Snippets

Alexander Hanel Generate links for aptnotes

Created by Alexander Hanel last modified
aptnotes.md
Raw 
# creates a README.md with generated/clickable links from APTnotes.csv
# for https://github.com/aptnotes/data by alexander hanel

import csv
with open("README.md", "rb") as readme:
    text = readme.read()
    output = "##Links\n"
    year = None
    with open("APTnotes.csv", "rb") as csv_file:
        reader = csv.DictReader(csv_file, delimiter=',')
        for row in reader:
            if year is None or year !=  row['Year']:
                year = row['Year']
                output += "\n###%s\n\n" % (year)
            temp_line = " - [%s](%s) - Source: %s\n" % (row["Title"], row["Link"], row["Source"])
            output += temp_line
    search_text = "#How can I help?"
    offset = text.find(search_text)
    temp_text = text[:offset] + "\n" + output + "\n" + text[offset:] 

with open("README.md", "wb") as out:
    out.write(temp_text)

Scroll down to Links to see all the generate links.

alt text

#What is it? APTnotes is a repository of publicly-available papers and blogs (sorted by year) related to malicious campaigns/activity/software that have been associated with vendor-defined APT (Advanced Persistent Threat) groups and/or tool-sets.

#Who birthed this brain child? This repo was created by Kiran Bandla

David Westcott does things on occasion...

#Where's that data? In the original repo, we maintained an ongoing README with links to all of the reports in some form (we tried) order. We also stored all of the reports in year named folders within the repo itself (we ran out of room).

To solve the storage problem, we have moved everything over to Box (thanks Box, kisses). In order to maintain chronological order (and our sanity) we have migrated to CSV and JSON summary file(s).

#How can I download all the reports from Box? Our current interim fix for this (shout out to @Taskr) can be found within this issue: https://github.com/aptnotes/data/issues/50

##APTnotes.csv APTnotes.csv This a CSV summary file used to keep track of all the goodness

###Format

Filename Title Source Link SHA-1 Date Year
Name of the file Title of the report Vendor Box Link to the report SHA-1 of report Date of report release Year of release

##APTnotes.json APTnotes.json -- This is a converted version of the CSV format

###Format Example

[{"sha1": "3e6399a4b608bbd99dd81bd2be4cd49731362b5e", "Title": "How China Will Use Cyber Warfare", "Filename": "Fritz_HOW-CHINA-WILL-USE-CYBER-WARFARE(Oct-01-08)", "Source": "Jason Fritz", "Link": "https://app.box.com/s/696xnzy1an3jbm3b212y5n8xieirbemd", "Year": "2008", "Date": "10/1/08"},

##Links

###2008

###2009

###2010

###2011

###2012

###2013

###2014

###2013

###2014

###2015

###2016

#How can I help? There are multiple ways to get a report added: * Notify us via Twitter using the hash tag #aptnotes * Example: new report by vendor on this group - link #aptnotes * Reach out to us directly * @aptnotes * Create a new issue on Github including the data you want added (using the default issue template) * We created an issue template to take the guesswork out of things * If the document is only available in HTML, print a "clean" version (e.g. with Readability, Clearly, or similar) to PDF

#Why do we do it? Like almost every open-source project, this is a labor of love. There are so many reports out there, and they either get lost in the mix or taken down before you get a chance to read them. This is our effort to:

  • 1. Make sure these lovely reports get consumed
  • 2. Ensure the people of #DFIR #infosec know what's out there
  • 3. Hopefully add some context to the chaos

#How is this data being utilized? At present (that we know of...) these current projects consume this repo and make magical things happen:

#Thank You This project would not be where it is without the people that have helped along the way, thank you contributors

Comments (0)

HTTPS SSH

You can clone a snippet to your computer for local editing. Learn more.