import requests

import demistomock as demisto
from CommonServerPython import *

''' IMPORTS '''

# disable insecure warnings
requests.packages.urllib3.disable_warnings()

THREAT_MINER_URL = demisto.params().get('threatminer_url')
VERIFY_CERTIFICATES = False if demisto.params().get('insecure') else True
DEFAULT_HEADERS = {
    "Content-Type": "application/json"
}
MAX_RETURNED_ARRAY_SIZE = 30

''' HELPER FUNCTIONS '''


def http_request(method, url, headers):
    try:
        res = requests.request(method,
                               url,
                               verify=VERIFY_CERTIFICATES,
                               headers=headers)

        if res.status_code == 200:
            return res.json()
        # 204 HTTP status code is returned when api rate limit has been exceeded
        elif res.status_code == 204:
            return_error("You've reached your API call quota.")
        elif res.status_code == 404:
            return {}

        res.raise_for_status()

    except Exception as e:
        demisto.results({
            'Type': entryTypes['error'],
            'ContentsFormat': formats['text'],
            'Contents': 'error has occured: %s' % (e.message, ),
        })


def get_domain_report_from_threat_miner(domain_name):
    return {
        'raw_whois': get_domain_whois_rawdata(domain_name),
        'raw_passive_dns': get_domain_passive_dns_rawdata(domain_name),
        'raw_sub_domains': get_domain_subdomains_rawdata(domain_name),
        'raw_domain_uris': get_domain_URI_rawdata(domain_name),
        'raw_domain_md5': get_domain_MD5_rawdata(domain_name)
    }


def get_domain_whois_rawdata(domain_name):
    threat_miner_domain_url_postfix = 'domain.php?q={}&rt={}'.format(domain_name, 1)
    response = http_request('GET', THREAT_MINER_URL + threat_miner_domain_url_postfix, DEFAULT_HEADERS)
    domain_whois = response.get('results', [])
    if len(domain_whois) == 0:
        return {}

    return domain_whois[0]


def get_domain_passive_dns_rawdata(domain_name):
    threat_miner_domain_url_postfix = 'domain.php?q={}&rt={}'.format(domain_name, 2)
    response = http_request('GET', THREAT_MINER_URL + threat_miner_domain_url_postfix, DEFAULT_HEADERS)
    threatminer_results_as_array = response.get('results', [])
    if len(threatminer_results_as_array) == 0:
        return []

    return threatminer_results_as_array


def get_domain_passive_dns(passive_dns, max_returned_array_size):
    if max_returned_array_size == -1:
        return passive_dns['raw_passive_dns']
    return passive_dns['raw_passive_dns'][:max_returned_array_size]


def get_domain_subdomains_rawdata(domain_name):
    threat_miner_domain_url_postfix = 'domain.php?q={}&rt={}'.format(domain_name, 5)
    response = http_request('GET', THREAT_MINER_URL + threat_miner_domain_url_postfix, DEFAULT_HEADERS)
    sub_domains_array = response.get('results', [])
    return sub_domains_array


def get_domain_URI_rawdata(domain_name):
    threat_miner_domain_url_postfix = 'domain.php?q={}&rt={}'.format(domain_name, 3)
    response = http_request('GET', THREAT_MINER_URL + threat_miner_domain_url_postfix, DEFAULT_HEADERS)
    uris_full_result = response.get('results', [])
    return uris_full_result


def get_domain_URI(uris_raw_data, max_returned_array_size):
    uri_counter = 0
    uris = []
    for uri_info in uris_raw_data['raw_domain_uris']:
        if max_returned_array_size == -1 or uri_counter < max_returned_array_size:
            uris.append({
                'Address': uri_info['uri'],
                'LastSeen': uri_info['last_seen']
            })
            uri_counter += 1
        else:
            break

    return uris


def get_domain_MD5_rawdata(domain_name):
    threat_miner_domain_url_postfix = 'domain.php?q={}&rt={}'.format(domain_name, 4)
    response = http_request('GET', THREAT_MINER_URL + threat_miner_domain_url_postfix, DEFAULT_HEADERS)
    md5s = response.get('results', [])
    return md5s


