This is the documentation for example scripts used to submit data to the APWG repositories. Although marked as 'examples' the scripts should perform flawlessly if used to submit data.
Some of the repositories receive IODEF-formatted XML via an HTTP/SSL interface.
Data is encoded in 'wrappers', like:
Time, Criticality, other data and an ...
EventData for #1, which includes:
PhraudReport (for reporting phishing lures)
BotDetails (for reporting infected systems)
Time, Date, and other Information
To submit data to these places requires a three-step operation:
1. Encode your data into an appropriate PhraudReport (RFC5190) or BotDetails or other EventData Element.
2. Encode your data into an IETF IODEF (RFC5070) IODEF-Document.
3. Submit to the APWG.
The contents of this directory:
phish - Code to build and deliver a PhraudReport Document.
askquestions_phish.py - Not used for phish reports
build_phish.py - Assemble the EventData Element.
iodef_phish_config.ini - Static variables used in the scripts.
phish_fromStruct.py - Code to take phishStruct and generate an IODEF Document.
phish_fromMessage.py - Sample code to take a mail message and create
an IODEF Document.
phishStruct.py - Data to be encoded into the IODEF Document
phishStruct_test.py - Test data to be encoded into the IODEF Document.
bot - Code to build and deliver a BotDetails Document.
askQuestions.py - Get bot data via asking questions.
bot_fromStruct.py - Code to take botStruct and generate an IODEF
botStruct.pc - Data to be encoded into the IODEF Document.
botStruct_test.py - Test data to be encoded into the IODEF
iodef_bot_config.ini - Static variables used in the script.
common - Common code.
buildIODEF.py - Assemble EventData into an IODEF-Document.
send_to_apwg.py - code to send the completed IODEF to the
iodef - The IODEF library implemented in python.
II. Data submission using a template:
1. Verify iodef_*_config.ini is correct.
2. Craft a routine to take *your* data and put it into a *Struct.
3. Run python *_fromStruct.py
- Your input data will be XML-encoded into an IODEF-Document.
- The Document will be sent to the repository.
III. Data submission using a function
You could also create your own encoding and submission functions using
the phish_fromStruct or bot_fromStruct as a guide.