ThreatFactor NSIA

h1. ThreatScript Definitions

ThreatScript Definitions are written in ECMAScript (basically the same as JavaScript). The ThreatScript definitions return a Result object which indicates whether a match was observed.

h2. ThreatScript Example

Below is an example of a ThreatScript that triggers if the web-page has a form element.

<pre><code class="javascript">

/*

 * Name: Example.General.Has_Form_Tag

 * Version: 1

 * ID: 1000000

 * Message: Indicates if the page has as a form tag

 * Severity: Low

 */

importPackage(Packages.ThreatScript);

importPackage(Packages.HTTP);

function analyze( httpResponse, operation, variables, environment, defaultRule ){

	var parser = httpResponse.getDocumentParser();

	var location = new URL( httpResponse.getLocation() );

	//Get a list of all script tags

	var tagNameFilter = new TagNameFilter("form");

	var nodesList = parser.extractAllNodesThatMatch(tagNameFilter); 

        if( nodesList.size() > 0 ){

	     return new Result( true, "A form was detected" );

	}

	return new Result( false, "No forms detected" );

}

</code>

</pre>

h2. Meta-Data

ThreatScripts must provide a meta-data that indicates the following information:

| *Name*  | *Valid Input*                                   | *Notes* |

| Name    | <category>.<sub_category>.<definition_name>     |         |

| Version | integer                                         |         |

| ID      | integer                                         |         |

| Message | message to be displayed when definition matches |         |

| Severity| Either: Low, Medium or High                     |         |

{{include(Definition_Naming_Convention)}}