stinky-fox/tm-v1-bad-ip-sync

Trend Micro Vision One Bad IP addresses sync to AbuseIPDB service

About

Sync malicious IP addresses to AbuseIPDB service. Initially designed for serverless (like AWS Lambda) but can be used on any Virtual Machine with python.

Requirements

• Cloud One Workload Security reporting IPS detections to the Vision One
• Vision One account
• Abuseip DB account
• Python + dependencies:
  • requests
  • json
  • sys
  • os
  • ipaddress
  • datetime
  • dateutil

Environment Variables

Following Environment variables must configured

• TMV1QUERYPERIODTYPE = acceptable values: days, weeks or months
• TMV1QUERYPERIODVALUE = numerical value that comes together with previous, i.e. 1 or 2 The variables will be combined to the single dict {"months":1}. Don't overquery, if you run your script once a day - days:1 is a decent scope. If both values not set - the default days and 1 will be used.
• ABUSEIPDB_APIKEY = your https://www.abuseipdb.com/account/api API key
• TMV1APIKEY = Trend Micro Vision One API Key (https://automation.trendmicro.com/xdr/Guides/First-Steps-Toward-Using-the-APIs#Obtain-the-Authentication-Token-of-an--------Account)

To run the script on any VM server

Uncomment the last line lambda_handler('a','b')