def create_domain_command_markdown(domain, context):
    md = '## Threat_miner Domain report for: {}\n'.format(domain)
    threat_miner_found_results = False

    if len(context.get('Whois', '')) != 0:
        md += tableToMarkdown("Whois for {} domain".format(domain), context['Whois'],
                              ['Domain', 'Server', 'CreateDate', 'UpdateDate', 'Expiration', 'NameServers'])
        threat_miner_found_results = True
    if len(context.get('PassiveDNS', '')) != 0:
        md += tableToMarkdown("PassiveDNS for {} domain".format(domain),
                              context['PassiveDNS'], ['IP', 'FirstSeen', 'LastSeen'])
        threat_miner_found_results = True
    if len(context.get('Subdomains', '')) != 0:
        md += tableToMarkdown("{} Subdomains".format(domain), context['Subdomains'],
                              ['Subdomains'])
        threat_miner_found_results = True
    if len(context.get('URI', '')) != 0:
        md += tableToMarkdown("{} URIs".format(domain), context['URI'],
                              ['Address', 'LastSeen'])
        threat_miner_found_results = True
    if len(context.get('MD5', '')) != 0:
        md += tableToMarkdown("{} Related Samples(hash only)".format(domain),
                              context['MD5'], ['hashes'])
        threat_miner_found_results = True

    if not threat_miner_found_results:
        md += 'No results found'

    return md


def domain_command(max_returned_array_size):
    domain_name = demisto.args().get('domain')
    threat_miner_raw_results = get_domain_report_from_threat_miner(domain_name)

    passive_dns = {}
    subdomains = {}
    md5s = {}
    if max_returned_array_size == -1:
        passive_dnses = threat_miner_raw_results['raw_passive_dns']
        subdomains = threat_miner_raw_results['raw_sub_domains']
        md5s = threat_miner_raw_results['raw_domain_md5']
    else:
        passive_dnses = threat_miner_raw_results['raw_passive_dns'][:max_returned_array_size]
        subdomains = threat_miner_raw_results['raw_sub_domains'][:max_returned_array_size]
        md5s = threat_miner_raw_results['raw_domain_md5'][:max_returned_array_size]

    context_passive_dnses = []
    for passive_dns in passive_dnses:
        context_passive_dnses.append({
            'IP': passive_dns['ip'],
            'FirstSeen': passive_dns['first_seen'],
            'LastSeen': passive_dns['last_seen']

        })

    threat_miner_context = {
        'Name': domain_name,
        'Whois': {
            'Server': threat_miner_raw_results['raw_whois']['whois']['whois_server'],
            'CreateDate': threat_miner_raw_results['raw_whois']['whois']['creation_date'],
            'UpdateDate': threat_miner_raw_results['raw_whois']['whois']['updated_date'],
            'Expiration': threat_miner_raw_results['raw_whois']['whois']['expiration_date'],
            'NameServers': threat_miner_raw_results['raw_whois']['whois']['nameservers']
        },
        'PassiveDNS': context_passive_dnses,
        'Subdomains': subdomains,
        'URI': get_domain_URI(threat_miner_raw_results, max_returned_array_size),
        'MD5': md5s
    }

    passive_dnses_ips = []
    for passive_dns in passive_dnses:
        passive_dnses_ips.append(passive_dns['ip'])

    domain_context = {
        "Name": threat_miner_context['Name'],
        "DNS": passive_dnses_ips,
        'Whois': {
            'UpdateDate': threat_miner_context['Whois']['UpdateDate'],
            'CreateDate': threat_miner_context['Whois']['CreateDate'],
            'Expiration': threat_miner_context['Whois']['Expiration'],
            'Registrant': {
                'Name': threat_miner_raw_results['raw_whois']['whois']['tech_info']['Organization'],
                'Email': threat_miner_raw_results['raw_whois']['whois']['emails']['registrant']
            }
        }
    }

    context = {
        'ThreatMiner.Domain(val.Name && val.Name == obj.Name)': threat_miner_context,
        'Domain(val.Name && val.Name == obj.Name)': domain_context
    }

