From 6056501ff42eedc50fb5531ae03efad80da0cce4 Mon Sep 17 00:00:00 2001 From: haraksin Date: Mon, 15 Jun 2020 18:08:33 -0700 Subject: [PATCH] Adding checking if connection to MISP is valid --- .gitignore | 3 ++- misp_taxii_hooks/hooks.py | 18 ++++++++++++++---- 2 files changed, 16 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index 7bf4e3a..18aa560 100644 --- a/.gitignore +++ b/.gitignore @@ -6,4 +6,5 @@ config.yaml __pycache__ build dist -src \ No newline at end of file +src +vscode/ \ No newline at end of file diff --git a/misp_taxii_hooks/hooks.py b/misp_taxii_hooks/hooks.py index 1fce618..6325a81 100644 --- a/misp_taxii_hooks/hooks.py +++ b/misp_taxii_hooks/hooks.py @@ -11,8 +11,15 @@ import logging from pyaml import yaml from yaml import Loader from io import StringIO +from requests.exceptions import ConnectionError +logging_level = logging.INFO log = logging.getLogger("__main__") +log.setLevel(logging_level) +handler.setLevel(logging_level) +formatter = logging.Formatter('%(asctime)s - %(name)s - %(levelname)s - %(message)s') +handler.setFormatter(formatter) + from opentaxii.signals import ( CONTENT_BLOCK_CREATED, INBOX_MESSAGE_CREATED @@ -25,7 +32,7 @@ def env_config_helper(env_name): return name.split(',') return os.environ[env_name] else: - print("Missing env setting {0}. Set OPENTAXII_CONFIG or {0}.".format(env_name)) + log.error("Missing env setting {0}. Set OPENTAXII_CONFIG or {0}.".format(env_name)) return "UNKNOWN" def yaml_config_helper(config_name, CONFIG): @@ -38,7 +45,7 @@ def yaml_config_helper(config_name, CONFIG): ## CONFIG if "OPENTAXII_CONFIG" in os.environ: - print("Using config from {}".format(os.environ["OPENTAXII_CONFIG"])) + log.info("Using config from {}".format(os.environ["OPENTAXII_CONFIG"])) CONFIG = yaml.load(open(os.environ["OPENTAXII_CONFIG"], "r"), Loader=Loader) # validate dedup and collections and publish CONFIG = yaml_config_helper("dedup", CONFIG) @@ -46,7 +53,7 @@ if "OPENTAXII_CONFIG" in os.environ: CONFIG = yaml_config_helper("publish", CONFIG) else: - print("Trying to use env variables...") + log.debug("Trying to use env variables...") misp_url = env_config_helper("MISP_URL") misp_api = env_config_helper("MISP_API") misp_dedup = env_config_helper("MISP_DEDUP") @@ -139,7 +146,10 @@ def post_stix(manager, content_block, collection_ids, service_id): # But I don't wanna read docs if (len(package.attributes) > 0): log.info("Uploading event to MISP with attributes %s", [x.value for x in package.attributes]) - event = MISP.add_event(package) + try: + event = MISP.add_event(package) + except ConnectionError: + log.error("MISP-Taxii-Server - Cannot connect to MISP; please ensure that MISP is up and running at {}. Skipping MISP upload.".format(CONFIG['misp']['url'])) if ( CONFIG["misp"]["publish"] == True or CONFIG["misp"]["publish"] == "True"