howto_use_python_otx_api.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Using the OTX-Python-SDK"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## API Key Configuration"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "from OTXv2 import OTXv2, IndicatorTypes"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "from pandas.io.json import json_normalize"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "from datetime import datetime, timedelta"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "metadata": {
    "collapsed": false
   },
   "outputs": [],
   "source": [
    "#otx = OTXv2(\"56eeceea60fe1afb077026f0d228342a74707e64852ae7dd3cbee8439ff4d59c\")\n",
    "otx = OTXv2(\"a0709959938ef8b855136a06f118a716df327ae1109c4a6c35685c42e38be4ca\")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Replace YOUR_KEY with your OTX API key. You can find it on your settings page https://otx.alienvault.com/settings."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Subscriptions"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "The getall() method accesses your subscriptions.  It downloads all the OTX pulses and their assocciated indicators of compromise (IOCs) from your account. This includes:  \n",
    "- All pulses you subscribe to directly\n",
    "- All pulses by users you subscribe to\n",
    "- OTX pulses you created (including private pulses)\n",
    "If this is the first time you are using your account, the download includes all pulses created by AlienVault. All users are subscribed to the AlienVault user by default."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "pulses = otx.getall()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "metadata": {
    "collapsed": false
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "5"
      ]
     },
     "execution_count": 6,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "len(pulses)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "metadata": {
    "collapsed": false,
    "scrolled": true
   },
   "outputs": [
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "/var/folders/fn/f809r2_97k9cv7vfz0vgt_w00000gn/T/ipykernel_1775/633517224.py:1: FutureWarning: pandas.io.json.json_normalize is deprecated, use pandas.json_normalize instead.\n",
      "  json_normalize(pulses)[0:5]\n"
     ]
    },
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>id</th>\n",
       "      <th>name</th>\n",
       "      <th>description</th>\n",
       "      <th>author_name</th>\n",
       "      <th>modified</th>\n",
       "      <th>created</th>\n",
       "      <th>revision</th>\n",
       "      <th>tlp</th>\n",
       "      <th>public</th>\n",
       "      <th>adversary</th>\n",
       "      <th>indicators</th>\n",
       "      <th>tags</th>\n",
       "      <th>targeted_countries</th>\n",
       "      <th>malware_families</th>\n",
       "      <th>attack_ids</th>\n",
       "      <th>references</th>\n",
       "      <th>industries</th>\n",
       "      <th>extract_source</th>\n",
       "      <th>more_indicators</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>60ece5998a5b54a5ffe75cb4</td>\n",
       "      <td>SSH Brute-Force Honeypot Live</td>\n",
       "      <td>every host is banned for 3 hours and receives ...</td>\n",
       "      <td>pr0viehh</td>\n",
       "      <td>2024-03-31T20:31:20.973000</td>\n",
       "      <td>2021-07-13T01:00:09.665000</td>\n",
       "      <td>5</td>\n",
       "      <td>white</td>\n",
       "      <td>1</td>\n",
       "      <td></td>\n",
       "      <td>[{'id': 3659063371, 'indicator': '50.229.197.6...</td>\n",
       "      <td>[Bruteforce, Brute-Force, SSH, Honeypot]</td>\n",
       "      <td>[]</td>\n",
       "      <td>[]</td>\n",
       "      <td>[]</td>\n",
       "      <td>[]</td>\n",
       "      <td>[]</td>\n",
       "      <td>[]</td>\n",
       "      <td>False</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>5a64f74f0e543738c12bc973</td>\n",
       "      <td>Webscanners with Bad Requests - HTTP Status 40...</td>\n",
       "      <td>Webscanners who&amp;amp;amp;amp;#39;s requests res...</td>\n",
       "      <td>david3</td>\n",
       "      <td>2024-03-31T20:20:16.926000</td>\n",
       "      <td>2018-01-21T20:25:51.668000</td>\n",
       "      <td>4</td>\n",
       "      <td>white</td>\n",
       "      <td>1</td>\n",
       "      <td></td>\n",
       "      <td>[{'id': 3631657412, 'indicator': '5.161.117.81...</td>\n",
       "      <td>[webscanner, bruteforce, badrequest, probing, ...</td>\n",
       "      <td>[]</td>\n",
       "      <td>[]</td>\n",
       "      <td>[]</td>\n",
       "      <td>[]</td>\n",
       "      <td>[]</td>\n",
       "      <td>[]</td>\n",
       "      <td>False</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>6341d1aa0a02a3f6251ab540</td>\n",
       "      <td>Sinking Yachts Phishing Domains</td>\n",
       "      <td>Sinking Yachts is a Discord based anti-phishin...</td>\n",
       "      <td>__akac__</td>\n",
       "      <td>2024-03-31T19:40:30.790000</td>\n",
       "      <td>2022-10-08T19:38:18.341000</td>\n",
       "      <td>14410</td>\n",
       "      <td>white</td>\n",
       "      <td>1</td>\n",
       "      <td></td>\n",
       "      <td>[{'id': 3655847998, 'indicator': 'stearncomrnu...</td>\n",
       "      <td>[discord, roblox, steam, phishing]</td>\n",
       "      <td>[]</td>\n",
       "      <td>[]</td>\n",
       "      <td>[]</td>\n",
       "      <td>[]</td>\n",
       "      <td>[gaming]</td>\n",
       "      <td>[]</td>\n",
       "      <td>False</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>64a7c62dda0c66ad822272ec</td>\n",
       "      <td>IPy Notebook Test</td>\n",
       "      <td></td>\n",
       "      <td>pranavkr</td>\n",
       "      <td>2023-08-06T08:03:47.345000</td>\n",
       "      <td>2023-07-07T08:00:45.157000</td>\n",
       "      <td>1</td>\n",
       "      <td>green</td>\n",
       "      <td>0</td>\n",
       "      <td></td>\n",
       "      <td>[]</td>\n",
       "      <td>[]</td>\n",
       "      <td>[]</td>\n",
       "      <td>[]</td>\n",
       "      <td>[]</td>\n",
       "      <td>[]</td>\n",
       "      <td>[]</td>\n",
       "      <td>[]</td>\n",
       "      <td>False</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>64a53b9c7fc8616c4ff6024f</td>\n",
       "      <td>IPy Notebook Test</td>\n",
       "      <td></td>\n",
       "      <td>pranavkr</td>\n",
       "      <td>2023-08-04T09:00:46.665000</td>\n",
       "      <td>2023-07-05T09:45:00.687000</td>\n",
       "      <td>1</td>\n",
       "      <td>green</td>\n",
       "      <td>0</td>\n",
       "      <td></td>\n",
       "      <td>[]</td>\n",
       "      <td>[]</td>\n",
       "      <td>[]</td>\n",
       "      <td>[]</td>\n",
       "      <td>[]</td>\n",
       "      <td>[]</td>\n",
       "      <td>[]</td>\n",
       "      <td>[]</td>\n",
       "      <td>False</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "                         id  \\\n",
       "0  60ece5998a5b54a5ffe75cb4   \n",
       "1  5a64f74f0e543738c12bc973   \n",
       "2  6341d1aa0a02a3f6251ab540   \n",
       "3  64a7c62dda0c66ad822272ec   \n",
       "4  64a53b9c7fc8616c4ff6024f   \n",
       "\n",
       "                                                name  \\\n",
       "0                      SSH Brute-Force Honeypot Live   \n",
       "1  Webscanners with Bad Requests - HTTP Status 40...   \n",
       "2                    Sinking Yachts Phishing Domains   \n",
       "3                                  IPy Notebook Test   \n",
       "4                                  IPy Notebook Test   \n",
       "\n",
       "                                         description author_name  \\\n",
       "0  every host is banned for 3 hours and receives ...    pr0viehh   \n",
       "1  Webscanners who&amp;amp;amp;#39;s requests res...      david3   \n",
       "2  Sinking Yachts is a Discord based anti-phishin...    __akac__   \n",
       "3                                                       pranavkr   \n",
       "4                                                       pranavkr   \n",
       "\n",
       "                     modified                     created  revision    tlp  \\\n",
       "0  2024-03-31T20:31:20.973000  2021-07-13T01:00:09.665000         5  white   \n",
       "1  2024-03-31T20:20:16.926000  2018-01-21T20:25:51.668000         4  white   \n",
       "2  2024-03-31T19:40:30.790000  2022-10-08T19:38:18.341000     14410  white   \n",
       "3  2023-08-06T08:03:47.345000  2023-07-07T08:00:45.157000         1  green   \n",
       "4  2023-08-04T09:00:46.665000  2023-07-05T09:45:00.687000         1  green   \n",
       "\n",
       "   public adversary                                         indicators  \\\n",
       "0       1            [{'id': 3659063371, 'indicator': '50.229.197.6...   \n",
       "1       1            [{'id': 3631657412, 'indicator': '5.161.117.81...   \n",
       "2       1            [{'id': 3655847998, 'indicator': 'stearncomrnu...   \n",
       "3       0                                                           []   \n",
       "4       0                                                           []   \n",
       "\n",
       "                                                tags targeted_countries  \\\n",
       "0           [Bruteforce, Brute-Force, SSH, Honeypot]                 []   \n",
       "1  [webscanner, bruteforce, badrequest, probing, ...                 []   \n",
       "2                 [discord, roblox, steam, phishing]                 []   \n",
       "3                                                 []                 []   \n",
       "4                                                 []                 []   \n",
       "\n",
       "  malware_families attack_ids references industries extract_source  \\\n",
       "0               []         []         []         []             []   \n",
       "1               []         []         []         []             []   \n",
       "2               []         []         []   [gaming]             []   \n",
       "3               []         []         []         []             []   \n",
       "4               []         []         []         []             []   \n",
       "\n",
       "   more_indicators  \n",
       "0            False  \n",
       "1            False  \n",
       "2            False  \n",
       "3            False  \n",
       "4            False  "
      ]
     },
     "execution_count": 7,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "json_normalize(pulses)[0:5]"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": []
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "- author_name: The username of the OTX User that created the pulse\n",
    "- created: Date when the pulse was created in the system\n",
    "- description: Describes the pulse in terms of the type of threat it poses, and any other facts that may link it to other threat indicators.\n",
    "- id: Unique identifier of the pulse\n",
    "- indicators: Collection of Indicators Of Compromise \n",
    "- modified: Date when the pulse was last modified\n",
    "- name: Name of the pulse\n",