    markdown = create_domain_command_markdown(domain_name, threat_miner_context)

    demisto.results({
        'Type': entryTypes['note'],
        'Contents': threat_miner_raw_results,
        'HumanReadable': markdown,
        'EntryContext': context,
        'ContentsFormat': formats['json']
    })


def get_ip_whois_rawdata(ip_address):
    threat_miner_ip_url_postfix = 'host.php?q={}&rt={}'.format(ip_address, 1)
    response = http_request('GET', THREAT_MINER_URL + threat_miner_ip_url_postfix, DEFAULT_HEADERS)
    whois_rawdata = response.get('results', [])
    if len(whois_rawdata) > 0:
        return whois_rawdata[0]
    return {}


def get_ip_whois(whois_rawdata, ip_address):
    ip_whois_results = {}
    ip_whois_results['Address'] = ip_address
    ip_whois_results['Reverse'] = whois_rawdata['raw_whois']['reverse_name']
    ip_whois_results['Bgp'] = whois_rawdata['raw_whois']['bgp_prefix']
    ip_whois_results['Country'] = whois_rawdata['raw_whois']['cc']
    ip_whois_results['ASN'] = whois_rawdata['raw_whois']['asn']
    ip_whois_results['Org'] = whois_rawdata['raw_whois']['org_name']

    return ip_whois_results


def get_ip_passiveDNS_rawdata(ip_address):
    threat_miner_ip_url_postfix = 'host.php?q={}&rt={}'.format(ip_address, 2)
    response = http_request('GET', THREAT_MINER_URL + threat_miner_ip_url_postfix, DEFAULT_HEADERS)
    passiveDNSArray = response.get('results', [])

    return passiveDNSArray


def get_ip_URI_rawdata(ip_address):
    threat_miner_ip_url_postfix = 'host.php?q={}&rt={}'.format(ip_address, 3)
    response = http_request('GET', THREAT_MINER_URL + threat_miner_ip_url_postfix, DEFAULT_HEADERS)
    uris_rawdata = response.get('results', [])
    return uris_rawdata


def get_ip_URI(threatminer_results_as_array, max_returned_array_size):
    uri_counter = 0
    URIs = []

    for _ in threatminer_results_as_array['raw_ip_uris']:
        if max_returned_array_size == -1 or uri_counter < max_returned_array_size:
            URIs.append({
                'Address': threatminer_results_as_array['raw_ip_uris'][uri_counter]['uri'],
                'LastSeen': threatminer_results_as_array['raw_ip_uris'][uri_counter]['last_seen']
            })
            uri_counter += 1
        else:
            break

    return URIs


def get_ip_MD5_rawdata(ip_address):
    threat_miner_domain_url_postfix = 'host.php?q={}&rt={}'.format(ip_address, 4)
    response = http_request('GET', THREAT_MINER_URL + threat_miner_domain_url_postfix, DEFAULT_HEADERS)

    md5s = response.get('results', [])

    if len(md5s) == 0:
        return []
    return md5s


def get_ip_SSL_rawdata(ip_address):
    threat_miner_domain_url_postfix = 'host.php?q={}&rt={}'.format(ip_address, 5)
    response = http_request('GET', THREAT_MINER_URL + threat_miner_domain_url_postfix, DEFAULT_HEADERS)

    ssls_raw_data = response.get('results', [])
    return ssls_raw_data


def create_ip_command_markdown(ip_address, context):
    md = '## Threat_miner IP report for: {}\n'.format(ip_address)
    threat_miner_found_results = False

