#!/usr/bin/env python3 # -*-coding:UTF-8 -* import os import sys from pymisp import MISPEvent, MISPObject from pymisp.tools.abstractgenerator import AbstractMISPObjectGenerator MISPEvent from packages import Paste import datetime import json from io import BytesIO sys.path.append(os.path.join(os.environ['AIL_BIN'], 'lib/')) import ConfigLoader import item_basic sys.path.append(os.path.join(os.environ['AIL_BIN'], 'export')) import MispExport class ObjectWrapper: def __init__(self, pymisp): self.pymisp = pymisp self.currentID_date = None self.eventID_to_push = self.get_daily_event_id() config_loader = ConfigLoader.ConfigLoader() self.maxDuplicateToPushToMISP = config_loader.get_config_int("ailleakObject", "maxDuplicateToPushToMISP") config_loader = None self.attribute_to_tag = None def add_new_object(self, uuid_ail, item_id, tag): self.uuid_ail = uuid_ail # self.paste = Paste.Paste(path) # temp = self.paste._get_p_duplicate() # # #beautifier # if not temp: # temp = '' # # p_duplicate_number = len(temp) if len(temp) >= 0 else 0 # # to_ret = "" # for dup in temp[:10]: # dup = dup.replace('\'','\"').replace('(','[').replace(')',']') # dup = json.loads(dup) # algo = dup[0] # path = dup[1].split('/')[-6:] # path = '/'.join(path)[:-3] # -3 removes .gz # if algo == 'tlsh': # perc = 100 - int(dup[2]) # else: # perc = dup[2] # to_ret += "{}: {} [{}%]\n".format(path, algo, perc) # p_duplicate = to_ret return MispExport.export_ail_item(item_id, [tag]) def date_to_str(self, date): return "{0}-{1}-{2}".format(date.year, date.month, date.day) def get_all_related_events(self, to_search): result = self.pymisp.search(controller='events', eventinfo=to_search, metadata=False) events = [] if result: for e in result: events.append({'id': e['Event']['id'], 'org_id': e['Event']['org_id'], 'info': e['Event']['info']}) return events def get_daily_event_id(self): to_match = "Daily AIL-leaks {}".format(datetime.date.today()) events = self.get_all_related_events(to_match) for dic in events: info = dic['info'] e_id = dic['id'] if info == to_match: print('Found: ', info, '->', e_id) self.currentID_date = datetime.date.today() return e_id created_event = self.create_daily_event() new_id = created_event['Event']['id'] print('New event created:', new_id) self.currentID_date = datetime.date.today() return new_id def create_daily_event(self): today = datetime.date.today() # [0-3] distribution = 0 info = "Daily AIL-leaks {}".format(today) # [0-2] analysis = 0 # [1-4] threat = 3 published = False org_id = None orgc_id = None sharing_group_id = None date = None event = MISPEvent() event.distribution = distribution event.info = info event.analysis = analysis event.threat = threat event.published = published event.add_tag('infoleak:output-format="ail-daily"') existing_event = self.pymisp.add_event(event) return existing_event # Publish object to MISP def pushToMISP(self, uuid_ail, item_id, tag): if self.currentID_date != datetime.date.today(): #refresh id self.eventID_to_push = self.get_daily_event_id() mispTYPE = 'ail-leak' # paste object already exist if self.paste_object_exist(self.eventID_to_push, item_id): # add new tag self.tag(self.attribute_to_tag, tag) print(item_id + ' tagged: ' + tag) #create object else: misp_obj = self.add_new_object(uuid_ail, item_id, tag) # deprecated # try: # templateID = [x['ObjectTemplate']['id'] for x in self.pymisp.get_object_templates_list() if x['ObjectTemplate']['name'] == mispTYPE][0] # except IndexError: # valid_types = ", ".join([x['ObjectTemplate']['name'] for x in self.pymisp.get_object_templates_list()]) # print ("Template for type %s not found! Valid types are: %s" % (mispTYPE, valid_types)) r = self.pymisp.add_object(self.eventID_to_push, misp_obj, pythonify=True) if 'errors' in r: print(r) else: print('Pushed:', tag, '->', item_id) def paste_object_exist(self, eventId, item_id): res = self.pymisp.search(controller='attributes', eventid=eventId, value=item_id) # object already exist if res.get('Attribute', []): self.attribute_to_tag = res['Attribute'][0]['uuid'] return True # new object else: return False def tag(self, uuid, tag): self.pymisp.tag(uuid, tag)