From 8e92708a8d928711f303c2175a122a3602538038 Mon Sep 17 00:00:00 2001
From: theycallmecharlie <38168227+theycallmecharlie@users.noreply.github.com>
Date: Wed, 18 Sep 2024 09:50:33 -0300
Subject: [PATCH] Abuse CH API

---
 .../Malware Bazaar/bazaar-parameters.xml         |  0
 .../{ => Abuse API}/Malware Bazaar/bazaar.xml    |  0
 .../Threat Fox/threatfox-parameters.xml          |  4 ++++
 .../Abuse API/Threat Fox/threatfox.xml           | 16 ++++++++++++++++
 4 files changed, 20 insertions(+)
 rename Community Developed/{ => Abuse API}/Malware Bazaar/bazaar-parameters.xml (100%)
 rename Community Developed/{ => Abuse API}/Malware Bazaar/bazaar.xml (100%)
 create mode 100644 Community Developed/Abuse API/Threat Fox/threatfox-parameters.xml
 create mode 100644 Community Developed/Abuse API/Threat Fox/threatfox.xml

diff --git a/Community Developed/Malware Bazaar/bazaar-parameters.xml b/Community Developed/Abuse API/Malware Bazaar/bazaar-parameters.xml
similarity index 100%
rename from Community Developed/Malware Bazaar/bazaar-parameters.xml
rename to Community Developed/Abuse API/Malware Bazaar/bazaar-parameters.xml
diff --git a/Community Developed/Malware Bazaar/bazaar.xml b/Community Developed/Abuse API/Malware Bazaar/bazaar.xml
similarity index 100%
rename from Community Developed/Malware Bazaar/bazaar.xml
rename to Community Developed/Abuse API/Malware Bazaar/bazaar.xml
diff --git a/Community Developed/Abuse API/Threat Fox/threatfox-parameters.xml b/Community Developed/Abuse API/Threat Fox/threatfox-parameters.xml
new file mode 100644
index 0000000..87c696e
--- /dev/null
+++ b/Community Developed/Abuse API/Threat Fox/threatfox-parameters.xml	
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="UTF-8" ?> 
+<WorkflowParameterValues xmlns="http://qradar.ibm.com/UniversalCloudRESTAPI/WorkflowParameterValues/V2">     
+<Value name="api_host" value="threatfox-api.abuse.ch/api/v1/" /> 
+</WorkflowParameterValues>
\ No newline at end of file
diff --git a/Community Developed/Abuse API/Threat Fox/threatfox.xml b/Community Developed/Abuse API/Threat Fox/threatfox.xml
new file mode 100644
index 0000000..ec9a81b
--- /dev/null
+++ b/Community Developed/Abuse API/Threat Fox/threatfox.xml	
@@ -0,0 +1,16 @@
+<Workflow name="Threat Fox" version="1.0" xmlns="http://qradar.ibm.com/UniversalCloudRESTAPI/Workflow/V2">
+    <Parameters>
+        <Parameter name="api_host" label="API Host" required="true"/>
+    </Parameters>
+    <Actions>
+        <CallEndpoint url="https://${/api_host}" method="POST" savePath="/response">
+            <RequestHeader name="Accept" value="application/json" />
+            <RequestBody type="application/json" encoding="UTF-8"> 
+               { "query": "get_iocs", "days": 1}
+        </RequestBody>
+        </CallEndpoint>
+        <ForEach item="/sample" items="/response/body/data">
+         <PostEvent path="/sample" source="threatfox"/>
+        </ForEach>
+</Actions>
+</Workflow>
\ No newline at end of file