    if len(context['Whois']) != 0:
        md += tableToMarkdown("Whois for {}".format(ip_address), context['Whois'],
                              ['Address', 'Country', 'Org', 'Bgp', 'Reverse', 'ASN'])
        threat_miner_found_results = True
    if len(context['PassiveDNS']) != 0:
        md += tableToMarkdown("PassiveDNS for {}".format(ip_address), context['PassiveDNS'],
                              ['Domain', 'FirstSeen', 'LastSeen'])
        threat_miner_found_results = True
    if len(context['URI']) != 0:
        md += tableToMarkdown("{} URIs".format(ip_address), context['URI'],
                              ['Address', 'LastSeen'])
        threat_miner_found_results = True
    if len(context['MD5']) != 0:
        md += tableToMarkdown("{} MD5s".format(ip_address), context['MD5'], ['MD5'])
        threat_miner_found_results = True
    if len(context['SSL']) != 0:
        md += tableToMarkdown("{} SSLs".format(ip_address), context['SSL'], ['SSL'])
        threat_miner_found_results = True

    if not threat_miner_found_results:
        md += 'No results found'

    return md


def get_ip_report_from_threat_miner(ip_address):
    return {
        'raw_whois': get_ip_whois_rawdata(ip_address),
        'raw_passive_dns': get_ip_passiveDNS_rawdata(ip_address),
        'raw_ip_md5': get_ip_MD5_rawdata(ip_address),
        'raw_ip_uris': get_ip_URI_rawdata(ip_address),
        'raw_ip_ssl': get_ip_SSL_rawdata(ip_address)
    }


def get_passive_dns(threat_miner_raw_results):
    passive_dnses = []
    for passive_dns in threat_miner_raw_results['raw_passive_dns']:
        passive_dnses.append({
            "Domain": passive_dns['domain'],
            "FirstSeen": passive_dns['first_seen'],
            "LastSeen": passive_dns['last_seen']
        })
    return passive_dnses


def ip_command(max_returned_array_size):
    ip_address = demisto.args().get('ip')
    if not is_ip_valid(ip_address):
        return_error('An invalid IP was specified')
    threat_miner_raw_results = get_ip_report_from_threat_miner(ip_address)
    passiveDnses = get_passive_dns(threat_miner_raw_results)
    md5s = {}
    ssls = {}

    if max_returned_array_size == -1:
        passiveDns = passiveDnses
        md5s = threat_miner_raw_results['raw_ip_md5']
        ssls = threat_miner_raw_results['raw_ip_ssl']
    else:
        ssls = threat_miner_raw_results['raw_ip_ssl'][:max_returned_array_size]
        passiveDns = passiveDnses[:max_returned_array_size]
        md5s = threat_miner_raw_results['raw_ip_md5'][:max_returned_array_size]

    threat_miner_context = {
        'Address': ip_address,
        'Whois': {
            'Address': ip_address,
            'Reverse': threat_miner_raw_results['raw_whois'].get('reverse_name'),
            'Bgp': threat_miner_raw_results['raw_whois'].get('bgp_prefix'),
            'Country': threat_miner_raw_results['raw_whois'].get('cc'),
            'ASN': threat_miner_raw_results['raw_whois'].get('asn'),
            'Org': threat_miner_raw_results['raw_whois'].get('org_name')
        },
        'PassiveDNS': passiveDns,
        'MD5': md5s,
        'URI': get_ip_URI(threat_miner_raw_results, max_returned_array_size),
        'SSL': ssls
    }

    markdown = create_ip_command_markdown(ip_address, threat_miner_context)
    ipcontext = {
        "IP.Address": threat_miner_context['Address'],
        "IP.Geo.Country": threat_miner_context['Whois']['Country'],
        "IP.ASN": threat_miner_context['Whois']['ASN'],
    }
    context = {
        'ThreatMiner.IP(val.Address && val.Address == obj.Address)': threat_miner_context,
        'IP(val.Address && val.Address == obj.Address)': ipcontext
    }

    demisto.results(
        {'Type': entryTypes['note'],
         'Contents': threat_miner_raw_results,
         'HumanReadable': markdown,
         'EntryContext': context,
         'ContentsFormat': formats['json']})


def get_file_whois_rawdata(hashed_file):
    threat_miner_ip_url_postfix = 'sample.php?q={}&rt={}'.format(hashed_file, 1)
    response = http_request('GET', THREAT_MINER_URL + threat_miner_ip_url_postfix, DEFAULT_HEADERS)
    threatminer_results_as_array = response.get('results', [])

    if len(threatminer_results_as_array) == 0:
        return threatminer_results_as_array

