MISP
/
MISP-maltego
mirror of https://github.com/MISP/MISP-maltego
2
0
Fork 0
Code Issues Releases Wiki Activity

chg: [relations] Favor machines for Event relations

pull/15/head
Christophe Vandeplas 2019-02-09 07:46:46 +01:00
parent 7b6796cda2
commit 521e2cd38a
3 changed files with 36 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
src/MISP_maltego/resources/maltego/misp_MISPEventToAll.machine
View File

@ -1,12 +1,19 @@
machine("misp.MISPEventToAll", machine("misp.MISPEventToAll",
displayName:"Event to All", displayName:"Event to All",
author:"Christophe Vandeplas", author:"Christophe Vandeplas",
description: "Automatically expands MISP Objects to their attributes") { description: "Automatically expands MISP Objects to their attributes") {
start { start {
run("MISP_maltego.EventToAttributes") run("MISP_maltego.EventToAttributes")
paths { run("MISP_maltego.AttributeToEvent")
run("MISP_maltego.ObjectToAttributes") paths {
run("MISP_maltego.GalaxyToRelations") path {
} run("MISP_maltego.ObjectToAttributes")
} run("MISP_maltego.AttributeToEvent")
} }
path {
run("MISP_maltego.GalaxyToRelations")
}
}
}
}

16
src/MISP_maltego/transforms/attributetoevent.py
View File

@ -1,6 +1,4 @@
from canari.maltego.entities import Hash, Domain, IPv4Address, URL, DNSName, AS, Website, NSRecord, PhoneNumber, EmailAddress, File, Hashtag, Company, Alias, Twitter
from canari.maltego.transform import Transform from canari.maltego.transform import Transform
from canari.maltego.message import Bookmark
# from canari.framework import EnableDebugWindow # from canari.framework import EnableDebugWindow
from MISP_maltego.transforms.common.util import get_misp_connection, event_to_entity, get_attribute_in_event, attribute_to_entity from MISP_maltego.transforms.common.util import get_misp_connection, event_to_entity, get_attribute_in_event, attribute_to_entity
from MISP_maltego.transforms.common.entities import Unknown from MISP_maltego.transforms.common.entities import Unknown
@ -24,6 +22,13 @@ class AttributeInMISP(Transform):
def do_transform(self, request, response, config): def do_transform(self, request, response, config):
maltego_misp_attribute = request.entity maltego_misp_attribute = request.entity
# skip MISP Events (value = int)
try:
int(maltego_misp_attribute.value)
return response
except Exception:
pass
misp = get_misp_connection(config) misp = get_misp_connection(config)
events_json = misp.search(controller='events', values=maltego_misp_attribute.value, withAttachments=False) events_json = misp.search(controller='events', values=maltego_misp_attribute.value, withAttachments=False)
in_misp = False in_misp = False
@ -48,6 +53,13 @@ class AttributeToEvent(Transform):
def do_transform(self, request, response, config): def do_transform(self, request, response, config):
maltego_misp_attribute = request.entity maltego_misp_attribute = request.entity
# skip MISP Events (value = int)
try:
int(maltego_misp_attribute.value)
return response
except Exception:
pass
misp = get_misp_connection(config) misp = get_misp_connection(config)
events_json = misp.search(controller='events', values=maltego_misp_attribute.value, withAttachments=False) events_json = misp.search(controller='events', values=maltego_misp_attribute.value, withAttachments=False)
in_misp = False in_misp = False

6
src/MISP_maltego/transforms/eventtoattributes.py
View File

@ -24,7 +24,7 @@ class EventToAttributes(Transform):
# The transform input entity type. # The transform input entity type.
input_type = MISPEvent input_type = MISPEvent
description = 'Expands an Event to Attributes, Tags, Galaxies and related events' description = 'Expands an Event to Attributes, Tags, Galaxies'
def do_transform(self, request, response, config): def do_transform(self, request, response, config):
maltego_misp_event = request.entity maltego_misp_event = request.entity
@ -49,8 +49,8 @@ class EventToAttributes(Transform):
for c in g['GalaxyCluster']: for c in g['GalaxyCluster']:
response += galaxycluster_to_entity(c) response += galaxycluster_to_entity(c)
for e in event_json['Event']['RelatedEvent']: # for e in event_json['Event']['RelatedEvent']:
response += event_to_entity(e, link_style=LinkStyle.DashDot) # response += event_to_entity(e, link_style=LinkStyle.DashDot)
for a in event_json['Event']["Attribute"]: for a in event_json['Event']["Attribute"]:
for entity in attribute_to_entity(a, event_tags=event_tags): for entity in attribute_to_entity(a, event_tags=event_tags):