This Python script is used to perform an automated query to multiple cybersecurity vendors when looking into a potential IOC's reputation.

This way, the analyst can save time during analysis, which can be crucial when time is of the essence, or before manually searching for it is becoming too much cumbersome.

./iocmatcher.py [-h] (--csv CSV | --json JSON) ioc

The scripts needs two components: a file (either CSV or JSON format) and the query itself (domain, hash or IP address). There are two example files for inputting the API keys needed for the script to work.

Example: ./iocmatcher.py --csv api_keys.csv google.com

Example of CSV file:

abuseipdb,aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
greynoise,bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
pulsedive,cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc
virustotal,dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd

Example of JSON file:

{
    "abuseipdb" : "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
    "greynoise" : "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
    "pulsedive" : "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
    "virustotal": "dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"
}