Skip to content
This repository has been archived by the owner on Aug 29, 2023. It is now read-only.
wes edited this page Mar 17, 2020 · 8 revisions

Getting Started

Python3.6+ is required (eg: Ubuntu 18 LTS, ..)

This you have the python SDK successfully installed. Installing the python client is as easy as:

$ pip3 install 'cifsdk>=5.0b1,<6.0'

Basic Output Formats

Table

$ cif --itype ipv4 --limit 5 --format table
+-------+----------+----------------------+----------------------+---------------+-------+----+-------+----------------------------------+------------+-------------+----------------+-----------------------------+---------------+
|  tlp  |  group   |       lasttime       |      reporttime      |   indicator  | itype | cc |  asn  |             asn_desc             | confidence | description |      tags      |            rdata            | provider      |
+-------+----------+----------------------+----------------------+---------------+-------+----+-------+----------------------------------+------------+-------------+----------------+-----------------------------+---------------+
| amber | everyone | 2016-02-23T14:58:21Z | 2016-02-23T14:58:21Z | 107.180.51.16 |  ipv4 | US | 26496 | AS-26496-GO-DADDY-COM-LLC GoDa.. |   13.996   |             | phishing,rdata |       lasttimeserc.com      | openphish.com |
| amber | everyone | 2016-02-23T14:58:21Z | 2016-02-23T14:58:21Z | 216.69.185.19 |  ipv4 | US | 26496 | AS-26496-GO-DADDY-COM-LLC GoDa.. |   13.996   |             | phishing,rdata |    ns37.domaincontrol.com   | openphish.com |
| amber | everyone | 2016-02-23T14:58:22Z | 2016-02-23T14:58:22Z | 107.180.51.16 |  ipv4 | US | 26496 | AS-26496-GO-DADDY-COM-LLC GoDa.. |   13.996   |             | phishing,rdata |       lasttimeserc.com      | openphish.com |
| amber | everyone | 2016-02-23T14:58:22Z | 2016-02-23T14:58:22Z |  188.121.58.1 |  ipv4 | NL | 26496 | AS-26496-GO-DADDY-COM-LLC GoDa.. |   13.996   |             | phishing,rdata | inetsoftwaresolutions.co.uk | openphish.com |
| amber | everyone | 2016-02-23T14:58:22Z | 2016-02-23T14:58:22Z | 216.69.185.19 |  ipv4 | US | 26496 | AS-26496-GO-DADDY-COM-LLC GoDa.. |   20.023   |             | phishing,rdata |    ns37.domaincontrol.com   | spamhaus.org  |
+-------+----------+----------------------+----------------------+---------------+-------+----+-------+----------------------------------+------------+-------------+----------------+-----------------------------+---------------+

CSV

Most Fields

$ cif --itype ipv4 --limit 5 --format csv
amber,everyone,2016-02-23T14:58:21Z,2016-02-23T14:58:21Z,107.180.51.16,ipv4,US,26496,AS-26496-GO-DADDY-COM-LLC GoDa..,13.996,,"phishing,rdata",lasttimeserc.com,openphish.com
amber,everyone,2016-02-23T14:58:22Z,2016-02-23T14:58:22Z,107.180.51.16,ipv4,US,26496,AS-26496-GO-DADDY-COM-LLC GoDa..,13.996,,"phishing,rdata",lasttimeserc.com,openphish.com

Custom Fields

$ cif --itype ipv4 --limit 5 --format csv --fields tlp,group,reported_at,indicator
amber,everyone,2016-02-23T14:58:21Z,107.180.51.16
amber,everyone,2016-02-23T14:58:22Z,107.180.51.16

JSON

$ cif --itype ipv4 --limit 5 --format json
[{"geolocation": "33.6119,-111.8906", "protocol": 6, "cc": "US", "rir": "arin", "related": "e7ab7044e21120408423e3aef2e7c09842e53d004e48e053c0bc16fe5383b429", "prefix": "107.180.51.0/24", "timezone": "America/Phoenix", ... }]