MISP
/
MISP-Taxii-Server
mirror of https://github.com/MISP/MISP-Taxii-Server
2
0
Fork 0
Code Issues Releases Wiki Activity

Checking for MISP existence

pull/82/head
haraksin 2020-06-15 19:24:18 -07:00
parent 67f9c52def
commit 0aaed66540
1 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
misp_taxii_hooks/hooks.py
View File

@ -71,6 +71,7 @@ else:
"collections": misp_collections "collections": misp_collections
} }
} }
MISP = ''
try: try:
MISP = pymisp.PyMISP( MISP = pymisp.PyMISP(
CONFIG["misp"]["url"], CONFIG["misp"]["url"],
@ -126,7 +127,9 @@ def post_stix(manager, content_block, collection_ids, service_id):
): ):
for attrib in values: for attrib in values:
log.info("Checking for existence of %s", attrib) log.info("Checking for existence of %s", attrib)
search = MISP.search("attributes", values=str(attrib)) search = ''
if MISP:
search = MISP.search("attributes", values=str(attrib))
if 'response' in search: if 'response' in search:
if search["response"]["Attribute"] != []: if search["response"]["Attribute"] != []:
# This means we have it! # This means we have it!
@ -151,16 +154,19 @@ def post_stix(manager, content_block, collection_ids, service_id):
# But I don't wanna read docs # But I don't wanna read docs
if (len(package.attributes) > 0): if (len(package.attributes) > 0):
log.info("Uploading event to MISP with attributes %s", [x.value for x in package.attributes]) log.info("Uploading event to MISP with attributes %s", [x.value for x in package.attributes])
event = ''
try: try:
event = MISP.add_event(package) if MISP:
except ConnectionError: event = MISP.add_event(package)
except ConnectionError, NameError:
log.error("Cannot push to MISP; please ensure that MISP is up and running at {}. Skipping MISP upload.".format(CONFIG['misp']['url'])) log.error("Cannot push to MISP; please ensure that MISP is up and running at {}. Skipping MISP upload.".format(CONFIG['misp']['url']))
if ( if (
CONFIG["misp"]["publish"] == True or CONFIG["misp"]["publish"] == True or
CONFIG["misp"]["publish"] == "True" CONFIG["misp"]["publish"] == "True"
): ):
log.info("Publishing event to MISP with ID {}".format(event.get('uuid'))) log.info("Publishing event to MISP with ID {}".format(event.get('uuid')))
MISP.publish(event) if MISP:
MISP.publish(event)
else: else:
log.info("Skipping MISP event publishing") log.info("Skipping MISP event publishing")
else: else: