Provide also GOLANG example ? about threatexchange

[motiwarifacebook]

Hey @meirwah, right now providing examples in Go would be helpful, but is not a priority. If you want to see our examples in other languages, see our examples here: https://developers.facebook.com/docs/threat-exchange/examples/v2.5

Even better, if you would like to write the Go examples, I can add them to that page :)

[mgoffin]

I noticed the documented examples use v2.4 as well as threat_indicators to query for the first two examples. Should those get updated to v2.5 and using threat_descriptors?

I have never written Go before, so I apologize if any of this is over-engineered or there's better ways to do this :)

Example 1: A query to get all threat descriptors which are IP Addresses of proxies in ThreatExchange.

package main

import (
    "bytes"
    "encoding/json"
    "fmt"
    "io/ioutil"
    "net/http"
    "net/url"
)

func main() {
    var app_id = "555"
    var app_secret = "1234"
    var type_ = "IP_ADDRESS"
    var text = "proxy"

    var buffer bytes.Buffer
    buffer.WriteString(app_id)
    buffer.WriteString("|")
    buffer.WriteString(app_secret)

    access_token := buffer.String()

    var Url *url.URL
    Url, err := url.Parse("https://graph.facebook.com")
    Url.Path += "/v2.5/threat_descriptors/"

    parameters := url.Values{}
    parameters.Add("access_token", access_token)
    parameters.Add("type", type_)
    parameters.Add("text", text)
    Url.RawQuery = parameters.Encode()

    res, err := http.Get(Url.String())
    if err != nil {
        panic(err)
    }

    result, err := ioutil.ReadAll(res.Body)
    res.Body.Close()
    if err != nil {
        panic(err)
    }

    var dat map[string] interface{}
    if err := json.Unmarshal(result, &dat); err != nil {
        panic(err)
    }
    p, err := json.MarshalIndent(dat, "", "  ")
    if err != nil {
        panic(err)
    }

    fmt.Print(string(p))
}

Example 2: A query to get all IP Addresses of proxies uploaded by the Facebook Administrator app in ThreatExchange.

package main

import (
    "bytes"
    "encoding/json"
    "fmt"
    "io/ioutil"
    "net/http"
    "net/url"
)

func main() {
    var app_id = "555"
    var app_secret = "1234"
    var owner_app_id = "820763734618599"
    var type_ = "IP_ADDRESS"
    var text = "proxy"

    var buffer bytes.Buffer
    buffer.WriteString(app_id)
    buffer.WriteString("|")
    buffer.WriteString(app_secret)

    access_token := buffer.String()

    var Url *url.URL
    Url, err := url.Parse("https://graph.facebook.com")
    Url.Path += "/v2.5/threat_descriptors/"

    parameters := url.Values{}
    parameters.Add("access_token", access_token)
    parameters.Add("owner_app_id", owner_app_id)
    parameters.Add("type", type_)
    parameters.Add("text", text)
    Url.RawQuery = parameters.Encode()

    res, err := http.Get(Url.String())
    if err != nil {
        panic(err)
    }

    result, err := ioutil.ReadAll(res.Body)
    res.Body.Close()
    if err != nil {
        panic(err)
    }

    var dat map[string] interface{}
    if err := json.Unmarshal(result, &dat); err != nil {
        panic(err)
    }
    p, err := json.MarshalIndent(dat, "", "  ")
    if err != nil {
        panic(err)
    }

    fmt.Print(string(p))
}

Example 3: A query to get all malware analyses uploaded to ThreatExchange uploaded between Fri, 07 Feb 2014 22:51:29 GMT and Sat, 08 Feb 2014 10:51:29 GMT.

package main

import (
    "bytes"
    "encoding/json"
    "fmt"
    "io/ioutil"
    "net/http"
    "net/url"
)

func main() {
    var app_id = "555"
    var app_secret = "1234"
    var start_time = "1391813489"
    var end_time = "1391856689"

    var buffer bytes.Buffer
    buffer.WriteString(app_id)
    buffer.WriteString("|")
    buffer.WriteString(app_secret)

    access_token := buffer.String()

    var Url *url.URL
    Url, err := url.Parse("https://graph.facebook.com")
    Url.Path += "/v2.5/malware_analyses/"

    parameters := url.Values{}
    parameters.Add("access_token", access_token)
    parameters.Add("since", start_time)
    parameters.Add("until", end_time)
    Url.RawQuery = parameters.Encode()

    res, err := http.Get(Url.String())
    if err != nil {
        panic(err)
    }

    result, err := ioutil.ReadAll(res.Body)
    res.Body.Close()
    if err != nil {
        panic(err)
    }

    var dat map[string] interface{}
    if err := json.Unmarshal(result, &dat); err != nil {
        panic(err)
    }
    p, err := json.MarshalIndent(dat, "", "  ")
    if err != nil {
        panic(err)
    }

    fmt.Print(string(p))
}

Example 4: A query to get all malware families uploaded to ThreatExchange between yesterday and today.

package main

import (
    "bytes"
    "encoding/json"
    "fmt"
    "io/ioutil"
    "net/http"
    "net/url"
)

func main() {
    var app_id = "555"
    var app_secret = "1234"
    var start_time = "yesterday"
    var end_time = "now"

    var buffer bytes.Buffer
    buffer.WriteString(app_id)
    buffer.WriteString("|")
    buffer.WriteString(app_secret)

    access_token := buffer.String()

    var Url *url.URL
    Url, err := url.Parse("https://graph.facebook.com")
    Url.Path += "/v2.5/malware_analyses/"

    parameters := url.Values{}
    parameters.Add("access_token", access_token)
    parameters.Add("since", start_time)
    parameters.Add("until", end_time)
    Url.RawQuery = parameters.Encode()

    res, err := http.Get(Url.String())
    if err != nil {
        panic(err)
    }

    result, err := ioutil.ReadAll(res.Body)
    res.Body.Close()
    if err != nil {
        panic(err)
    }

    var dat map[string] interface{}
    if err := json.Unmarshal(result, &dat); err != nil {
        panic(err)
    }
    p, err := json.MarshalIndent(dat, "", "  ")
    if err != nil {
        panic(err)
    }

    fmt.Print(string(p))
}

[meirwah]

@mgoffin Thanks a lot for the examples!!!
And thanks @motiwarifacebook for the response ...

[hammem]

Awesome, @mgoffin !

@meirwah, is it ok if we close this one out?