accept_dupes
- (bool)
+ (bool)
–
Whether to accept incoming duplicate events. Default is False.
@@ -968,7 +968,7 @@suppress_dupes
- (bool)
+ (bool)
–
Whether to suppress outgoing duplicate events. Default is True.
@@ -976,7 +976,7 @@per_host_only
- (bool)
+ (bool)
–
Limit the module to only scanning once per host. Default is False.
@@ -984,7 +984,7 @@per_hostport_only
- (bool)
+ (bool)
–
Limit the module to only scanning once per host:port. Default is False.
@@ -992,7 +992,7 @@per_domain_only
- (bool)
+ (bool)
–
Limit the module to only scanning once per domain. Default is False.
@@ -1000,7 +1000,7 @@scope_distance_modifier
- ((int, None))
+ ((int, None))
–
Modifies scope distance acceptance for events. Default is 0. @@ -1013,7 +1013,7 @@
target_only
- (bool)
+ (bool)
–
Accept only the initial target event(s). Default is False.
@@ -1021,7 +1021,7 @@in_scope_only
- (bool)
+ (bool)
–
Accept only explicitly in-scope events. Default is False.
@@ -1045,7 +1045,7 @@module_threads
- (int)
+ (int)
–
Maximum concurrent instances of handle_event() or handle_batch(). Default is 1.
@@ -1053,7 +1053,7 @@batch_size
- (int)
+ (int)
–
Size of batches processed by handle_batch(). Default is 1.
@@ -1061,7 +1061,7 @@batch_wait
- (int)
+ (int)
–
Seconds to wait before force-submitting a batch. Default is 10.
@@ -1069,7 +1069,7 @@api_failure_abort_threshold
- (int)
+ (int)
–
Threshold for setting error state after failed HTTP requests (only takes effect when api_request() is used. Default is 5.
_preserve_graph
- (bool)
+ (bool)
–
When set to True, accept events that may be duplicates but are necessary for construction of complete graph. Typically only enabled for output modules that need to maintain full chains of events, e.g. neo4j and json. Default is False.
_stats_exclude
- (bool)
+ (bool)
–
Whether to exclude this module from scan statistics. Default is False.
@@ -1093,7 +1093,7 @@_qsize
- (int)
+ (int)
–
Outgoing queue size (0 for infinite). Default is 0.
@@ -1101,7 +1101,7 @@_priority
- (int)
+ (int)
–
Priority level of events raised by this module, 1-5. Default is 3.
@@ -1109,7 +1109,7 @@_name
- (str)
+ (str)
–
Module name, overridden automatically. Default is 'base'.
@@ -1117,7 +1117,7 @@_type
- (str)
+ (str)
–
Module type, for differentiating between normal and output modules. Default is 'scan'.
@@ -4458,7 +4458,7 @@errored
- (bool)
+ (bool)
–
Whether the module has errored out. Default is False.
@@ -4574,7 +4574,7 @@url
- (str)
+ (str)
–
The initial API URL. Can contain placeholders for 'page', 'page_size', and 'offset'.
@@ -4582,7 +4582,7 @@page_size
- (int, default:
+ (int, default:
100
)
–
@@ -4592,7 +4592,7 @@ json
- (bool, default:
+ (bool, default:
True
)
–
@@ -4602,7 +4602,7 @@ next_key
- (callable, default:
+ (callable, default:
None
)
–
@@ -4949,7 +4949,7 @@ trace
- (bool, default:
+ (bool, default:
True
)
–
@@ -5023,7 +5023,7 @@ trace
- (bool, default:
+ (bool, default:
False
)
–
@@ -5131,7 +5131,7 @@ Raises:
ValidationError
+ValidationError
–
If the event cannot be validated (handled in self.make_event()).
trace
- (bool, default:
+ (bool, default:
True
)
–
@@ -5855,7 +5855,7 @@ trace
- (bool, default:
+ (bool, default:
False
)
–
@@ -5929,7 +5929,7 @@ trace
- (bool, default:
+ (bool, default:
False
)
–
@@ -6003,7 +6003,7 @@ trace
- (bool, default:
+ (bool, default:
False
)
–
@@ -6077,7 +6077,7 @@ trace
- (bool, default:
+ (bool, default:
True
)
–
@@ -6151,7 +6151,7 @@ trace
- (bool, default:
+ (bool, default:
False
)
–
@@ -6341,7 +6341,7 @@ raise_error
- (bool)
+ (bool)
–
Whether to raise a validation error if the event could not be created. Defaults to False.