    "- references: List of references to papers, websites or blogs related to the threat described in the pulse\n",
    "- revision: Revision number that increments each time pulse contents change\n",
    "- tags: List of tags that provide information about pulse content, for example, Phshing, malware, C&C, and apt."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Let's explore the indicators object:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "metadata": {
    "collapsed": false,
    "scrolled": false
   },
   "outputs": [
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "/var/folders/fn/f809r2_97k9cv7vfz0vgt_w00000gn/T/ipykernel_1775/647023602.py:1: FutureWarning: pandas.io.json.json_normalize is deprecated, use pandas.json_normalize instead.\n",
      "  json_normalize(pulses[1][\"indicators\"])\n"
     ]
    },
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>id</th>\n",
       "      <th>indicator</th>\n",
       "      <th>type</th>\n",
       "      <th>created</th>\n",
       "      <th>content</th>\n",
       "      <th>title</th>\n",
       "      <th>description</th>\n",
       "      <th>expiration</th>\n",
       "      <th>is_active</th>\n",
       "      <th>role</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>3631657412</td>\n",
       "      <td>5.161.117.81</td>\n",
       "      <td>IPv4</td>\n",
       "      <td>2023-02-11T00:05:15</td>\n",
       "      <td></td>\n",
       "      <td>400 BAD REQUEST</td>\n",
       "      <td></td>\n",
       "      <td>2023-05-12T00:00:00</td>\n",
       "      <td>1</td>\n",
       "      <td>scanning_host</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>3366197086</td>\n",
       "      <td>167.94.138.46</td>\n",
       "      <td>IPv4</td>\n",
       "      <td>2023-02-11T00:10:08</td>\n",
       "      <td></td>\n",
       "      <td>400 BAD REQUEST</td>\n",
       "      <td></td>\n",
       "      <td>2023-05-12T00:00:00</td>\n",
       "      <td>1</td>\n",
       "      <td>scanning_host</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>3631724497</td>\n",
       "      <td>176.97.210.177</td>\n",
       "      <td>IPv4</td>\n",
       "      <td>2023-02-11T00:10:16</td>\n",
       "      <td></td>\n",
       "      <td>400 BAD REQUEST</td>\n",
       "      <td></td>\n",
       "      <td>2023-05-12T00:00:00</td>\n",
       "      <td>1</td>\n",
       "      <td>scanning_host</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>3631724497</td>\n",
       "      <td>176.97.210.177</td>\n",
       "      <td>IPv4</td>\n",
       "      <td>2023-02-11T00:15:09</td>\n",
       "      <td></td>\n",
       "      <td>400 BAD REQUEST</td>\n",
       "      <td></td>\n",
       "      <td>2023-05-12T00:00:00</td>\n",
       "      <td>1</td>\n",
       "      <td>scanning_host</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>3631755626</td>\n",
       "      <td>3.80.221.68</td>\n",
       "      <td>IPv4</td>\n",
       "      <td>2023-02-11T00:15:17</td>\n",
       "      <td></td>\n",
       "      <td>400 BAD REQUEST</td>\n",
       "      <td></td>\n",
       "      <td>2023-05-12T00:00:00</td>\n",
       "      <td>1</td>\n",
       "      <td>scanning_host</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>...</th>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>29999</th>\n",
       "      <td>2279830927</td>\n",
       "      <td>192.241.230.46</td>\n",
       "      <td>IPv4</td>\n",
       "      <td>2024-03-31T19:50:07</td>\n",
       "      <td></td>\n",
       "      <td>400 BAD REQUEST</td>\n",
       "      <td></td>\n",
       "      <td>2024-06-29T00:00:00</td>\n",
       "      <td>1</td>\n",
       "      <td>scanning_host</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>30000</th>\n",
       "      <td>3548007530</td>\n",
       "      <td>172.104.11.51</td>\n",
       "      <td>IPv4</td>\n",
       "      <td>2024-03-31T20:00:15</td>\n",
       "      <td></td>\n",
       "      <td>400 BAD REQUEST</td>\n",
       "      <td></td>\n",
       "      <td>2024-06-29T00:00:00</td>\n",
       "      <td>1</td>\n",
       "      <td>scanning_host</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>30001</th>\n",
       "      <td>3854241386</td>\n",
       "      <td>166.88.141.168</td>\n",
       "      <td>IPv4</td>\n",
       "      <td>2024-03-31T20:00:17</td>\n",
       "      <td></td>\n",
       "      <td>400 BAD REQUEST</td>\n",
       "      <td></td>\n",
       "      <td>2024-06-29T00:00:00</td>\n",
       "      <td>1</td>\n",
       "      <td>scanning_host</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>30002</th>\n",
       "      <td>3422948472</td>\n",
       "      <td>205.210.31.17</td>\n",
       "      <td>IPv4</td>\n",
       "      <td>2024-03-31T20:10:06</td>\n",
       "      <td></td>\n",
       "      <td>400 BAD REQUEST</td>\n",
       "      <td></td>\n",
       "      <td>2024-06-29T00:00:00</td>\n",
       "      <td>1</td>\n",
       "      <td>scanning_host</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>30003</th>\n",
       "      <td>3603117133</td>\n",
       "      <td>107.170.248.15</td>\n",
       "      <td>IPv4</td>\n",
       "      <td>2024-03-31T20:20:17</td>\n",
       "      <td></td>\n",
       "      <td>400 BAD REQUEST</td>\n",
       "      <td></td>\n",
       "      <td>2024-06-29T00:00:00</td>\n",
       "      <td>1</td>\n",
       "      <td>scanning_host</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>30004 rows × 10 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "               id       indicator  type              created content  \\\n",
       "0      3631657412    5.161.117.81  IPv4  2023-02-11T00:05:15           \n",
       "1      3366197086   167.94.138.46  IPv4  2023-02-11T00:10:08           \n",
       "2      3631724497  176.97.210.177  IPv4  2023-02-11T00:10:16           \n",
       "3      3631724497  176.97.210.177  IPv4  2023-02-11T00:15:09           \n",
       "4      3631755626     3.80.221.68  IPv4  2023-02-11T00:15:17           \n",
       "...           ...             ...   ...                  ...     ...   \n",
       "29999  2279830927  192.241.230.46  IPv4  2024-03-31T19:50:07           \n",
       "30000  3548007530   172.104.11.51  IPv4  2024-03-31T20:00:15           \n",
       "30001  3854241386  166.88.141.168  IPv4  2024-03-31T20:00:17           \n",
       "30002  3422948472   205.210.31.17  IPv4  2024-03-31T20:10:06           \n",
       "30003  3603117133  107.170.248.15  IPv4  2024-03-31T20:20:17           \n",
       "\n",
       "                 title description           expiration  is_active  \\\n",
       "0      400 BAD REQUEST              2023-05-12T00:00:00          1   \n",
       "1      400 BAD REQUEST              2023-05-12T00:00:00          1   \n",
       "2      400 BAD REQUEST              2023-05-12T00:00:00          1   \n",
       "3      400 BAD REQUEST              2023-05-12T00:00:00          1   \n",
       "4      400 BAD REQUEST              2023-05-12T00:00:00          1   \n",
       "...                ...         ...                  ...        ...   \n",
       "29999  400 BAD REQUEST              2024-06-29T00:00:00          1   \n",
       "30000  400 BAD REQUEST              2024-06-29T00:00:00          1   \n",
       "30001  400 BAD REQUEST              2024-06-29T00:00:00          1   \n",
       "30002  400 BAD REQUEST              2024-06-29T00:00:00          1   \n",
       "30003  400 BAD REQUEST              2024-06-29T00:00:00          1   \n",
       "\n",
       "                role  \n",
       "0      scanning_host  \n",
       "1      scanning_host  \n",
       "2      scanning_host  \n",
       "3      scanning_host  \n",
       "4      scanning_host  \n",
       "...              ...  \n",
       "29999  scanning_host  \n",
       "30000  scanning_host  \n",
       "30001  scanning_host  \n",
       "30002  scanning_host  \n",
       "30003  scanning_host  \n",
       "\n",
       "[30004 rows x 10 columns]"
      ]
     },
     "execution_count": 8,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "json_normalize(pulses[1][\"indicators\"])"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "- _id: Unique identifier of the IOC\n",
    "- created: Date IOC was added to the pulse\n",
    "- description: Describe the Indicator Of Compromise\n",
    "- indicator: The IOC\n",
    "- indicator_type: Type of indicator\n",
    "\n",
    "The following Indicator Types are supported (also defined in IndicatorTypes.py):"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "indicator_types = [\n",
    "\t\t\t{\n",
    "\t\t\t    \"name\": \"IPv4\", \n",
    "\t\t\t    \"description\": \"An IPv4 address indicating the online location of a server or other computer.\"\n",
    "\t\t\t}, \n",
    "\t\t\t{\n",
    "\t\t\t    \"name\": \"IPv6\", \n",
    "\t\t\t    \"description\": \"An IPv6 address indicating the online location of a server or other computer.\"\n",
    "\t\t\t}, \n",
    "\t\t\t{\n",
    "\t\t\t    \"name\": \"domain\", \n",
    "\t\t\t    \"description\": \"A domain name for a website or server. Domains encompass a series of hostnames.\"\n",
    "\t\t\t}, \n",
    "\t\t\t{\n",
    "\t\t\t    \"name\": \"hostname\", \n",
    "\t\t\t    \"description\": \"The hostname for a server located within a domain.\"\n",
    "\t\t\t}, \n",
    "\t\t\t{\n",
    "\t\t\t     \n",
    "\t\t\t    \"name\": \"email\", \n",
    "\t\t\t    \"description\": \"An email associated with suspicious activity.\"\n",
    "\t\t\t}, \n",
    "\t\t\t{\n",
    "\t\t\t    \"name\": \"URL\", \n",
    "\t\t\t    \"description\": \" Uniform Resource Location (URL) summarizing the online location of a file or resource.\"\n",
    "\t\t\t}, \n",
    "\t\t\t{\n",
    "\t\t\t     \n",
    "\t\t\t    \"name\": \"URI\", \n",
    "\t\t\t    \"description\": \"Uniform Resource Indicator (URI) describing the explicit path to a file hosted online.\"\n",
    "\t\t\t}, \n",
    "\t\t\t{\n",
    "\t\t\t    \"name\": \"FileHash-MD5\", \n",
    "\t\t\t    \"description\": \"A MD5-format hash that summarizes the architecture and content of a file.\"\n",
    "\t\t\t}, \n",
    "\t\t\t{\n",
    "\t\t\t    \"name\": \"FileHash-SHA1\", \n",
    "\t\t\t    \"description\": \"A SHA-format hash that summarizes the architecture and content of a file.\"\n",
    "\t\t\t}, \n",
    "\t\t\t{\n",
    "\t\t\t    \"name\": \"FileHash-SHA256\", \n",
    "\t\t\t    \"description\": \"A SHA-256-format hash that summarizes the architecture and content of a file.\"\n",
    "\t\t\t}, \n",
    "\t\t\t{\n",
    "\t\t\t     \n",
    "\t\t\t    \"name\": \"FileHash-PEHASH\", \n",
    "\t\t\t    \"description\": \"A PEPHASH-format hash that summarizes the architecture and content of a file.\"\n",
    "\t\t\t}, \n",
    "\t\t\t{\n",
    "\t\t\t     \n",
    "\t\t\t    \"name\": \"FileHash-IMPHASH\", \n",
    "\t\t\t    \"description\": \"An IMPHASH-format hash that summarizes the architecture and content of a file.\"\n",
    "\t\t\t}, \n",
    "\t\t\t{\n",
    "\t\t\t    \"name\": \"CIDR\", \n",
    "\t\t\t    \"description\": \"Classless Inter-Domain Routing (CIDR) address, which describes both a server's IP address and the network architecture (routing path) surrounding that server.\"\n",
