@@ -0,0 +1,1831 @@
+from django.core.management.base import BaseCommand, CommandError%0A%0Aimport urllib2%0Aimport re%0A%0ASTORE_FOLDER = '/usr/local/third_party_ips'%0A %0AET_COMPROMISED_IPS_URL = 'https://rules.emergingthreatspro.com/blockrules/compromised-ips.txt'%0AET_COMPROMISED_IPS_REV = 'https://rules.emergingthreatspro.com/blockrules/COMPrev'%0AET_COMPROMISED_IPS_CONTENT_FILE = 'et_compromised_ips'%0AET_COMPROMISED_IPS_REV_FILE = 'et_compromised_ips.rev' %0A%0ADSHIELD_BLOCK_URL = 'https://isc.sans.edu/block.txt'%0ADSHIELD_BLOCK_CONTENT_FILE = 'dshield_block'%0ADSHIELD_BLOCK_REV_FILE = 'dshield_block.rev'%0A%0Aclass Command(BaseCommand):%0A    help = 'Update 3rd party rules (et and dshield)'%0A    %0A    def handle(self, *args, **options):%0A        self._et_compromised_ips()%0A        self._dshield_block()%0A%0A    def _et_compromised_ips(self):%0A        url = urllib2.urlopen(ET_COMPROMISED_IPS_URL)%0A        f = open('%25s/%25s' %25 (STORE_FOLDER, ET_COMPROMISED_IPS_CONTENT_FILE), 'w')%0A        f.write(url.read())%0A        f.close()%0A        %0A        url = urllib2.urlopen(ET_COMPROMISED_IPS_REV)%0A        f = open('%25s/%25s' %25 (STORE_FOLDER, ET_COMPROMISED_IPS_REV_FILE), 'w')%0A        f.write(url.read())%0A        f.close()%0A    %0A    def _dshield_block(self):%0A        url = urllib2.urlopen(DSHIELD_BLOCK_URL)%0A        f = open('%25s/%25s' %25 (STORE_FOLDER, DSHIELD_BLOCK_CONTENT_FILE), 'w')%0A        content = url.read()%0A        networks = ''%0A        for l in content.splitlines():%0A            res = re.search('%5E(%5Cd+%5C.%5Cd+.%5Cd+%5C.%5Cd+)%5Ct(%5Cd+%5C.%5Cd+.%5Cd+%5C.%5Cd+)%5Ct(%5Cd+)%5Ct', l)%0A            if res:%0A                networks += '%25s/%25s%5Cn' %25 (res.group(1), res.group(3))%0A        f.write(networks)%0A        f.close()%0A        %0A        f = open('%25s/%25s' %25 (STORE_FOLDER, DSHIELD_BLOCK_REV_FILE), 'w')%0A        rev = re.search('updated: (.*)%5Cn', content, re.IGNORECASE).group(1)%0A        f.write(rev)%0A        f.close()%0A

Update third party rules script