Home

CIF Software Development Kit for Python

The CIF Software Development Kit (SDK) for Python contains library code and examples designed to enable developers to build applications using CIF.

from pprint import pprint
from cifsdk import search, submit, ping

if not ping():
    print("Server Unavailable...")

for i in search({'indicator': 'example.com'}):
    pprint(i)

rv = submit({'indicator': 'example.com', 'tags': 'phishing', 'group': 'everyone'})

Supporting the Project

Getting value from the project? Is it saving you time and money? Take out a small subscription to keep it going!

Installation

$ sudo apt-get install -y python-dev python-pip
$ pip install 'cifsdk>=4.0.0a1,<5.0'

Examples

Client

Running out of the box

These plugins are minimal and run out of the box

$ export CIF_TOKEN=1234
$ export CIF_REMOTE=http://localhost:5000
$ cif -q example.com
$ cif -q example.com --format csv
$ cif -q example.com --format table
$ cif -q example.com --format json

API

The REST API doc is now available via your local CIF instance using Swagger. Simply navigate to http://localhost:5000 using your browser to begin.

Search

import logging
from cifsdk.client.http import HTTP as Client
from pprint import pprint

cli = Client(token='1234',
             remote='https://localhost',
             verify_ssl=False)


ret = cli.indicators_search('example.com')

filters = {
  "indicator": "example.com",
  "confidence": 4,
  "probability": 84,
}

ret = cli.indicators_search(filters=filters)
pprint(ret)

Create

import logging
import json
from cifsdk.client.http import HTTP as Client

data = '{"indicator":"example4.com","tlp":"amber","confidence":"4","tags":"malware","provider":"example.com","group":"everyone"}'
data = json.loads(data)

cli = Client(token='1234',
            remote='https://localhost',
            verify_ssl=False)

ret = cli.indicators_create(data)
print("submission id: {0}".format(ret))

Ping

from cifsdk.client.http import HTTP as Client
...

ret = cli.ping()
print("roundtrip: %s ms" % ret)