    "\t\t\t}, \n",
    "\t\t\t{\n",
    "\t\t\t     \n",
    "\t\t\t    \"name\": \"FilePath\", \n",
    "\t\t\t    \"description\": \"A unique location in a file system.\"\n",
    "\t\t\t}, \n",
    "\t\t\t{\n",
    "\t\t\t     \n",
    "\t\t\t    \"name\": \"Mutex\", \n",
    "\t\t\t    \"description\": \"The name of a mutex resource describing the execution architecture of a file.\"\n",
    "\t\t\t}, \n",
    "\t\t\t{\n",
    "\t\t\t    \"name\": \"CVE\", \n",
    "\t\t\t    \"description\": \"Common Vulnerability and Exposure (CVE) entry describing a software vulnerability that can be exploited to engage in malicious activity.\"\n",
    "\t\t\t}]"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "metadata": {
    "collapsed": false,
    "scrolled": true
   },
   "outputs": [
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "/var/folders/fn/f809r2_97k9cv7vfz0vgt_w00000gn/T/ipykernel_1775/3949440694.py:1: FutureWarning: pandas.io.json.json_normalize is deprecated, use pandas.json_normalize instead.\n",
      "  json_normalize(indicator_types)\n"
     ]
    },
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>name</th>\n",
       "      <th>description</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>IPv4</td>\n",
       "      <td>An IPv4 address indicating the online location...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>IPv6</td>\n",
       "      <td>An IPv6 address indicating the online location...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>domain</td>\n",
       "      <td>A domain name for a website or server. Domains...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>hostname</td>\n",
       "      <td>The hostname for a server located within a dom...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>email</td>\n",
       "      <td>An email associated with suspicious activity.</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>5</th>\n",
       "      <td>URL</td>\n",
       "      <td>Uniform Resource Location (URL) summarizing t...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>6</th>\n",
       "      <td>URI</td>\n",
       "      <td>Uniform Resource Indicator (URI) describing th...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>7</th>\n",
       "      <td>FileHash-MD5</td>\n",
       "      <td>A MD5-format hash that summarizes the architec...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>8</th>\n",
       "      <td>FileHash-SHA1</td>\n",
       "      <td>A SHA-format hash that summarizes the architec...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>9</th>\n",
       "      <td>FileHash-SHA256</td>\n",
       "      <td>A SHA-256-format hash that summarizes the arch...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>10</th>\n",
       "      <td>FileHash-PEHASH</td>\n",
       "      <td>A PEPHASH-format hash that summarizes the arch...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>11</th>\n",
       "      <td>FileHash-IMPHASH</td>\n",
       "      <td>An IMPHASH-format hash that summarizes the arc...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>12</th>\n",
       "      <td>CIDR</td>\n",
       "      <td>Classless Inter-Domain Routing (CIDR) address,...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>13</th>\n",
       "      <td>FilePath</td>\n",
       "      <td>A unique location in a file system.</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>14</th>\n",
       "      <td>Mutex</td>\n",
       "      <td>The name of a mutex resource describing the ex...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>15</th>\n",
       "      <td>CVE</td>\n",
       "      <td>Common Vulnerability and Exposure (CVE) entry ...</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "                name                                        description\n",
       "0               IPv4  An IPv4 address indicating the online location...\n",
       "1               IPv6  An IPv6 address indicating the online location...\n",
       "2             domain  A domain name for a website or server. Domains...\n",
       "3           hostname  The hostname for a server located within a dom...\n",
       "4              email      An email associated with suspicious activity.\n",
       "5                URL   Uniform Resource Location (URL) summarizing t...\n",
       "6                URI  Uniform Resource Indicator (URI) describing th...\n",
       "7       FileHash-MD5  A MD5-format hash that summarizes the architec...\n",
       "8      FileHash-SHA1  A SHA-format hash that summarizes the architec...\n",
       "9    FileHash-SHA256  A SHA-256-format hash that summarizes the arch...\n",
       "10   FileHash-PEHASH  A PEPHASH-format hash that summarizes the arch...\n",
       "11  FileHash-IMPHASH  An IMPHASH-format hash that summarizes the arc...\n",
       "12              CIDR  Classless Inter-Domain Routing (CIDR) address,...\n",
       "13          FilePath                A unique location in a file system.\n",
       "14             Mutex  The name of a mutex resource describing the ex...\n",
       "15               CVE  Common Vulnerability and Exposure (CVE) entry ..."
      ]
     },
     "execution_count": 10,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "json_normalize(indicator_types)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "mtime = (datetime.now() - timedelta(days=1)).isoformat()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 12,
   "metadata": {
    "collapsed": false
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "'2024-03-31T02:03:15.307354'"
      ]
     },
     "execution_count": 12,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "mtime"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Events"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Besides receiving the pulse information, there is another function that can retrieve different events that are ocurring in the OTX system and affect your account."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 13,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "events = otx.getevents_since(mtime)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 14,
   "metadata": {
    "collapsed": false
   },
   "outputs": [
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "/var/folders/fn/f809r2_97k9cv7vfz0vgt_w00000gn/T/ipykernel_1775/1230498797.py:1: FutureWarning: pandas.io.json.json_normalize is deprecated, use pandas.json_normalize instead.\n",
      "  json_normalize(events)\n"
     ]
    },
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "Empty DataFrame\n",
       "Columns: []\n",
       "Index: []"
      ]
     },
     "execution_count": 14,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "json_normalize(events)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "- id: object id of this event.  Unique reference identifier\n",
    "- action : \"[subscribe | unsubscribe | delete]\", Currently supports subscribe / unsubscribe events for users and pulses and delete events for pulses\n",
    "- object_type : \"[pulse | user]\", // Currently supports events for pulse and user objects\n",
    "- object_id : \"[pulse id | author id]\", // Unique id can be used to lookup pulses and users (e.g. to remove them from  system, they would remove all pulses by author_id or an individual pulse by pulse \"id\".\n",
    "\"created\" : <timestamp of event>"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "When developing an application, you must decide how you want to handle different types of events. For instance, if one OTX user unsubscribes from another user, do you want to delete the IOCs the second user contributed from your application? How do you plan to reconcile the data on the server versus the data in your application?\n",
    "The same question comes up when users delete a pulse."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Using Search and get Pulse by ID"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "The OTX API allows you to search for pulses and users by keyword.  This allows you to obtain pulses that you're not (yet) subscribed to."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 15,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "pulses = otx.search_pulses(\"Russian\")"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 16,
   "metadata": {
    "collapsed": false
   },
   "outputs": [
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "/var/folders/fn/f809r2_97k9cv7vfz0vgt_w00000gn/T/ipykernel_1775/1567407658.py:1: FutureWarning: pandas.io.json.json_normalize is deprecated, use pandas.json_normalize instead.\n",
      "  json_normalize(pulses[\"results\"])\n"
     ]
    },
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>id</th>\n",
       "      <th>name</th>\n",
       "      <th>description</th>\n",
       "      <th>author_name</th>\n",
       "      <th>modified</th>\n",
       "      <th>created</th>\n",
       "      <th>tags</th>\n",
       "      <th>references</th>\n",
       "      <th>public</th>\n",
       "      <th>adversary</th>\n",
       "      <th>...</th>\n",
       "      <th>TLP</th>\n",
       "      <th>revision</th>\n",
       "      <th>groups</th>\n",
       "      <th>in_group</th>\n",
       "      <th>is_subscribing</th>\n",
       "      <th>author.username</th>\n",
       "      <th>author.id</th>\n",
       "      <th>author.avatar_url</th>\n",
       "      <th>author.is_subscribed</th>\n",
       "      <th>author.is_following</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>5528132f13432a2102724d34</td>\n",
       "      <td>Potential TV5 Monde intrusion indicators</td>\n",
       "      <td>TV5Monde was taken off air in April 2015. A gr...</td>\n",
       "      <td>AlienVault</td>\n",
       "      <td>2019-01-25T15:20:10.359000</td>\n",
       "      <td>2015-04-10T18:15:11.492000</td>\n",
       "      <td>[]</td>\n",
       "      <td>[]</td>\n",
       "      <td>1</td>\n",
       "      <td>Sofacy</td>\n",
       "      <td>...</td>\n",
       "      <td>green</td>\n",
       "      <td>11</td>\n",
       "      <td>[]</td>\n",
       "      <td>False</td>\n",
       "      <td>None</td>\n",
       "      <td>AlienVault</td>\n",
       "      <td>2</td>\n",
       "      <td>/otxapi/users/avatar_image/media/avatars/user_...</td>\n",
       "      <td>False</td>\n",
       "      <td>False</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>55346adeb45ff536ca3ffd2c</td>\n",
       "      <td>Operation RussianDoll</td>\n",
       "      <td>FireEye Labs recently detected a limited APT c...</td>\n",
       "      <td>AlienVault</td>\n",
       "      <td>2017-08-24T10:45:07.905000</td>\n",
       "      <td>2015-04-20T02:56:30.505000</td>\n",
       "      <td>[]</td>\n",
       "      <td>[]</td>\n",
       "      <td>1</td>\n",
       "      <td>Sofacy</td>\n",
       "      <td>...</td>\n",
       "      <td>green</td>\n",
       "      <td>3</td>\n",
       "      <td>[]</td>\n",
       "      <td>False</td>\n",
       "      <td>None</td>\n",
       "      <td>AlienVault</td>\n",
       "      <td>2</td>\n",
       "      <td>/otxapi/users/avatar_image/media/avatars/user_...</td>\n",
