### Bloxnone GSIRT IOC blocks script 

This script reads the latest version of the domain_blocks.txt and uploads it to the custom name list on csp.infoblox.com

By using PUT method, old version of the block list is replaced with the newer version. 

### Custom name list

The Custom List Items represent the list of the FQDN to define allow list and block list for additional protection.

There is a custom name list based on GSIRT provided domain that will be used by TheOrchard_Policy.

* GSIRT_ioc_domain_block_list

Each custom name list has id associated with it that is consumed the bloxone API.

Custom list ids can be retrieved by using GET request API.
https://csp.infoblox.com/api/atcfw/v1/named_lists

* GSIRT_ioc_domain_block_list = 690221
 
There is a custom list that can be used for testing only.
* test_ioc_domain_block_list = 704905

### Bloxone authentication

Bloxone API uses token based authentication. Script retrieves api token during runtime from the secretsmanager.

### Running script locally

Switch the name list id to use the test ones in config.py if testing in dev
* GSIRT_ioc_domain_block_list = 704905

```
python3.10 -m venv env 
source env/bin/activate

pip install -U pip

pip install requests
pip install boto3

export Environment=dev
export SERVICE_NAME=bloxone
export AWS_DEFAULT_REGION=us-east-1

python bloxone_ioc_blocks.py

Script should return http code 201.
```