@@ -6364,7 +6364,7 @@Raises:
ValidationError
+ValidationError
–
If the event could not be validated and raise_error is True.
@@ -6459,7 +6459,7 @@url
- (str, default:
+ (str, default:
None
)
–
@@ -6480,7 +6480,7 @@ Raises:
ValueError
+ValueError
–
If the API response is not successful (status code != 200).
@@ -6646,7 +6646,7 @@Raises:
AttributeError
+AttributeError
–
If the module is not in an acceptable state to queue incoming events.
@@ -6779,7 +6779,7 @@AttributeError
+AttributeError
–
If the module is not in an acceptable state to queue outgoing events.
@@ -6995,7 +6995,7 @@message
- (str, default:
+ (str, default:
None
)
–
@@ -7265,7 +7265,7 @@ trace
- (bool, default:
+ (bool, default:
False
)
–
@@ -7398,7 +7398,7 @@ trace
- (bool, default:
+ (bool, default:
False
)
–
@@ -7472,7 +7472,7 @@ trace
- (bool, default:
+ (bool, default:
True
)
–
diff --git a/Dev/dev/core/index.html b/Dev/dev/core/index.html
index 9f522c201..f66e0495b 100644
--- a/Dev/dev/core/index.html
+++ b/Dev/dev/core/index.html
@@ -11,7 +11,7 @@
-
+
- Bases: EngineBase
EngineBase
The client portion of BBOT's RPC Engine.
To create an engine, you must create a subclass of this class and also define methods for each of your desired functions.
@@ -1312,7 +1312,7 @@
- Bases: EngineBase
EngineBase
The server portion of BBOT's RPC Engine.
Methods defined here must match the methods in your EngineClient.
To use the functions, you must create mappings for them in the CMDS attribute, as shown below.
diff --git a/Dev/dev/event/index.html b/Dev/dev/event/index.html index cda6691b7..54bb7678e 100644 --- a/Dev/dev/event/index.html +++ b/Dev/dev/event/index.html @@ -11,7 +11,7 @@ - +data
- (Union[str, dict, BaseEvent])
+ (Union[str, dict, BaseEvent])
–
The primary data for the event or an existing event object.
@@ -587,7 +587,7 @@event_type
- (str, default:
+ (str, default:
None
)
–
@@ -597,7 +597,7 @@ parent
- (BaseEvent, default:
+ (BaseEvent, default:
None
)
–
@@ -607,7 +607,7 @@ context
- (str, default:
+ (str, default:
None
)
–
@@ -617,7 +617,7 @@ module
- (str, default:
+ (str, default:
None
)
–
@@ -647,7 +647,7 @@ tags
- (Union[str, List[str]], default:
+ (Union[str, List[str]], default:
None
)
–
@@ -657,7 +657,7 @@ confidence
- (int, default:
+ (int, default:
100
)
–
@@ -667,7 +667,7 @@ dummy
- (bool, default:
+ (bool, default:
False
)
–
@@ -698,7 +698,7 @@ Raises:
ValidationError
+ValidationError
–
Raised when there's an error in event data or type sanitization.
@@ -1020,7 +1020,7 @@Raises:
ValidationError
+ValidationError
–
Raised when the JSON dictionary is missing required fields.
@@ -1168,7 +1168,7 @@type
- (str)
+ (str)
–
Specifies the type of the event, e.g., IP_ADDRESS, DNS_NAME.
id
- (str)
+ (str)
–
An identifier for the event (event type + sha1 hash of data). NOT universally unique.
@@ -1192,7 +1192,7 @@data
- (str or dict)
+ (str or dict)
–
The main data for the event, e.g., a URL or IP address.