       "      <td>False</td>\n",
       "      <td>False</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>553583b5b45ff501cdc579aa</td>\n",
       "      <td>Operation Buhtrap</td>\n",
       "      <td>Operation Buhtrap - The trap for Russian accou...</td>\n",
       "      <td>tomdaq</td>\n",
       "      <td>2015-04-20T22:54:45.662000</td>\n",
       "      <td>2015-04-20T22:54:45.662000</td>\n",
       "      <td>[]</td>\n",
       "      <td>[]</td>\n",
       "      <td>1</td>\n",
       "      <td>None</td>\n",
       "      <td>...</td>\n",
       "      <td>green</td>\n",
       "      <td>1</td>\n",
       "      <td>[]</td>\n",
       "      <td>False</td>\n",
       "      <td>None</td>\n",
       "      <td>tomdaq</td>\n",
       "      <td>49</td>\n",
       "      <td>https://otx.alienvault.com/assets/images/defau...</td>\n",
       "      <td>False</td>\n",
       "      <td>False</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>5541029cb45ff5029b148b7f</td>\n",
       "      <td>Operation Armageddon</td>\n",
       "      <td>“Operation Armageddon,” active since at least ...</td>\n",
       "      <td>AlienVault</td>\n",
       "      <td>2017-03-12T01:33:45.089000</td>\n",
       "      <td>2015-04-29T16:11:08.251000</td>\n",
       "      <td>[]</td>\n",
       "      <td>[]</td>\n",
       "      <td>1</td>\n",
       "      <td>Gamaredon Group</td>\n",
       "      <td>...</td>\n",
       "      <td>green</td>\n",
       "      <td>7</td>\n",
       "      <td>[]</td>\n",
       "      <td>False</td>\n",
       "      <td>None</td>\n",
       "      <td>AlienVault</td>\n",
       "      <td>2</td>\n",
       "      <td>/otxapi/users/avatar_image/media/avatars/user_...</td>\n",
       "      <td>False</td>\n",
       "      <td>False</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>558d85f0b45ff55ccb25e6f4</td>\n",
       "      <td>Digital Attack on German Parliament</td>\n",
       "      <td>Servers of The Left in German Bundestag have b...</td>\n",
       "      <td>AlienVault</td>\n",
       "      <td>2017-07-24T12:00:41.708000</td>\n",
       "      <td>2015-06-26T17:03:44.800000</td>\n",
       "      <td>[]</td>\n",
       "      <td>[]</td>\n",
       "      <td>1</td>\n",
       "      <td>Sofacy</td>\n",
       "      <td>...</td>\n",
       "      <td>green</td>\n",
       "      <td>5</td>\n",
       "      <td>[]</td>\n",
       "      <td>False</td>\n",
       "      <td>None</td>\n",
       "      <td>AlienVault</td>\n",
       "      <td>2</td>\n",
       "      <td>/otxapi/users/avatar_image/media/avatars/user_...</td>\n",
       "      <td>False</td>\n",
       "      <td>False</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>5</th>\n",
       "      <td>55a7cbb7b45ff51f5c94e6a2</td>\n",
       "      <td>Microsoft Office Zero-Day CVE-2015-2424 Levera...</td>\n",
       "      <td>Yesterday, Microsoft patched CVE-2015-2424, a ...</td>\n",
       "      <td>AlienVault</td>\n",
       "      <td>2019-10-24T16:03:41.314000</td>\n",
       "      <td>2015-07-16T15:20:23.492000</td>\n",
       "      <td>[]</td>\n",
       "      <td>[]</td>\n",
       "      <td>1</td>\n",
       "      <td>None</td>\n",
       "      <td>...</td>\n",
       "      <td>green</td>\n",
       "      <td>1</td>\n",
       "      <td>[]</td>\n",
       "      <td>False</td>\n",
       "      <td>None</td>\n",
       "      <td>AlienVault</td>\n",
       "      <td>2</td>\n",
       "      <td>/otxapi/users/avatar_image/media/avatars/user_...</td>\n",
       "      <td>False</td>\n",
       "      <td>False</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>6</th>\n",
       "      <td>55dfc30067db8c7bb8cb9865</td>\n",
       "      <td>New Spear Phishing Campaign Pretends to be EFF</td>\n",
       "      <td>Google's security team recently identified a n...</td>\n",
       "      <td>AlienVault</td>\n",
       "      <td>2015-08-28T02:10:08.167000</td>\n",
       "      <td>2015-08-28T02:10:08.167000</td>\n",
       "      <td>[]</td>\n",
       "      <td>[]</td>\n",
       "      <td>1</td>\n",
       "      <td>None</td>\n",
       "      <td>...</td>\n",
       "      <td>green</td>\n",
       "      <td>1</td>\n",
       "      <td>[]</td>\n",
       "      <td>False</td>\n",
       "      <td>None</td>\n",
       "      <td>AlienVault</td>\n",
       "      <td>2</td>\n",
       "      <td>/otxapi/users/avatar_image/media/avatars/user_...</td>\n",
       "      <td>False</td>\n",
       "      <td>False</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>7</th>\n",
       "      <td>55fae83567db8c6fb3518bcd</td>\n",
       "      <td>THE DUKES: 7 years of Russian cyberespionage</td>\n",
       "      <td>The Dukes are a well-resourced, highly dedicat...</td>\n",
       "      <td>AlienVault</td>\n",
       "      <td>2017-03-06T17:17:18.888000</td>\n",
       "      <td>2015-09-17T16:20:05.303000</td>\n",
       "      <td>[]</td>\n",
       "      <td>[]</td>\n",
       "      <td>1</td>\n",
       "      <td>APT 29</td>\n",
       "      <td>...</td>\n",
       "      <td>green</td>\n",
       "      <td>2</td>\n",
       "      <td>[]</td>\n",
       "      <td>False</td>\n",
       "      <td>None</td>\n",
       "      <td>AlienVault</td>\n",
       "      <td>2</td>\n",
       "      <td>/otxapi/users/avatar_image/media/avatars/user_...</td>\n",
       "      <td>False</td>\n",
       "      <td>False</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>8</th>\n",
       "      <td>55faf3014637f26df8745a74</td>\n",
       "      <td>Targeted Attack Distributes PlugX in Russia</td>\n",
       "      <td>Proofpoint researchers recently observed a cam...</td>\n",
       "      <td>AlienVault</td>\n",
       "      <td>2015-09-17T17:06:09.914000</td>\n",
       "      <td>2015-09-17T17:06:09.914000</td>\n",
       "      <td>[]</td>\n",
       "      <td>[]</td>\n",
       "      <td>1</td>\n",
       "      <td>None</td>\n",
       "      <td>...</td>\n",
       "      <td>green</td>\n",
       "      <td>1</td>\n",
       "      <td>[]</td>\n",
       "      <td>False</td>\n",
       "      <td>None</td>\n",
       "      <td>AlienVault</td>\n",
       "      <td>2</td>\n",
       "      <td>/otxapi/users/avatar_image/media/avatars/user_...</td>\n",
       "      <td>False</td>\n",
       "      <td>False</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>9</th>\n",
       "      <td>565301b84637f2388ab004ca</td>\n",
       "      <td>Phishing site running suspicious scripts</td>\n",
       "      <td>Found phishing sites using the same format of ...</td>\n",
       "      <td>muscothym</td>\n",
       "      <td>2015-11-23T12:16:53.725000</td>\n",
       "      <td>2015-11-23T12:08:24.397000</td>\n",
       "      <td>[]</td>\n",
       "      <td>[]</td>\n",
       "      <td>1</td>\n",
       "      <td>None</td>\n",
       "      <td>...</td>\n",
       "      <td>green</td>\n",
       "      <td>10</td>\n",
       "      <td>[]</td>\n",
       "      <td>False</td>\n",
       "      <td>None</td>\n",
       "      <td>muscothym</td>\n",
       "      <td>6895</td>\n",
       "      <td>/otxapi/users/avatar_image/media/avatars/musco...</td>\n",
       "      <td>False</td>\n",
       "      <td>False</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>10</th>\n",
       "      <td>5671b0604637f25637cffe86</td>\n",
       "      <td>Scanning Host - DNS query amplification attemp...</td>\n",
       "      <td>Intense DNS query amplification attempt from R...</td>\n",
       "      <td>renan.lopes</td>\n",
       "      <td>2015-12-16T18:41:36.827000</td>\n",
       "      <td>2015-12-16T18:41:36.827000</td>\n",
       "      <td>[]</td>\n",
       "      <td>[]</td>\n",
       "      <td>1</td>\n",
       "      <td>None</td>\n",
       "      <td>...</td>\n",
       "      <td>green</td>\n",
       "      <td>1</td>\n",
       "      <td>[]</td>\n",
       "      <td>False</td>\n",
       "      <td>None</td>\n",
       "      <td>renan.lopes</td>\n",
       "      <td>5557</td>\n",
       "      <td>/otxapi/users/avatar_image/media/avatars/renan...</td>\n",
       "      <td>False</td>\n",
       "      <td>False</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>11</th>\n",
       "      <td>56747dfa4637f25637d08132</td>\n",
       "      <td>ZBot Malware</td>\n",
       "      <td>The Trojans designed to steal money from bank ...</td>\n",
       "      <td>AlienVault</td>\n",
       "      <td>2019-05-16T15:31:22.466000</td>\n",
       "      <td>2015-12-18T21:43:22.913000</td>\n",
       "      <td>[]</td>\n",
       "      <td>[]</td>\n",
       "      <td>1</td>\n",
       "      <td>None</td>\n",
       "      <td>...</td>\n",
       "      <td>green</td>\n",
       "      <td>2</td>\n",
       "      <td>[]</td>\n",
       "      <td>False</td>\n",
       "      <td>None</td>\n",
       "      <td>AlienVault</td>\n",
       "      <td>2</td>\n",
       "      <td>/otxapi/users/avatar_image/media/avatars/user_...</td>\n",
       "      <td>False</td>\n",
       "      <td>False</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>12</th>\n",
       "      <td>567a9bf967db8c417529da86</td>\n",
       "      <td>BBSRAT Attacks Targeting Russian Orgs Linked t...</td>\n",
       "      <td>In late 2014, ESET presented an attack campaig...</td>\n",
       "      <td>brandongwalters@eaton.com</td>\n",
       "      <td>2015-12-23T13:04:57.822000</td>\n",
       "      <td>2015-12-23T13:04:57.822000</td>\n",
       "      <td>[]</td>\n",
       "      <td>[]</td>\n",
       "      <td>1</td>\n",
       "      <td>None</td>\n",
       "      <td>...</td>\n",
       "      <td>green</td>\n",
       "      <td>1</td>\n",
       "      <td>[]</td>\n",
       "      <td>False</td>\n",
       "      <td>None</td>\n",
       "      <td>brandongwalters@eaton.com</td>\n",
       "      <td>5792</td>\n",
       "      <td>/otxapi/users/avatar_image/media/avatars/brand...</td>\n",
       "      <td>False</td>\n",
       "      <td>False</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>13</th>\n",
       "      <td>567af83c4637f21e1c24d4ba</td>\n",
       "      <td>BBSRAT Attacks Targeting Russian Organizations</td>\n",
       "      <td>In late 2014, ESET presented an attack campaig...</td>\n",
       "      <td>AlienVault</td>\n",
       "      <td>2017-07-22T10:17:47.604000</td>\n",
       "      <td>2015-12-23T19:38:36.636000</td>\n",
       "      <td>[]</td>\n",
       "      <td>[]</td>\n",
       "      <td>1</td>\n",
       "      <td>Roaming Tiger</td>\n",
       "      <td>...</td>\n",
       "      <td>green</td>\n",
       "      <td>2</td>\n",
       "      <td>[]</td>\n",
       "      <td>False</td>\n",
       "      <td>None</td>\n",
       "      <td>AlienVault</td>\n",
       "      <td>2</td>\n",
       "      <td>/otxapi/users/avatar_image/media/avatars/user_...</td>\n",
       "      <td>False</td>\n",
       "      <td>False</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>14</th>\n",
       "      <td>568b2cef4637f2624bcdbf2c</td>\n",
       "      <td>Spam: New Year, New Russian Girlfriend!</td>\n",
