = sys.argv[1]
    output_file = sys.argv[2]

    lines = read_lines(input_file)
    indicators = create_indicators(lines)
    save_to_json_with_commas(indicators, output_file)

if __name__ == "__main__":
    main()