    return threatminer_results_as_array[0]


def get_file_http_rawdata(hashed_file):
    threat_miner_domain_url_postfix = 'sample.php?q={}&rt={}'.format(hashed_file, 2)
    response = http_request('GET', THREAT_MINER_URL + threat_miner_domain_url_postfix, DEFAULT_HEADERS)
    file_http_raw_data = response.get('results', [])
    return file_http_raw_data


def get_file_http(file_http_raw_data, max_returned_array_size):
    if len(file_http_raw_data['raw_file_https']) == 0:
        return []

    file_http = file_http_raw_data['raw_file_https'][0]
    http_traffics = file_http['http_traffic']

    http_traffic_counter = 0
    http_traffics_info = []

    for _ in http_traffics:
        if max_returned_array_size == -1 or http_traffic_counter < max_returned_array_size:
            http_traffics_info.append({
                'Domain': http_traffics[http_traffic_counter]['domain'],
                'URL': http_traffics[http_traffic_counter]['url'],
                'Useragent': http_traffics[http_traffic_counter]['user_agent']
            })
            http_traffic_counter += 1
        else:
            break
    return http_traffics_info


def get_file_domains_and_ip_rawdata(hashed_file):
    threat_miner_domain_url_postfix = 'sample.php?q={}&rt={}'.format(hashed_file, 3)
    response = http_request('GET', THREAT_MINER_URL + threat_miner_domain_url_postfix, DEFAULT_HEADERS)
    domain_and_ip_raw_data = response.get('results', [])
    return domain_and_ip_raw_data


def get_file_domains_and_ip(domain_and_ip_raw_data, max_returned_array_size):
    if len(domain_and_ip_raw_data['raw_file_domains']) == 0:
        return {}

    counter = 0
    domains_and_ips = []
    for domain_and_ip in domain_and_ip_raw_data['raw_file_domains'][0]['domains']:
        if max_returned_array_size == -1 or counter < max_returned_array_size:
            domains_and_ips.append({
                'Domain': domain_and_ip['domain'],
                'IP': domain_and_ip['ip']
            })
        else:
            break
    return domains_and_ips


def get_file_mutants_rawdata(hashed_file):
    threat_miner_domain_url_postfix = 'sample.php?q={}&rt={}'.format(hashed_file, 4)
    response = http_request('GET', THREAT_MINER_URL + threat_miner_domain_url_postfix, DEFAULT_HEADERS)
    mutants_rawdata = response.get('results', [])
    return mutants_rawdata


def get_file_mutants(mutants_rawdata, max_returned_array_size):
    if len(mutants_rawdata['raw_file_mutants']) == 0:
        return {}

    file_mutants = mutants_rawdata['raw_file_mutants'][0]
    if max_returned_array_size == -1:
        return file_mutants['mutants']
    return file_mutants['mutants'][:max_returned_array_size]


def get_file_registry_keys_rawdata(hashed_file):
    threat_miner_domain_url_postfix = 'sample.php?q={}&rt={}'.format(hashed_file, 5)
    response = http_request('GET', THREAT_MINER_URL + threat_miner_domain_url_postfix, DEFAULT_HEADERS)

    threatminer_results_as_array = response.get('results', [])
    if len(threatminer_results_as_array) == 0:
        return {}
    return threatminer_results_as_array[0]


def get_file_registry_keys(file_registry_keys, max_returned_array_size):
    if len(file_registry_keys['raw_file_registry']) == 0:
        return {}

    if max_returned_array_size == -1:
        return file_registry_keys['raw_file_registry']['registry_keys']
    return file_registry_keys['raw_file_registry']['registry_keys'][:max_returned_array_size]


def get_file_AV_detection_rawdata(hashed_file):
    threat_miner_domain_url_postfix = 'sample.php?q={}&rt={}'.format(hashed_file, 6)
    response = http_request('GET', THREAT_MINER_URL + threat_miner_domain_url_postfix, DEFAULT_HEADERS)

    raw_file_av_dectection = response.get('results', {})
    return raw_file_av_dectection