       "      <td>Fake Russian girlfriend-themed spam campaign</td>\n",
       "      <td>rpsanch</td>\n",
       "      <td>2016-01-05T02:39:43.063000</td>\n",
       "      <td>2016-01-05T02:39:43.063000</td>\n",
       "      <td>[]</td>\n",
       "      <td>[]</td>\n",
       "      <td>1</td>\n",
       "      <td>None</td>\n",
       "      <td>...</td>\n",
       "      <td>green</td>\n",
       "      <td>1</td>\n",
       "      <td>[]</td>\n",
       "      <td>False</td>\n",
       "      <td>None</td>\n",
       "      <td>rpsanch</td>\n",
       "      <td>7584</td>\n",
       "      <td>https://otx.alienvault.com/assets/images/defau...</td>\n",
       "      <td>False</td>\n",
       "      <td>False</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>15</th>\n",
       "      <td>569ac29767db8c057c6fdcc8</td>\n",
       "      <td>BlackEnergy Malware</td>\n",
       "      <td>These attacks are active and ongoing as of ear...</td>\n",
       "      <td>liveck@pta.center</td>\n",
       "      <td>2016-01-16T22:23:29.872000</td>\n",
       "      <td>2016-01-16T22:22:15.592000</td>\n",
       "      <td>[]</td>\n",
       "      <td>[]</td>\n",
       "      <td>1</td>\n",
       "      <td>None</td>\n",
       "      <td>...</td>\n",
       "      <td>green</td>\n",
       "      <td>2</td>\n",
       "      <td>[]</td>\n",
       "      <td>False</td>\n",
       "      <td>None</td>\n",
       "      <td>liveck@pta.center</td>\n",
       "      <td>7748</td>\n",
       "      <td>https://otx.alienvault.com/assets/images/defau...</td>\n",
       "      <td>False</td>\n",
       "      <td>False</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>16</th>\n",
       "      <td>569d38d74637f2624bcddaa8</td>\n",
       "      <td>Malicious Code Analysis on Ukraine's Power Gri...</td>\n",
       "      <td>At the end of December 2015, the network syste...</td>\n",
       "      <td>AlienVault</td>\n",
       "      <td>2016-01-18T19:11:19.403000</td>\n",
       "      <td>2016-01-18T19:11:19.403000</td>\n",
       "      <td>[]</td>\n",
       "      <td>[]</td>\n",
       "      <td>1</td>\n",
       "      <td>None</td>\n",
       "      <td>...</td>\n",
       "      <td>green</td>\n",
       "      <td>1</td>\n",
       "      <td>[]</td>\n",
       "      <td>False</td>\n",
       "      <td>None</td>\n",
       "      <td>AlienVault</td>\n",
       "      <td>2</td>\n",
       "      <td>/otxapi/users/avatar_image/media/avatars/user_...</td>\n",
       "      <td>False</td>\n",
       "      <td>False</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>17</th>\n",
       "      <td>56cb95eb67db8c5860d245d2</td>\n",
       "      <td>Russian bank employees got fake job offers in ...</td>\n",
       "      <td>Employees at six Russian banks were sent spoof...</td>\n",
       "      <td>AlienVault</td>\n",
       "      <td>2016-02-22T23:12:43.852000</td>\n",
       "      <td>2016-02-22T23:12:43.852000</td>\n",
       "      <td>[]</td>\n",
       "      <td>[]</td>\n",
       "      <td>1</td>\n",
       "      <td>None</td>\n",
       "      <td>...</td>\n",
       "      <td>green</td>\n",
       "      <td>1</td>\n",
       "      <td>[]</td>\n",
       "      <td>False</td>\n",
       "      <td>None</td>\n",
       "      <td>AlienVault</td>\n",
       "      <td>2</td>\n",
       "      <td>/otxapi/users/avatar_image/media/avatars/user_...</td>\n",
       "      <td>False</td>\n",
       "      <td>False</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>18</th>\n",
       "      <td>56d0a04667db8c48093080b7</td>\n",
       "      <td>20160203-BlackEnergy by maldoc,Malware</td>\n",
       "      <td>Black Energy is a malware that was believed to...</td>\n",
       "      <td>rpsanch</td>\n",
       "      <td>2016-02-26T18:58:14.597000</td>\n",
       "      <td>2016-02-26T18:58:14.597000</td>\n",
       "      <td>[]</td>\n",
       "      <td>[]</td>\n",
       "      <td>1</td>\n",
       "      <td>None</td>\n",
       "      <td>...</td>\n",
       "      <td>green</td>\n",
       "      <td>1</td>\n",
       "      <td>[]</td>\n",
       "      <td>False</td>\n",
       "      <td>None</td>\n",
       "      <td>rpsanch</td>\n",
       "      <td>7584</td>\n",
       "      <td>https://otx.alienvault.com/assets/images/defau...</td>\n",
       "      <td>False</td>\n",
       "      <td>False</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>19</th>\n",
       "      <td>56d0a89467db8c4809308123</td>\n",
       "      <td>20160204: CVE-2014-4114 Sandworm is not a WORM</td>\n",
       "      <td>Cyphort labs team found that the exploit paylo...</td>\n",
       "      <td>rpsanch</td>\n",
       "      <td>2016-02-26T19:33:40.006000</td>\n",
       "      <td>2016-02-26T19:33:40.006000</td>\n",
       "      <td>[]</td>\n",
       "      <td>[]</td>\n",
       "      <td>1</td>\n",
       "      <td>None</td>\n",
       "      <td>...</td>\n",
       "      <td>green</td>\n",
       "      <td>1</td>\n",
       "      <td>[]</td>\n",
       "      <td>False</td>\n",
       "      <td>None</td>\n",
       "      <td>rpsanch</td>\n",
       "      <td>7584</td>\n",
       "      <td>https://otx.alienvault.com/assets/images/defau...</td>\n",
       "      <td>False</td>\n",
       "      <td>False</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>20</th>\n",
       "      <td>5710fba53d1aa4023873a2d1</td>\n",
       "      <td>Possible Credential Stealing Malware</td>\n",
       "      <td>We found a machine on our network making suspi...</td>\n",
       "      <td>sredwards</td>\n",
       "      <td>2016-04-19T15:00:42.456000</td>\n",
       "      <td>2016-04-15T14:33:09.525000</td>\n",
       "      <td>[]</td>\n",
       "      <td>[]</td>\n",
       "      <td>1</td>\n",
       "      <td>None</td>\n",
       "      <td>...</td>\n",
       "      <td>green</td>\n",
       "      <td>19</td>\n",
       "      <td>[]</td>\n",
       "      <td>False</td>\n",
       "      <td>None</td>\n",
       "      <td>sredwards</td>\n",
       "      <td>3255</td>\n",
       "      <td>https://otx.alienvault.com/assets/images/defau...</td>\n",
       "      <td>False</td>\n",
       "      <td>False</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>21</th>\n",
       "      <td>571b325a3c4c3e015d93c33f</td>\n",
       "      <td>The Ghost Dragon - Cylance Report</td>\n",
       "      <td>Cylance SPEAR™ has identified an APT group whi...</td>\n",
       "      <td>CyberAnarchist</td>\n",
       "      <td>2016-04-23T08:29:14.035000</td>\n",
       "      <td>2016-04-23T08:29:14.035000</td>\n",
       "      <td>[]</td>\n",
       "      <td>[]</td>\n",
       "      <td>1</td>\n",
       "      <td>None</td>\n",
       "      <td>...</td>\n",
       "      <td>white</td>\n",
       "      <td>1</td>\n",
       "      <td>[]</td>\n",
       "      <td>False</td>\n",
       "      <td>None</td>\n",
       "      <td>CyberAnarchist</td>\n",
       "      <td>2064</td>\n",
       "      <td>/otxapi/users/avatar_image/media/avatars/Cyber...</td>\n",
       "      <td>False</td>\n",
       "      <td>False</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>22</th>\n",
       "      <td>57238ca37b3d46015f793bcf</td>\n",
       "      <td>BrLock ransomware</td>\n",
       "      <td>BrLock was found on April 18, 2016, but the ex...</td>\n",
       "      <td>bartblaze</td>\n",
       "      <td>2016-04-29T16:32:35.621000</td>\n",
       "      <td>2016-04-29T16:32:35.621000</td>\n",
       "      <td>[]</td>\n",
       "      <td>[]</td>\n",
       "      <td>1</td>\n",
       "      <td>None</td>\n",
       "      <td>...</td>\n",
       "      <td>green</td>\n",
       "      <td>1</td>\n",
       "      <td>[]</td>\n",
       "      <td>False</td>\n",
       "      <td>None</td>\n",
       "      <td>bartblaze</td>\n",
       "      <td>1009</td>\n",
       "      <td>/otxapi/users/avatar_image/media/avatars/bartb...</td>\n",
       "      <td>False</td>\n",
       "      <td>False</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>23</th>\n",
       "      <td>572887524d42e3015db731d9</td>\n",
       "      <td>Remote Code Execution Attempt / auto append file</td>\n",
       "      <td>Attempting to append the pot. analysis of the ...</td>\n",
       "      <td>Umbra00</td>\n",
       "      <td>2016-05-03T11:11:14.151000</td>\n",
       "      <td>2016-05-03T11:11:14.151000</td>\n",
       "      <td>[]</td>\n",
       "      <td>[]</td>\n",
       "      <td>1</td>\n",
       "      <td>None</td>\n",
       "      <td>...</td>\n",
       "      <td>green</td>\n",
       "      <td>1</td>\n",
       "      <td>[]</td>\n",
       "      <td>False</td>\n",
       "      <td>None</td>\n",
       "      <td>Umbra00</td>\n",
       "      <td>14010</td>\n",
       "      <td>/otxapi/users/avatar_image/media/avatars/Umbra...</td>\n",
       "      <td>False</td>\n",
       "      <td>False</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>24</th>\n",
       "      <td>5731bc95452c27015dad07e0</td>\n",
       "      <td>Enigma ransomware</td>\n",
       "      <td>A new ransomware called Enigma was discovered ...</td>\n",
       "      <td>bartblaze</td>\n",
       "      <td>2016-05-11T12:17:46.494000</td>\n",
       "      <td>2016-05-10T10:48:53.586000</td>\n",
       "      <td>[]</td>\n",
       "      <td>[]</td>\n",
       "      <td>1</td>\n",
       "      <td>None</td>\n",
       "      <td>...</td>\n",
       "      <td>green</td>\n",
       "      <td>2</td>\n",
       "      <td>[]</td>\n",
       "      <td>False</td>\n",
       "      <td>None</td>\n",
       "      <td>bartblaze</td>\n",
       "      <td>1009</td>\n",
       "      <td>/otxapi/users/avatar_image/media/avatars/bartb...</td>\n",
       "      <td>False</td>\n",
       "      <td>False</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>25 rows × 24 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "                          id  \\\n",
       "0   5528132f13432a2102724d34   \n",
       "1   55346adeb45ff536ca3ffd2c   \n",
       "2   553583b5b45ff501cdc579aa   \n",
       "3   5541029cb45ff5029b148b7f   \n",
       "4   558d85f0b45ff55ccb25e6f4   \n",
       "5   55a7cbb7b45ff51f5c94e6a2   \n",
       "6   55dfc30067db8c7bb8cb9865   \n",
       "7   55fae83567db8c6fb3518bcd   \n",
       "8   55faf3014637f26df8745a74   \n",
       "9   565301b84637f2388ab004ca   \n",
       "10  5671b0604637f25637cffe86   \n",
       "11  56747dfa4637f25637d08132   \n",
       "12  567a9bf967db8c417529da86   \n",
       "13  567af83c4637f21e1c24d4ba   \n",
       "14  568b2cef4637f2624bcdbf2c   \n",
       "15  569ac29767db8c057c6fdcc8   \n",
       "16  569d38d74637f2624bcddaa8   \n",
       "17  56cb95eb67db8c5860d245d2   \n",
       "18  56d0a04667db8c48093080b7   \n",
       "19  56d0a89467db8c4809308123   \n",
       "20  5710fba53d1aa4023873a2d1   \n",
       "21  571b325a3c4c3e015d93c33f   \n",
       "22  57238ca37b3d46015f793bcf   \n",
       "23  572887524d42e3015db731d9   \n",
       "24  5731bc95452c27015dad07e0   \n",
       "\n",
       "                                                 name  \\\n",