@@ -1200,7 +1200,7 @@data_graph
- (str)
+ (str)
–
Representation of self.data for graph nodes (e.g. Neo4j).
data_human
- (str)
+ (str)
–
Representation of self.data for human output.
data_id
- (str)
+ (str)
–
Representation of self.data used to calculate the event's ID (and ultimately its hash, which is used for deduplication)
data_json
- (str)
+ (str)
–
Representation of self.data to be used in JSON serialization.
host_stem
- (str)
+ (str)
–
An abbreviated representation of hostname that removes the TLD, e.g. "www.evilcorp". Used by the word cloud.
@@ -1248,7 +1248,7 @@port
- (int or None)
+ (int or None)
–
The port associated with the event, if applicable, else None.
@@ -1256,7 +1256,7 @@words
- (set)
+ (set)
–
A list of relevant keywords extracted from the event. Used by the word cloud.
@@ -1264,7 +1264,7 @@scope_distance
- (int)
+ (int)
–
Indicates how many hops the event is from the main scope; 0 means in-scope.
@@ -1272,7 +1272,7 @@web_spider_distance
- (int)
+ (int)
–
The spider distance from the web root, specific to web crawling.
@@ -1280,7 +1280,7 @@scan
- (Scanner)
+ (Scanner)
–
The scan object that generated the event.
@@ -1288,7 +1288,7 @@timestamp
- (datetime)
+ (datetime)
–
The time at which the data was discovered.
@@ -1304,7 +1304,7 @@parent
- (BaseEvent)
+ (BaseEvent)
–
The parent event that led to the discovery of this event.
@@ -1312,7 +1312,7 @@parent_id
- (str)
+ (str)
–
The id attribute of the parent event.
parent_uuid
- (str)
+ (str)
–
The uuid attribute of the parent event.
module_sequence
- (str)
+ (str)
–
The sequence of modules that participated in the discovery.
@@ -3215,7 +3215,7 @@data
- ((str, dict))
+ ((str, dict))
–
The primary data for the event.
@@ -3223,7 +3223,7 @@event_type
- (str)
+ (str)
–
Type of the event, e.g., 'IP_ADDRESS'.
@@ -3231,7 +3231,7 @@parent
- (BaseEvent)
+ (BaseEvent)
–
Parent event that led to this event's discovery. Defaults to None.
@@ -3239,7 +3239,7 @@module
- (str)
+ (str)
–
Module that discovered the event. Defaults to None.
@@ -3271,7 +3271,7 @@confidence
- (int)
+ (int)
–
Confidence level for the event, on a scale of 1-100. Defaults to 100.
@@ -3279,7 +3279,7 @@timestamp
- (datetime)
+ (datetime)
–
Time of event discovery. Defaults to current UTC time.
@@ -3287,7 +3287,7 @@_dummy
- (bool)
+ (bool)
–
If True, disables certain data validations. Defaults to False.
@@ -3305,7 +3305,7 @@Raises:
ValidationError
+ValidationError
–
If either scan or parent are not specified and _dummy is False.
mode
- (str, default:
+ (str, default:
'json'
)
–
@@ -3575,7 +3575,7 @@ siem_friendly
- (bool, default:
+ (bool, default:
False
)
–
@@ -3772,7 +3772,7 @@ j
- (dict)
+ (dict)
–
The JSON-compatible dictionary containing event data.
diff --git a/Dev/dev/helpers/command/index.html b/Dev/dev/helpers/command/index.html index 6b31e4783..6eb77aee9 100644 --- a/Dev/dev/helpers/command/index.html +++ b/Dev/dev/helpers/command/index.html @@ -11,7 +11,7 @@ - +*command
- (str, default:
+ (str, default:
()
)
–
@@ -772,7 +772,7 @@ check
- (bool, default:
+ (bool, default:
False
)
–
@@ -783,7 +783,7 @@ text
- (bool, default:
+ (bool, default:
True
)
–
@@ -793,7 +793,7 @@ idle_timeout
- (int, default:
+ (int, default:
None
)
–
@@ -803,7 +803,7 @@ **kwargs
- (dict, default:
+ (dict, default:
{}
)
–
@@ -825,7 +825,7 @@ Raises:
CalledProcessError
+CalledProcessError
–
If the subprocess exits with a non-zero status and check=True.
- Bases: EngineClient
EngineClient
bbot/core/helpers/dns/dns.py18 @@ -1033,7 +1033,7 @@ |