def get_file_AV_detection(raw_file_av_dectection):
    if len(raw_file_av_dectection['raw_file_av']) == 0:
        return {}

    av_detections = []
    for av_detection in raw_file_av_dectection['raw_file_av'][0]['av_detections']:
        av_detections.append({
            'Name': av_detection['av'],
            'Detection': av_detection['detection']
        })
    return av_detections


def get_file_report_from_threat_miner(hashed_file):
    return {
        'raw_whois': get_file_whois_rawdata(hashed_file),
        'raw_file_https': get_file_http_rawdata(hashed_file),
        'raw_file_domains': get_file_domains_and_ip_rawdata(hashed_file),
        'raw_file_mutants': get_file_mutants_rawdata(hashed_file),
        'raw_file_registry': get_file_registry_keys_rawdata(hashed_file),
        'raw_file_av': get_file_AV_detection_rawdata(hashed_file)
    }


def get_dbot_scores_context(threat_miner_raw_results, file_context, hashed_file):
    amount_of_detections = len(threat_miner_raw_results.get('AV', ''))
    dbot_scores = get_dbot_score_report(amount_of_detections, hashed_file, file_context)
    return dbot_scores


def file_command(max_returned_array_size):
    hashed_file = demisto.args().get('file')
    threat_miner_raw_results = get_file_report_from_threat_miner(hashed_file)

    threat_miner_context = {
        'MD5': threat_miner_raw_results['raw_whois'].get('md5', ''),
        'Architecture': threat_miner_raw_results['raw_whois'].get('architecture', ''),
        'SHA1': threat_miner_raw_results['raw_whois'].get('sha1', ''),
        'SHA256': threat_miner_raw_results['raw_whois'].get('sha256', ''),
        'Type': threat_miner_raw_results['raw_whois'].get('file_type', ''),
        'Name': threat_miner_raw_results['raw_whois'].get('file_name', ''),
        'Size': threat_miner_raw_results['raw_whois'].get('file_size', ''),
        'Analyzed': threat_miner_raw_results['raw_whois'].get('date_analysed', ''),
        'HTTP': get_file_http(threat_miner_raw_results, max_returned_array_size),
        'Domains': get_file_domains_and_ip(threat_miner_raw_results, max_returned_array_size),
        'Mutants': get_file_mutants(threat_miner_raw_results, max_returned_array_size),
        'Registry': get_file_registry_keys(threat_miner_raw_results, max_returned_array_size),
        'AV': get_file_AV_detection(threat_miner_raw_results)
    }
    markdown = create_file_command_markdown(hashed_file, threat_miner_context)

    file_context = {
        'MD5': threat_miner_raw_results['raw_whois'].get('md5', ''),
        'Architecture': threat_miner_raw_results['raw_whois'].get('architecture', ''),
        'SHA1': threat_miner_raw_results['raw_whois'].get('sha1', ''),
        'SHA256': threat_miner_raw_results['raw_whois'].get('sha256', ''),
        'Type': threat_miner_raw_results['raw_whois'].get('file_type', ''),
        'Name': threat_miner_raw_results['raw_whois'].get('file_name', ''),
        'Size': threat_miner_raw_results['raw_whois'].get('file_size', ''),
        'Analyzed': threat_miner_raw_results['raw_whois'].get('date_analysed', '')
    }
    dbot_scores = get_dbot_scores_context(threat_miner_context, file_context, hashed_file)

    context = {
        'ThreatMiner.File(val.MD5 && val.MD5 == obj.MD5)': threat_miner_context,
        'File(val.MD5 && val.MD5 == obj.MD5)': file_context,
        'DBotScore': dbot_scores
    }

    return demisto.results({'Type': entryTypes['note'],
                            'Contents': threat_miner_raw_results,
                            'HumanReadable': markdown,
                            'EntryContext': context,
                            'ContentsFormat': formats['json']})


def get_dbot_score_report(amount_of_detections, hashed_file, file_context):
    dbot = {}
    dbot_score = get_dbot_score(amount_of_detections)
    dbot['Score'] = dbot_score
    dbot['Indicator'] = hashed_file
    dbot['Type'] = 'File'
    dbot['Vendor'] = 'ThreatMiner'