       "0            Potential TV5 Monde intrusion indicators   \n",
       "1                               Operation RussianDoll   \n",
       "2                                   Operation Buhtrap   \n",
       "3                                Operation Armageddon   \n",
       "4                 Digital Attack on German Parliament   \n",
       "5   Microsoft Office Zero-Day CVE-2015-2424 Levera...   \n",
       "6      New Spear Phishing Campaign Pretends to be EFF   \n",
       "7        THE DUKES: 7 years of Russian cyberespionage   \n",
       "8         Targeted Attack Distributes PlugX in Russia   \n",
       "9            Phishing site running suspicious scripts   \n",
       "10  Scanning Host - DNS query amplification attemp...   \n",
       "11                                       ZBot Malware   \n",
       "12  BBSRAT Attacks Targeting Russian Orgs Linked t...   \n",
       "13     BBSRAT Attacks Targeting Russian Organizations   \n",
       "14            Spam: New Year, New Russian Girlfriend!   \n",
       "15                                BlackEnergy Malware   \n",
       "16  Malicious Code Analysis on Ukraine's Power Gri...   \n",
       "17  Russian bank employees got fake job offers in ...   \n",
       "18             20160203-BlackEnergy by maldoc,Malware   \n",
       "19     20160204: CVE-2014-4114 Sandworm is not a WORM   \n",
       "20               Possible Credential Stealing Malware   \n",
       "21                  The Ghost Dragon - Cylance Report   \n",
       "22                                  BrLock ransomware   \n",
       "23   Remote Code Execution Attempt / auto append file   \n",
       "24                                  Enigma ransomware   \n",
       "\n",
       "                                          description  \\\n",
       "0   TV5Monde was taken off air in April 2015. A gr...   \n",
       "1   FireEye Labs recently detected a limited APT c...   \n",
       "2   Operation Buhtrap - The trap for Russian accou...   \n",
       "3   “Operation Armageddon,” active since at least ...   \n",
       "4   Servers of The Left in German Bundestag have b...   \n",
       "5   Yesterday, Microsoft patched CVE-2015-2424, a ...   \n",
       "6   Google's security team recently identified a n...   \n",
       "7   The Dukes are a well-resourced, highly dedicat...   \n",
       "8   Proofpoint researchers recently observed a cam...   \n",
       "9   Found phishing sites using the same format of ...   \n",
       "10  Intense DNS query amplification attempt from R...   \n",
       "11  The Trojans designed to steal money from bank ...   \n",
       "12  In late 2014, ESET presented an attack campaig...   \n",
       "13  In late 2014, ESET presented an attack campaig...   \n",
       "14       Fake Russian girlfriend-themed spam campaign   \n",
       "15  These attacks are active and ongoing as of ear...   \n",
       "16  At the end of December 2015, the network syste...   \n",
       "17  Employees at six Russian banks were sent spoof...   \n",
       "18  Black Energy is a malware that was believed to...   \n",
       "19  Cyphort labs team found that the exploit paylo...   \n",
       "20  We found a machine on our network making suspi...   \n",
       "21  Cylance SPEAR™ has identified an APT group whi...   \n",
       "22  BrLock was found on April 18, 2016, but the ex...   \n",
       "23  Attempting to append the pot. analysis of the ...   \n",
       "24  A new ransomware called Enigma was discovered ...   \n",
       "\n",
       "                  author_name                    modified  \\\n",
       "0                  AlienVault  2019-01-25T15:20:10.359000   \n",
       "1                  AlienVault  2017-08-24T10:45:07.905000   \n",
       "2                      tomdaq  2015-04-20T22:54:45.662000   \n",
       "3                  AlienVault  2017-03-12T01:33:45.089000   \n",
       "4                  AlienVault  2017-07-24T12:00:41.708000   \n",
       "5                  AlienVault  2019-10-24T16:03:41.314000   \n",
       "6                  AlienVault  2015-08-28T02:10:08.167000   \n",
       "7                  AlienVault  2017-03-06T17:17:18.888000   \n",
       "8                  AlienVault  2015-09-17T17:06:09.914000   \n",
       "9                   muscothym  2015-11-23T12:16:53.725000   \n",
       "10                renan.lopes  2015-12-16T18:41:36.827000   \n",
       "11                 AlienVault  2019-05-16T15:31:22.466000   \n",
       "12  brandongwalters@eaton.com  2015-12-23T13:04:57.822000   \n",
       "13                 AlienVault  2017-07-22T10:17:47.604000   \n",
       "14                    rpsanch  2016-01-05T02:39:43.063000   \n",
       "15          liveck@pta.center  2016-01-16T22:23:29.872000   \n",
       "16                 AlienVault  2016-01-18T19:11:19.403000   \n",
       "17                 AlienVault  2016-02-22T23:12:43.852000   \n",
       "18                    rpsanch  2016-02-26T18:58:14.597000   \n",
       "19                    rpsanch  2016-02-26T19:33:40.006000   \n",
       "20                  sredwards  2016-04-19T15:00:42.456000   \n",
       "21             CyberAnarchist  2016-04-23T08:29:14.035000   \n",
       "22                  bartblaze  2016-04-29T16:32:35.621000   \n",
       "23                    Umbra00  2016-05-03T11:11:14.151000   \n",
       "24                  bartblaze  2016-05-11T12:17:46.494000   \n",
       "\n",
       "                       created tags references  public        adversary  ...  \\\n",
       "0   2015-04-10T18:15:11.492000   []         []       1           Sofacy  ...   \n",
       "1   2015-04-20T02:56:30.505000   []         []       1           Sofacy  ...   \n",
       "2   2015-04-20T22:54:45.662000   []         []       1             None  ...   \n",
       "3   2015-04-29T16:11:08.251000   []         []       1  Gamaredon Group  ...   \n",
       "4   2015-06-26T17:03:44.800000   []         []       1           Sofacy  ...   \n",
       "5   2015-07-16T15:20:23.492000   []         []       1             None  ...   \n",
       "6   2015-08-28T02:10:08.167000   []         []       1             None  ...   \n",
       "7   2015-09-17T16:20:05.303000   []         []       1           APT 29  ...   \n",
       "8   2015-09-17T17:06:09.914000   []         []       1             None  ...   \n",
       "9   2015-11-23T12:08:24.397000   []         []       1             None  ...   \n",
       "10  2015-12-16T18:41:36.827000   []         []       1             None  ...   \n",
       "11  2015-12-18T21:43:22.913000   []         []       1             None  ...   \n",
       "12  2015-12-23T13:04:57.822000   []         []       1             None  ...   \n",
       "13  2015-12-23T19:38:36.636000   []         []       1    Roaming Tiger  ...   \n",
       "14  2016-01-05T02:39:43.063000   []         []       1             None  ...   \n",
       "15  2016-01-16T22:22:15.592000   []         []       1             None  ...   \n",
       "16  2016-01-18T19:11:19.403000   []         []       1             None  ...   \n",
       "17  2016-02-22T23:12:43.852000   []         []       1             None  ...   \n",
       "18  2016-02-26T18:58:14.597000   []         []       1             None  ...   \n",
       "19  2016-02-26T19:33:40.006000   []         []       1             None  ...   \n",
       "20  2016-04-15T14:33:09.525000   []         []       1             None  ...   \n",
       "21  2016-04-23T08:29:14.035000   []         []       1             None  ...   \n",
       "22  2016-04-29T16:32:35.621000   []         []       1             None  ...   \n",
       "23  2016-05-03T11:11:14.151000   []         []       1             None  ...   \n",
       "24  2016-05-10T10:48:53.586000   []         []       1             None  ...   \n",
       "\n",
       "      TLP revision groups in_group is_subscribing            author.username  \\\n",
       "0   green       11     []    False           None                 AlienVault   \n",
       "1   green        3     []    False           None                 AlienVault   \n",
       "2   green        1     []    False           None                     tomdaq   \n",
       "3   green        7     []    False           None                 AlienVault   \n",
       "4   green        5     []    False           None                 AlienVault   \n",
       "5   green        1     []    False           None                 AlienVault   \n",
       "6   green        1     []    False           None                 AlienVault   \n",
       "7   green        2     []    False           None                 AlienVault   \n",
       "8   green        1     []    False           None                 AlienVault   \n",
       "9   green       10     []    False           None                  muscothym   \n",
       "10  green        1     []    False           None                renan.lopes   \n",
       "11  green        2     []    False           None                 AlienVault   \n",
       "12  green        1     []    False           None  brandongwalters@eaton.com   \n",
       "13  green        2     []    False           None                 AlienVault   \n",
       "14  green        1     []    False           None                    rpsanch   \n",
       "15  green        2     []    False           None          liveck@pta.center   \n",
       "16  green        1     []    False           None                 AlienVault   \n",
       "17  green        1     []    False           None                 AlienVault   \n",
       "18  green        1     []    False           None                    rpsanch   \n",
       "19  green        1     []    False           None                    rpsanch   \n",
       "20  green       19     []    False           None                  sredwards   \n",
       "21  white        1     []    False           None             CyberAnarchist   \n",
       "22  green        1     []    False           None                  bartblaze   \n",
       "23  green        1     []    False           None                    Umbra00   \n",
       "24  green        2     []    False           None                  bartblaze   \n",
       "\n",
       "   author.id                                  author.avatar_url  \\\n",
       "0          2  /otxapi/users/avatar_image/media/avatars/user_...   \n",
       "1          2  /otxapi/users/avatar_image/media/avatars/user_...   \n",
       "2         49  https://otx.alienvault.com/assets/images/defau...   \n",
       "3          2  /otxapi/users/avatar_image/media/avatars/user_...   \n",
       "4          2  /otxapi/users/avatar_image/media/avatars/user_...   \n",
       "5          2  /otxapi/users/avatar_image/media/avatars/user_...   \n",
       "6          2  /otxapi/users/avatar_image/media/avatars/user_...   \n",
       "7          2  /otxapi/users/avatar_image/media/avatars/user_...   \n",
       "8          2  /otxapi/users/avatar_image/media/avatars/user_...   \n",
       "9       6895  /otxapi/users/avatar_image/media/avatars/musco...   \n",
       "10      5557  /otxapi/users/avatar_image/media/avatars/renan...   \n",
       "11         2  /otxapi/users/avatar_image/media/avatars/user_...   \n",
