# rstapi-python
Python 3 library for using the various threat intelligence RST Cloud APIs:
- RST Threat Feed
- RST Report Hub
- RST Noise Control
- RST IoC Lookup
- RST Whois API
## Installation
To install with pip run `pip install rstapi`
## Usage
See GitHub source https://github.com/rstcloud/rstapi-python
for further details and example usage. The file `test.py` includes examples.
See RST Cloud API docs here: https://www.rstcloud.com/api-docs/
An API token is required to use the RST Cloud API. You can request a RST Cloud API token by contacting trial@rstcloud.net, generating it online https://www.rstcloud.com/#free-trial, or reaching out your account representative.
The better way is to setup an environment variable RST_API_KEY and call it without specifing the key in the code.
```
import rstapi
c = rstapi.ioclookup()
c.GetIndicator("1.1.1.1")
```
However, you can explicitly pass a token in the api client constructor:
```
import rstapi
c = rstapi.ioclookup(APIKEY="YOU_API_KEY")
c.GetIndicator("1.1.1.1")
```
## Products
### RST Threat Feed
A comprehensive threat intel feed of indicators (IP, Domain, URL, Hash) with their relationships to malware, TTPs, tools, threat groups, sectors, CVE, and other objects.
Compiled from over 260 sources, including Twitter, Telegram, online sandboxes (Any.Run, Hybrid Analysis, VMRay, etc.), threat reports, CERTs, malware research sites, GitHub, pastebin, closed sources and our global RST Honeypot network.
Read more: https://www.rstcloud.com/rst-threat-feed/
### RST Report Hub
An electronic library of threat reports from hundreds of security companies, individual researchers and cyber communities.
These reports undergo transformation from human-readable formats to machine-readable ones, including STIX 2.1. Extensive multilingual translation, archiving as PDFs, and summarization are conducted. Key data, encompassing threat actors, names, software, CVEs, geolocation, industry, etc., is automatically extracted, with due credit to the original report author.
Read more: https://www.rstcloud.com/rst-report-hub/
### RST Noise Control
A service that can be used with TIP, SOAR, or SIEM solutions to minimise the noise coming from False Positive indicators. Make sure that CDN IPs, known domains, common URLs, or hashes of calc.exe don’t trigger alerts.
This API employs over 110 rulesets and incorporates 12 GB of individual exceptions, to check if indicators are “known-good” and to be considered noise.
Read more: https://www.rstcloud.com/rst-noise-control/
### RST IoC Lookup
An API to check individual values if they are a suspicious or malicious indicator (IP, Domain, URL, Hash). Offering dynamic scoring and automatic decay of outdated indicators, the service ensures fair request rate with low cost.
Ideal for real-time checks in SOAR or be integration into custom applications for online user connection scrutiny.
Read more: https://www.rstcloud.com/rst-ioc-lookup/
### RST Whois API
A service to get actual registration info in JSON format for a given domain without limitations on speed and no ban from WHOIS servers. The results include whenever possible:
- Data in a unified JSON format
- Registrar and registrant info
- Age of the domain
- Dates (registered, updated, expires)
- Raw response from WHOIS servers
Read more: https://www.rstcloud.com/rst-whois-api/
Raw data
{
"_id": null,
"home_page": "https://github.com/rstcloud/rstapi-python",
"name": "rstapi",
"maintainer": null,
"docs_url": null,
"requires_python": null,
"maintainer_email": null,
"keywords": "threat intelligence, RST Cloud, IoC lookup, Whois API",
"author": "RST Cloud Pty Ltd",
"author_email": "support@rstcloud.net, ysergeev@rstcloud.net",
"download_url": "https://files.pythonhosted.org/packages/cb/d3/8209463d561a08358dcdc324fd6fbc5e05668fe06fb01fbcbee6aff70f2f/rstapi-1.0.4.tar.gz",
"platform": null,
"description": "# rstapi-python\n\nPython 3 library for using the various threat intelligence RST Cloud APIs:\n - RST Threat Feed\n - RST Report Hub\n - RST Noise Control\n - RST IoC Lookup\n - RST Whois API\n\n## Installation\n\nTo install with pip run `pip install rstapi`\n\n## Usage\n\nSee GitHub source https://github.com/rstcloud/rstapi-python\nfor further details and example usage. The file `test.py` includes examples.\n\nSee RST Cloud API docs here: https://www.rstcloud.com/api-docs/\n\nAn API token is required to use the RST Cloud API. You can request a RST Cloud API token by contacting trial@rstcloud.net, generating it online https://www.rstcloud.com/#free-trial, or reaching out your account representative.\n\n\nThe better way is to setup an environment variable RST_API_KEY and call it without specifing the key in the code.