MISP
/
MISP-maltego
mirror of https://github.com/MISP/MISP-maltego
2
0
Fork 0
Code Issues Releases Wiki Activity

new: [transform] from MISPObject to Event

pull/15/head
Christophe Vandeplas 2019-05-24 16:54:34 +02:00
parent 442d297b8e
commit 517c616877
1 changed files with 12 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
src/MISP_maltego/transforms/attributetoevent.py
View File

@ -76,7 +76,7 @@ class AttributeToEvent(Transform):
def do_transform(self, request, response, config): def do_transform(self, request, response, config):
# skip some Entities # skip some Entities
skip = ['properties.mispevent', 'properties.mispobject'] skip = ['properties.mispevent']
for i in skip: for i in skip:
if i in request.entity.fields: if i in request.entity.fields:
return response return response
@ -86,14 +86,22 @@ class AttributeToEvent(Transform):
pass pass
misp = get_misp_connection(config) misp = get_misp_connection(config)
# special Entities # from Galaxy
if 'properties.mispgalaxy' in request.entity.fields: if 'properties.mispgalaxy' in request.entity.fields:
tag_name = get_entity_property(request.entity, 'tag_name') tag_name = get_entity_property(request.entity, 'tag_name')
if not tag_name: if not tag_name:
tag_name = request.entity.value tag_name = request.entity.value
events_json = misp.search(controller='events', tags=tag_name, withAttachments=False) events_json = misp.search(controller='events', tags=tag_name, withAttachments=False)
# from Object
# standard Entities elif 'properties.mispobject' in request.entity.fields:
if request.entity.fields.get('event_id'):
events_json = misp.search(controller='events', eventid=request.entity.fields.get('event_id').value, withAttachments=False)
for e in events_json['response']:
response += event_to_entity(e, link_direction=LinkDirection.OutputToInput)
return response
else:
return response
# standard Entities (normal attributes)
else: else:
events_json = misp.search(controller='events', values=request.entity.value, withAttachments=False) events_json = misp.search(controller='events', values=request.entity.value, withAttachments=False)