       "12      5792  /otxapi/users/avatar_image/media/avatars/brand...   \n",
       "13         2  /otxapi/users/avatar_image/media/avatars/user_...   \n",
       "14      7584  https://otx.alienvault.com/assets/images/defau...   \n",
       "15      7748  https://otx.alienvault.com/assets/images/defau...   \n",
       "16         2  /otxapi/users/avatar_image/media/avatars/user_...   \n",
       "17         2  /otxapi/users/avatar_image/media/avatars/user_...   \n",
       "18      7584  https://otx.alienvault.com/assets/images/defau...   \n",
       "19      7584  https://otx.alienvault.com/assets/images/defau...   \n",
       "20      3255  https://otx.alienvault.com/assets/images/defau...   \n",
       "21      2064  /otxapi/users/avatar_image/media/avatars/Cyber...   \n",
       "22      1009  /otxapi/users/avatar_image/media/avatars/bartb...   \n",
       "23     14010  /otxapi/users/avatar_image/media/avatars/Umbra...   \n",
       "24      1009  /otxapi/users/avatar_image/media/avatars/bartb...   \n",
       "\n",
       "   author.is_subscribed author.is_following  \n",
       "0                 False               False  \n",
       "1                 False               False  \n",
       "2                 False               False  \n",
       "3                 False               False  \n",
       "4                 False               False  \n",
       "5                 False               False  \n",
       "6                 False               False  \n",
       "7                 False               False  \n",
       "8                 False               False  \n",
       "9                 False               False  \n",
       "10                False               False  \n",
       "11                False               False  \n",
       "12                False               False  \n",
       "13                False               False  \n",
       "14                False               False  \n",
       "15                False               False  \n",
       "16                False               False  \n",
       "17                False               False  \n",
       "18                False               False  \n",
       "19                False               False  \n",
       "20                False               False  \n",
       "21                False               False  \n",
       "22                False               False  \n",
       "23                False               False  \n",
       "24                False               False  \n",
       "\n",
       "[25 rows x 24 columns]"
      ]
     },
     "execution_count": 16,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "json_normalize(pulses[\"results\"])"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Let's say we're interested in viewing the full details (including indicators) from one of our search results.  For example maybe we're interested in the Enigma Ransomware:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 17,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "pulse_id = pulses[\"results\"][1][\"id\"]"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 18,
   "metadata": {
    "collapsed": false
   },
   "outputs": [],
   "source": [
    "pulse_details = otx.get_pulse_details(pulse_id)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 19,
   "metadata": {
    "collapsed": false
   },
   "outputs": [
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "/var/folders/fn/f809r2_97k9cv7vfz0vgt_w00000gn/T/ipykernel_1775/4271244268.py:1: FutureWarning: pandas.io.json.json_normalize is deprecated, use pandas.json_normalize instead.\n",
      "  json_normalize(pulse_details)\n"
     ]
    },
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>id</th>\n",
       "      <th>name</th>\n",
       "      <th>description</th>\n",
       "      <th>author_name</th>\n",
       "      <th>modified</th>\n",
       "      <th>created</th>\n",
       "      <th>tags</th>\n",
       "      <th>references</th>\n",
       "      <th>public</th>\n",
       "      <th>adversary</th>\n",
       "      <th>...</th>\n",
       "      <th>indicators</th>\n",
       "      <th>revision</th>\n",
       "      <th>groups</th>\n",
       "      <th>in_group</th>\n",
       "      <th>is_subscribing</th>\n",
       "      <th>author.username</th>\n",
       "      <th>author.id</th>\n",
       "      <th>author.avatar_url</th>\n",
       "      <th>author.is_subscribed</th>\n",
       "      <th>author.is_following</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>55346adeb45ff536ca3ffd2c</td>\n",
       "      <td>Operation RussianDoll</td>\n",
       "      <td>FireEye Labs recently detected a limited APT c...</td>\n",
       "      <td>AlienVault</td>\n",
       "      <td>2017-08-24T10:45:07.905000</td>\n",
       "      <td>2015-04-20T02:56:30.505000</td>\n",
       "      <td>[flash, apt28, windows, apt, shellcode, zeroda...</td>\n",
       "      <td>[]</td>\n",
       "      <td>1</td>\n",
       "      <td>Sofacy</td>\n",
       "      <td>...</td>\n",
       "      <td>[{'id': 4278, 'indicator': 'ssl-icloud.com', '...</td>\n",
       "      <td>3</td>\n",
       "      <td>[{'name': 'APT28/Sofacy/Fancy Bear Working Gro...</td>\n",
       "      <td>True</td>\n",
       "      <td>None</td>\n",
       "      <td>AlienVault</td>\n",
       "      <td>2</td>\n",
       "      <td>/otxapi/users/avatar_image/media/avatars/user_...</td>\n",
       "      <td>False</td>\n",
       "      <td>False</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>1 rows × 25 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "                         id                   name  \\\n",
       "0  55346adeb45ff536ca3ffd2c  Operation RussianDoll   \n",
       "\n",
       "                                         description author_name  \\\n",
       "0  FireEye Labs recently detected a limited APT c...  AlienVault   \n",
       "\n",
       "                     modified                     created  \\\n",
       "0  2017-08-24T10:45:07.905000  2015-04-20T02:56:30.505000   \n",
       "\n",
       "                                                tags references  public  \\\n",
       "0  [flash, apt28, windows, apt, shellcode, zeroda...         []       1   \n",
       "\n",
       "  adversary  ...                                         indicators revision  \\\n",
       "0    Sofacy  ...  [{'id': 4278, 'indicator': 'ssl-icloud.com', '...        3   \n",
       "\n",
       "                                              groups in_group is_subscribing  \\\n",
       "0  [{'name': 'APT28/Sofacy/Fancy Bear Working Gro...     True           None   \n",
       "\n",
       "  author.username  author.id  \\\n",
       "0      AlienVault          2   \n",
       "\n",
       "                                   author.avatar_url  author.is_subscribed  \\\n",
       "0  /otxapi/users/avatar_image/media/avatars/user_...                 False   \n",
       "\n",
       "  author.is_following  \n",
       "0               False  \n",
       "\n",
       "[1 rows x 25 columns]"
      ]
     },
     "execution_count": 19,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "json_normalize(pulse_details)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Indicator details"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Let's investigate an indicator included in the Enigma Ransomware pulse."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 20,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "indicator = pulse_details[\"indicators\"][4][\"indicator\"]"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 21,
   "metadata": {
    "collapsed": false
   },
   "outputs": [
    {
     "ename": "BadRequest",
     "evalue": "{'detail': 'Invalid IP (updatecenter.name)'}",
     "output_type": "error",
     "traceback": [
      "\u001b[0;31m---------------------------------------------------------------------------\u001b[0m",
      "\u001b[0;31mBadRequest\u001b[0m                                Traceback (most recent call last)",
      "Cell \u001b[0;32mIn[21], line 1\u001b[0m\n\u001b[0;32m----> 1\u001b[0m indicator_details \u001b[38;5;241m=\u001b[39m \u001b[43motx\u001b[49m\u001b[38;5;241;43m.\u001b[39;49m\u001b[43mget_indicator_details_full\u001b[49m\u001b[43m(\u001b[49m\u001b[43mIndicatorTypes\u001b[49m\u001b[38;5;241;43m.\u001b[39;49m\u001b[43mIPv4\u001b[49m\u001b[43m,\u001b[49m\u001b[43m \u001b[49m\u001b[43mindicator\u001b[49m\u001b[43m)\u001b[49m\n",
      "File \u001b[0;32m~/.pyenv/versions/3.10.8/lib/python3.10/site-packages/OTXv2.py:682\u001b[0m, in \u001b[0;36mOTXv2.get_indicator_details_full\u001b[0;34m(self, indicator_type, indicator)\u001b[0m\n\u001b[1;32m    680\u001b[0m \u001b[38;5;28;01mfor\u001b[39;00m section \u001b[38;5;129;01min\u001b[39;00m indicator_type\u001b[38;5;241m.\u001b[39msections:\n\u001b[1;32m    681\u001b[0m     indicator_url \u001b[38;5;241m=\u001b[39m \u001b[38;5;28mself\u001b[39m\u001b[38;5;241m.\u001b[39mcreate_indicator_detail_url(indicator_type, indicator, section)\n\u001b[0;32m--> 682\u001b[0m     indicator_dict[section] \u001b[38;5;241m=\u001b[39m \u001b[38;5;28;43mself\u001b[39;49m\u001b[38;5;241;43m.\u001b[39;49m\u001b[43mget\u001b[49m\u001b[43m(\u001b[49m\u001b[43mindicator_url\u001b[49m\u001b[43m)\u001b[49m\n\u001b[1;32m    683\u001b[0m \u001b[38;5;28;01mreturn\u001b[39;00m indicator_dict\n",
      "File \u001b[0;32m~/.pyenv/versions/3.10.8/lib/python3.10/site-packages/OTXv2.py:185\u001b[0m, in \u001b[0;36mOTXv2.get\u001b[0;34m(self, url, **kwargs)\u001b[0m\n\u001b[1;32m    177\u001b[0m \u001b[38;5;28;01mtry\u001b[39;00m:\n\u001b[1;32m    178\u001b[0m     response \u001b[38;5;241m=\u001b[39m \u001b[38;5;28mself\u001b[39m\u001b[38;5;241m.\u001b[39msession()\u001b[38;5;241m.\u001b[39mget(\n\u001b[1;32m    179\u001b[0m         \u001b[38;5;28mself\u001b[39m\u001b[38;5;241m.\u001b[39mcreate_url(url, \u001b[38;5;241m*\u001b[39m\u001b[38;5;241m*\u001b[39mkwargs),\n\u001b[1;32m    180\u001b[0m         headers\u001b[38;5;241m=\u001b[39m\u001b[38;5;28mself\u001b[39m\u001b[38;5;241m.\u001b[39mheaders,\n\u001b[0;32m   (...)\u001b[0m\n\u001b[1;32m    183\u001b[0m         cert\u001b[38;5;241m=\u001b[39m\u001b[38;5;28mself\u001b[39m\u001b[38;5;241m.\u001b[39mcert,\n\u001b[1;32m    184\u001b[0m     )\n\u001b[0;32m--> 185\u001b[0m     \u001b[38;5;28;01mreturn\u001b[39;00m \u001b[38;5;28;43mself\u001b[39;49m\u001b[38;5;241;43m.\u001b[39;49m\u001b[43mhandle_response_errors\u001b[49m\u001b[43m(\u001b[49m\u001b[43mresponse\u001b[49m\u001b[43m)\u001b[49m\u001b[38;5;241m.\u001b[39mjson()\n\u001b[1;32m    186\u001b[0m \u001b[38;5;28;01mexcept\u001b[39;00m requests\u001b[38;5;241m.\u001b[39mexceptions\u001b[38;5;241m.\u001b[39mRetryError:\n\u001b[1;32m    187\u001b[0m     \u001b[38;5;28;01mraise\u001b[39;00m RetryError()\n",
