yossibaruch / elastic_hunter

Quickly do IOC searches on data indexed by Elasticsearch

elastic_hunter.py

Quickly do IOC searches on data indexed by Elasticsearch ( I use md5 / filename as an example because I'm lazy -- yes I know these are brittle. )

1. IOCs you wish to search must be in CSV format -- row data does not need to be related, the column is what matters

# example:
"md5","file_name"
"C35906060A4B79FCB9564248C472741E","evil_file1.exe"
"41202F5DBD630BA5E29A3B0DAD1FE9C1","evil_file2.exe"
"90F0BC619BEF2A3BEFEACA0B2F0407DB","evil_file3.exe"
...
"2B9CC45773D7E15C2855239B15A7DA35","really_evil.exe"

2. Your index fields must match the name of the CSV headers

3. Usage:

Usage: elastic_hunter.py [options]

Options:
  -h, --help            show this help message and exit
  -c CSV_FILE, --csv=CSV_FILE containing IOC info (required)
  -i INDEX_NAME, --index=INDEX_NAME you want to search against (required)
  -s SERVER, --server=SERVER running elasticsearch (defaults to localhost)
  -p PORT, --port=PORT elasticsearch is running on (defaults to 9200)

3. Example:

$ ./elastic_hunter.py -c ../20_thousand_iocs.csv -i "all_files_metadata"
[+] Got 13 hits where 'file_name' = 'jscript9.exe'
[+] Got 1 hits where 'md5' = '3CC983011177A815A94218EB38E13241'