\n\n```\nimport rstapi\nc = rstapi.ioclookup()\nc.GetIndicator(\"1.1.1.1\")\n```\n\nHowever, you can explicitly pass a token in the api client constructor:\n\n```\nimport rstapi\nc = rstapi.ioclookup(APIKEY=\"YOU_API_KEY\")\nc.GetIndicator(\"1.1.1.1\")\n```\n\n\n## Products\n\n### RST Threat Feed\n\nA comprehensive threat intel feed of indicators (IP, Domain, URL, Hash) with their relationships to malware, TTPs, tools, threat groups, sectors, CVE, and other objects.\n\nCompiled from over 260 sources, including Twitter, Telegram, online sandboxes (Any.Run, Hybrid Analysis, VMRay, etc.), threat reports, CERTs, malware research sites, GitHub, pastebin, closed sources and our global RST Honeypot network.\n\nRead more: https://www.rstcloud.com/rst-threat-feed/\n\n### RST Report Hub\n\nAn electronic library of threat reports from hundreds of security companies, individual researchers and cyber communities.\n\nThese reports undergo transformation from human-readable formats to machine-readable ones, including STIX 2.1. Extensive multilingual translation, archiving as PDFs, and summarization are conducted. Key data, encompassing threat actors, names, software, CVEs, geolocation, industry, etc., is automatically extracted, with due credit to the original report author.\n\nRead more: https://www.rstcloud.com/rst-report-hub/\n\n### RST Noise Control\n\nA service that can be used with TIP, SOAR, or SIEM solutions to minimise the noise coming from False Positive indicators. Make sure that CDN IPs, known domains, common URLs, or hashes of calc.exe don\u2019t trigger alerts.\n\nThis API employs over 110 rulesets and incorporates 12 GB of individual exceptions, to check if indicators are \u201cknown-good\u201d and to be considered noise.\n\nRead more: https://www.rstcloud.com/rst-noise-control/\n\n### RST IoC Lookup\n\nAn API to check individual values if they are a suspicious or malicious indicator (IP, Domain, URL, Hash). Offering dynamic scoring and automatic decay of outdated indicators, the service ensures fair request rate with low cost.\n\nIdeal for real-time checks in SOAR or be integration into custom applications for online user connection scrutiny.\n\nRead more: https://www.rstcloud.com/rst-ioc-lookup/\n\n### RST Whois API\n\nA service to get actual registration info in JSON format for a given domain without limitations on speed and no ban from WHOIS servers. The results include whenever possible:\n\n- Data in a unified JSON format\n- Registrar and registrant info\n- Age of the domain\n- Dates (registered, updated, expires)\n- Raw response from WHOIS servers\n\nRead more: https://www.rstcloud.com/rst-whois-api/\n",
"bugtrack_url": null,
"license": "MIT",
"summary": "Python library to access the RST Cloud API.",
"version": "1.0.4",
"project_urls": {
"Homepage": "https://github.com/rstcloud/rstapi-python"
},
"split_keywords": [
"threat intelligence",
" rst cloud",
" ioc lookup",
" whois api"
],
"urls": [
{
"comment_text": "",
"digests": {
"blake2b_256": "9b5021ed4d319bee3ee5b1335407bdd47d40f73e0a1671596877c0c7eb20ef97",
"md5": "609f488cb013ccdc1c646e25a7eb7d06",
"sha256": "348cabdcdbfd91005babeff501408497f4c4b135959e5677761e6533d192c29a"
},
"downloads": -1,
"filename": "rstapi-1.0.4-py3-none-any.whl",
"has_sig": false,
"md5_digest": "609f488cb013ccdc1c646e25a7eb7d06",
"packagetype": "bdist_wheel",
"python_version": "py3",
"requires_python": null,
"size": 8812,
"upload_time": "2024-09-27T08:35:27",
"upload_time_iso_8601": "2024-09-27T08:35:27.659429Z",
"url": "https://files.pythonhosted.org/packages/9b/50/21ed4d319bee3ee5b1335407bdd47d40f73e0a1671596877c0c7eb20ef97/rstapi-1.0.4-py3-none-any.whl",
"yanked": false,
"yanked_reason": null
},
{
"comment_text": "",
"digests": {
"blake2b_256": "cbd38209463d561a08358dcdc324fd6fbc5e05668fe06fb01fbcbee6aff70f2f",
"md5": "9e94360d007277d51c6952f84bec4e91",
"sha256": "09dc6b142112e94de6c938314841473cf6fd4aca549c80b0035c0fdc59c2ac28"
},
"downloads": -1,
"filename": "rstapi-1.0.4.tar.gz",
"has_sig": false,
"md5_digest": "9e94360d007277d51c6952f84bec4e91",
"packagetype": "sdist",
"python_version": "source",
"requires_python": null,
"size": 8147,
"upload_time": "2024-09-27T08:35:29",
"upload_time_iso_8601": "2024-09-27T08:35:29.288254Z",
"url": "https://files.pythonhosted.org/packages/cb/d3/8209463d561a08358dcdc324fd6fbc5e05668fe06fb01fbcbee6aff70f2f/rstapi-1.0.4.tar.gz",
"yanked": false,
"yanked_reason": null
}
],
"upload_time": "2024-09-27 08:35:29",
"github": true,
"gitlab": false,
"bitbucket": false,
"codeberg": false,
"github_user": "rstcloud",
"github_project": "rstapi-python",
"travis_ci": false,
"coveralls": false,
"github_actions": true,
"lcname": "rstapi"
}
JSON
