machinae 1.0.0

Installation

Machinae can be installed using pip3:

pip3 install machinae

Or, if you’re feeling adventurous, can be installed directly from github:

pip3 install git+https://github.com/HurricaneLabs/machinae.git

Usage

Machinae usage is very similar to Automater:

usage: machinae [-h] [-c CONFIG] [-d DELAY] [-f FILE] [--nomerge] [-o {D,J,N}]
                [-O {ipv4,ipv6,fqdn,email,sslfp,hash,url}] [-q] [-s SITES]
                targets [targets ...]

• Machinae supports a simple configuration merging system to allow you to make

  adjustments to the configuration without modifying the machinae.yml we provide

  you, making configuration updates a snap. This is done by finding a system-wide

  default configuration (default /etc/machinae.yml), merging into that a

  system-wide local configuration (/etc/machinae.local.yml) and finally a

  per-user local configuration (~/.machinae.yml). The system-wide configuration

  can also be located in the current working directory, can be set using the

  MACHINAE_CONFIG environment variable, or of course by using the -c or

  --config command line options. Configuration merging can be disabled by

  passing the --nomerge option, which will cause Machinae to only load the

  default system-wide configuration (or the one passed on the command line).
• Machinae supports a -d/--delay option, like Automater. However, Machinae

  uses 0 by default.

• Machinae output is controlled by two arguments:

  • -o controls the output format, and can be followed by a single character

    to indicated the desired type of output:

    • N is the default output (“Normal”)

    • D is the default output, but dot characters are replaced

    • J is JSON output

  • -f/--file specifies the file where output should be written. The default

    is “-” for stdout.
• Machinae will attempt to auto-detect the type of target passed in (Machinae

  refers to targets as “observables” and the type as “otype”). This detection can

  be overridden with the -O/--otype option. The choices are listed in the

  usage
• By default, Machinae operates in verbose mode. In this mode, it will output

  status information about the services it is querying on the console as they are

  queried. This output will always be written to stdout, regardless of the output

  setting. To disable verbose mode, use -q
• By default, Machinae will run through all services in the configuration that

  apply to each target’s otype and are not marked as “default: false”. To modify

  this behavior, you can:

  • Pass a comma separated list of sites to run (use the top level key from the configuration).

  • Pass the special keyword all to run through all services including those marked as “default: false”

  Note that in both cases, otype validation is still applied.

• Lastly, a list of targets should be passed. All arguments other than the

  options listed above will be interpreted as targets.

Out-of-the-Box Data Sources

Machinae comes with out-of-the-box support for the following data sources:

• IPVoid

• URLVoid

• URL Unshortener (http://www.toolsvoid.com/unshorten-url)

• Malc0de

• SANS

• Telize GeoIP

• Fortinet Category (disabled by default)

• VirusTotal pDNS (via web scrape)

• VirusTotal pDNS (via JSON API)

• VirusTotal URL Report (via JSON API)

• VirusTotal File Report (via JSON API)

• Reputation Authority

• ThreatExpert

• VxVault

• ProjectHoneypot

• McAfee Threat Intelligence

• StopForumSpam

• Cymru MHR

• ICSI Certificate Notary

• TotalHash (disabled by default)

• DomainTools Whois (Requires API key)

• DomainTools Reverse Whois (Requires API key)

• IP WHOIS (Using RIR REST interfaces)

With additional data sources on the way.

Output Formats

Adding additional sites

*** COMING SOON ***

Known Issues

• Some ISP’s on IPvoid contain double-encoded HTML entities, which are not double-decoded

Upcoming Features

• Add IDS rule search functionality (VRT/ET)

• Add “More info” link for sites

• Add “dedup” option to parser settings

• Add option for per-otype request settings

• Add custom per-site output for error codes

Version History

Version 1.0.0 (2015-07-02)

• Initial release

License Info

The MIT License (MIT)

Copyright (c) 2015 Hurricane Labs LLC