    if dbot_score == 3:
        file_context['Malicious'] = {}
        file_context['Malicious']['Vendor'] = 'ThreatMiner'
        file_context['Malicious']['Detections'] = amount_of_detections
    return dbot


def get_dbot_score(amount_of_detections):
    malicious_threshold = int(demisto.args().get('threshold'))
    if amount_of_detections == 0:
        return 0
    if amount_of_detections > 0 and amount_of_detections < malicious_threshold:
        return 2
    if amount_of_detections >= malicious_threshold:
        return 3


def create_file_command_markdown(hashed_file, File_context):
    md = '## Threat_miner file report for hashed file: {}\n'.format(hashed_file)
    threat_miner_found_results = False

    md += '\n'
    md += '**File MD5:** {}'.format(hashed_file)
    md += '\n'
    md += '**File Architecture:** {}'.format(File_context.get('Architecture', 'Unkown'))
    md += '\n'
    md += '**File SHA1:** {}'.format(File_context.get('Sha1', 'Unknown'))
    md += '\n'
    md += '**File SHA256:** {}'.format(File_context.get('Sha256', 'Unkown'))
    md += '\n'
    md += '**File Type:** {}'.format(File_context.get('Type', 'Unkown'))
    md += '\n'
    md += '**File Name:** {}'.format(File_context.get('Name', 'Unkown'))
    md += '\n'
    md += '**File Size:** {}'.format(File_context.get('Size', 'Unkown'))
    md += '\n'
    md += '**File Analyzed:** {}'.format(File_context.get('Analyzed', 'Unkown'))

    if len(File_context.get('HTTP', '')) != 0:
        md += tableToMarkdown("HTTP for hashed file {}".format(hashed_file),
                              File_context['HTTP'], ['Domain', 'URL', 'Useragent'])
        threat_miner_found_results = True
    if len(File_context.get('Domains', '')) != 0:
        md += tableToMarkdown("Hashed file: {} Domains".format(hashed_file),
                              File_context['Domains'], ['Domain', 'IP'])
        threat_miner_found_results = True
    if len(File_context.get('Mutants', '')) != 0:
        md += tableToMarkdown("Hashed file: {} Mutants".format(hashed_file),
                              File_context['Mutants'], ['Mutants'])
        threat_miner_found_results = True
    if len(File_context.get('Registry', '')) != 0:
        md += tableToMarkdown("Hashed file: {} Registry keys".format(hashed_file),
                              File_context['Registry'], ['Registry'])
        threat_miner_found_results = True
    if len(File_context.get('AV', '')) != 0:
        md += tableToMarkdown("Hashed file: {} Anti Virus detections".format(hashed_file),
                              File_context['AV'], ['Name', 'Detection'])
        threat_miner_found_results = True

    if not threat_miner_found_results:
        md += 'No results found'

    return md


def delete_proxy_if_asked():
    if not demisto.params()['proxy']:
        del os.environ['HTTP_PROXY']
        del os.environ['HTTPS_PROXY']
        del os.environ['http_proxy']
        del os.environ['https_proxy']

    ''' EXECUTION CODE '''


try:
    delete_proxy_if_asked()
    demisto_command = demisto.command()
    if demisto_command == 'test-module':
        report = get_ip_whois_rawdata('8.8.8.8')

        if 'asn' in report:
            demisto.results('ok')
        else:
            demisto.results('test failed')

    if demisto.params().get('limit_results').lower() == 'all':
        max_array_size = -1
    else:
        max_array_size = int(demisto.params().get('limit_results', MAX_RETURNED_ARRAY_SIZE))

    if demisto_command == 'domain':
        domain_command(max_array_size)

    if demisto_command == 'ip':
        ip_command(max_array_size)

    if demisto_command == 'file':
        file_command(max_array_size)

except Exception as e:
    demisto.results({
        'Type': entryTypes['error'],
        'ContentsFormat': formats['text'],
        'Contents': 'error has occured: %s' % (e.message, ),
    })
