splunk-security_content/playbooks/custom_functions/base64_decode.py

def base64_decode(input_string=None, split_input=None, delimiter=None, **kwargs):
    """
    Decode one or more strings encoded with base64. The input can be a single chunk of base64 or a list of strings separated by a delimiter.
    
    Args:
        input_string (CEF type: *): Y2FsYy5leGU=
        split_input: Defaults to False. If True, use the delimiter to split the input string and decode each of the components separately if it is base64.
        delimiter: The character to use as a delimiter if split_input is True. Defaults to a comma. The special option "space" can be used to split on a single space character (" ").
    
    Returns a JSON-serializable object that implements the configured data paths:
        *.input_string (CEF type: *): Base64 string before being decoded
        *.output_string (CEF type: *): Resulting string after decoding from base64
    """
    ############################ Custom Code Goes Below This Line #################################
    import json
    import phantom.rules as phantom
    import base64

    if not input_string or not isinstance(input_string, str):
        raise ValueError('input_string must be a string')

    def isBase64(sb):
        try:
            if isinstance(sb, str):
                # If there's any unicode here, an exception will be thrown and the function will return false
                sb_bytes = bytes(sb, 'ascii')
            elif isinstance(sb, bytes):
                sb_bytes = sb
            else:
                raise ValueError("Argument must be string or bytes")
            return base64.b64encode(base64.b64decode(sb_bytes)) == sb_bytes
        except Exception:
            return False
    
    outputs = []
    
    # split_input defaults to false
    if split_input == True or (isinstance(split_input, str) and split_input.lower() == 'true'):
        split_input = True
    else:
        split_input = False
        
    # create the list of inputs, whether it be the single input or a delimiter-separated list
    if not split_input:
        input_list = [input_string]
    else:
        if not isinstance(delimiter, str):
            delimiter = ','
        if delimiter == 'space':
            delimiter = ' '
        input_list = input_string.split(delimiter)
    
    # now that input_list is set up, perform the base64 decode on each item that is valid base64
    for index, value in enumerate(input_list):         
        if isBase64(value):
            try:
                value_bytes = value.encode('ascii')
                data = base64.b64decode(value_bytes, validate=True)
                if data:
                    outputs.append({'input_string': value, 'output_string': data.decode('ascii').replace('\x00','')})

            except Exception as e:
                phantom.error(f'Unable to decode string: {e}')

    assert json.dumps(outputs)  # Will raise an exception if the :outputs: object is not JSON-serializable
    return outputs