      "File \u001b[0;32m~/.pyenv/versions/3.10.8/lib/python3.10/site-packages/OTXv2.py:162\u001b[0m, in \u001b[0;36mOTXv2.handle_response_errors\u001b[0;34m(cls, response)\u001b[0m\n\u001b[1;32m    160\u001b[0m     \u001b[38;5;28;01mraise\u001b[39;00m InvalidAPIKey()\n\u001b[1;32m    161\u001b[0m \u001b[38;5;28;01melif\u001b[39;00m response\u001b[38;5;241m.\u001b[39mstatus_code \u001b[38;5;241m==\u001b[39m \u001b[38;5;241m400\u001b[39m:\n\u001b[0;32m--> 162\u001b[0m     \u001b[38;5;28;01mraise\u001b[39;00m BadRequest(_response_json())\n\u001b[1;32m    163\u001b[0m \u001b[38;5;28;01melif\u001b[39;00m response\u001b[38;5;241m.\u001b[39mstatus_code \u001b[38;5;241m==\u001b[39m \u001b[38;5;241m404\u001b[39m:\n\u001b[1;32m    164\u001b[0m     \u001b[38;5;28;01mraise\u001b[39;00m NotFound()\n",
      "\u001b[0;31mBadRequest\u001b[0m: {'detail': 'Invalid IP (updatecenter.name)'}"
     ]
    }
   ],
   "source": [
    "indicator_details = otx.get_indicator_details_full(IndicatorTypes.IPv4, indicator)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Indicator details are divided into sections for convenience:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": false
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "['malware', 'passive_dns', 'url_list', 'general', 'reputation', 'geo']"
      ]
     },
     "execution_count": 30,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "indicator_details.keys()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": false
   },
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>actual_size</th>\n",
       "      <th>full_size</th>\n",
       "      <th>has_next</th>\n",
       "      <th>limit</th>\n",
       "      <th>page_num</th>\n",
       "      <th>paged</th>\n",
       "      <th>url_list</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>22</td>\n",
       "      <td>22</td>\n",
       "      <td>True</td>\n",
       "      <td>10</td>\n",
       "      <td>1</td>\n",
       "      <td>True</td>\n",
       "      <td>[{u'domain': u'', u'url': u'http://82.194.84.1...</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "   actual_size  full_size has_next  limit  page_num paged  \\\n",
       "0           22         22     True     10         1  True   \n",
       "\n",
       "                                            url_list  \n",
       "0  [{u'domain': u'', u'url': u'http://82.194.84.1...  "
      ]
     },
     "execution_count": 37,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "json_normalize(indicator_details[\"url_list\"])"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": false,
    "scrolled": false
   },
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>address</th>\n",
       "      <th>asset_type</th>\n",
       "      <th>first</th>\n",
       "      <th>flag_title</th>\n",
       "      <th>flag_url</th>\n",
       "      <th>hostname</th>\n",
       "      <th>indicator_link</th>\n",
       "      <th>last</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>82.194.84.120</td>\n",
       "      <td>domain</td>\n",
       "      <td>2013-08-29 14:59:51</td>\n",
       "      <td>Spain</td>\n",
       "      <td>/static/img/flags/es.png</td>\n",
       "      <td>comitres.net</td>\n",
       "      <td>/indicator/domain/comitres.net</td>\n",
       "      <td>2014-07-24 01:04:39</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>82.194.84.120</td>\n",
       "      <td>domain</td>\n",
       "      <td>2013-10-09 18:09:10</td>\n",
       "      <td>Spain</td>\n",
       "      <td>/static/img/flags/es.png</td>\n",
       "      <td>apamac.net</td>\n",
       "      <td>/indicator/domain/apamac.net</td>\n",
       "      <td>2013-12-16 15:42:58</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>82.194.84.120</td>\n",
       "      <td>domain</td>\n",
       "      <td>2013-08-31 15:02:04</td>\n",
       "      <td>Spain</td>\n",
       "      <td>/static/img/flags/es.png</td>\n",
       "      <td>estudio-danza-camargo.com</td>\n",
       "      <td>/indicator/domain/estudio-danza-camargo.com</td>\n",
       "      <td>2013-08-31 15:02:04</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "         address asset_type                first flag_title  \\\n",
       "0  82.194.84.120     domain  2013-08-29 14:59:51      Spain   \n",
       "1  82.194.84.120     domain  2013-10-09 18:09:10      Spain   \n",
       "2  82.194.84.120     domain  2013-08-31 15:02:04      Spain   \n",
       "\n",
       "                   flag_url                   hostname  \\\n",
       "0  /static/img/flags/es.png               comitres.net   \n",
       "1  /static/img/flags/es.png                 apamac.net   \n",
       "2  /static/img/flags/es.png  estudio-danza-camargo.com   \n",
       "\n",
       "                                indicator_link                 last  \n",
       "0               /indicator/domain/comitres.net  2014-07-24 01:04:39  \n",
       "1                 /indicator/domain/apamac.net  2013-12-16 15:42:58  \n",
       "2  /indicator/domain/estudio-danza-camargo.com  2013-08-31 15:02:04  "
      ]
     },
     "execution_count": 39,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "json_normalize(indicator_details[\"passive_dns\"].get('passive_dns'))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Indicator details are not available for all supported indicator types.  IndicatorTypes.supported_api_types contains a list of the indicator types you can use with get_indicator_details_by_section and get_indicator_details_full. "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Create pulse"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "You can create new pulses using the create_pulse function.  A name string is required.  Public boolean is also required but will be set True if not provided:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "indicators = [{\"indicator\": \"82.194.84.121\", \"description\":\"\", \"type\": \"IPv4\"}, {\"indicator\": \"82.194.84.122\", \"description\":\"\", \"type\": \"IPv4\"}]"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "new_pulse = otx.create_pulse(name=\"IPy Notebook Test\", indicators=indicators, public=False)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": false,
    "scrolled": true
   },
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>TLP</th>\n",
       "      <th>active</th>\n",
       "      <th>author_id</th>\n",
       "      <th>author_name</th>\n",
       "      <th>cloned_from</th>\n",
       "      <th>comments_count</th>\n",
       "      <th>created</th>\n",
       "      <th>description</th>\n",
       "      <th>downvotes</th>\n",
       "      <th>downvotes_count</th>\n",
       "      <th>...</th>\n",
       "      <th>subscribers</th>\n",
       "      <th>subscribers_count</th>\n",
       "      <th>tags</th>\n",
       "      <th>tags_count</th>\n",
       "      <th>unsubscribed_users</th>\n",
       "      <th>upvotes</th>\n",
       "      <th>upvotes_count</th>\n",
       "      <th>validators</th>\n",
       "      <th>validators_count</th>\n",
       "      <th>votes_count</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>green</td>\n",
       "      <td>True</td>\n",
       "      <td>14830</td>\n",
       "      <td>hilaryclintonsemailserver</td>\n",
       "      <td>None</td>\n",
       "      <td>0</td>\n",
       "      <td>2016-05-20T16:25:59.670399</td>\n",
       "      <td></td>\n",
       "      <td>[]</td>\n",
       "      <td>0</td>\n",
       "      <td>...</td>\n",
       "      <td>[]</td>\n",
       "      <td>0</td>\n",
       "      <td>[]</td>\n",
       "      <td>0</td>\n",
       "      <td>[]</td>\n",
       "      <td>[]</td>\n",
       "      <td>0</td>\n",
       "      <td>[]</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>1 rows × 38 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "     TLP active  author_id                author_name cloned_from  \\\n",
       "0  green   True      14830  hilaryclintonsemailserver        None   \n",
       "\n",
       "   comments_count                     created description downvotes  \\\n",
       "0               0  2016-05-20T16:25:59.670399                    []   \n",
       "\n",
       "   downvotes_count     ...      subscribers subscribers_count tags tags_count  \\\n",
       "0                0     ...               []                 0   []          0   \n",
       "\n",
       "   unsubscribed_users upvotes upvotes_count validators validators_count  \\\n",
       "0                  []      []             0         []                0   \n",
       "\n",
       "  votes_count  \n",
       "0           0  \n",
       "\n",
       "[1 rows x 38 columns]"
      ]
     },
     "execution_count": 43,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "json_normalize(new_pulse)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Data saved to pulse_indicators_2024-01-22_10-40-49.csv\n"
     ]
    }
   ],
   "source": [
    "import pandas as pd\n",
    "import schedule\n",
    "import time\n",
    "import datetime\n",
    "\n",
    "def get_pulse_indicator_info(pulse_id, api_key):\n",
    "    otx = OTXv2(api_key)\n",
    "\n",
    " \n",
    "    indicators = otx.get_pulse_indicators(pulse_id)\n",
    "\n",
    "    \n",
    "    indicator_types = []\n",
    "    indicator_values = []\n",
    "    descriptions = []\n",
    "\n",
    "    \n",
    "    for indicator in indicators:\n",
    "        indicator_types.append(indicator[\"type\"])\n",
    "        indicator_values.append(indicator[\"indicator\"])\n",
    "        descriptions.append(indicator[\"description\"])\n",
    "\n",
    "    \n",
    "    return indicator_types, indicator_values, descriptions\n",
    "\n",
    "def save_to_csv():\n",
    "    indicator_types, indicator_values, descriptions = get_pulse_indicator_info(pulse_id, api_key)\n",
    "    \n",
    "    #lists into a DataFrame\n",
    "    data = {\n",
    "        \"Indicator Types\": indicator_types,\n",
    "        \"Indicator Values\": indicator_values,\n",
    "        \"Descriptions\": descriptions\n",
    "    }\n",
    "    df = pd.DataFrame(data)\n",
    "\n",
    "    df = df.drop_duplicates(subset=[\"Indicator Values\"])\n",
    "    \n",
    "    #save to new file\n",
    "    current_time = datetime.datetime.now().strftime('%Y-%m-%d_%H-%M-%S')\n",
    "    filename = f'pulse_indicators_{current_time}.csv'\n",
    "    \n",
    "    df.to_csv(filename, index=False)\n",
    "    \n",
    "    print(f\"Data saved to {filename}\")\n",
    "\n",
    "\n",
    "api_key = \"56eeceea60fe1afb077026f0d228342a74707e64852ae7dd3cbee8439ff4d59c\"\n",
    "pulse_id = \"6341d1aa0a02a3f6251ab540\"\n",
    "\n",
    "save_to_csv()\n",
    "\n",
    "# To change time \n",
    "schedule.every(6).hours.do(save_to_csv)\n",
    "\n",
    "while True:\n",
    "    schedule.run_pending()\n",
    "    time.sleep(1)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "The following fields can be passed into create_pulse:\n",
    "- name(string, required) pulse name\n",
    "- public(boolean, required) long form description of threat\n",
    "- description(string) long form description of threat\n",
    "- tlp(string, white/green/amber/red) Traffic Light Protocol level for threat sharing\n",
    "- tags(list of strings) short keywords to associate with your pulse\n",
    "- references(list of strings, preferably URLs) external references for this threat\n",
    "- indicators(list of objects) IOCs to include in pulse"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.10.8"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 0
}