mirror of https://github.com/MISP/MISP-maltego
85 lines
2.3 KiB
Python
85 lines
2.3 KiB
Python
from canari.maltego.entities import Hash, Domain, IPv4Address, URL, DNSName, AS, Website, NSRecord, PhoneNumber, EmailAddress, File
|
|
from canari.maltego.transform import Transform
|
|
# from canari.framework import EnableDebugWindow
|
|
from MISP_maltego.transforms.common.entities import MISPEvent
|
|
from MISP_maltego.transforms.common.util import get_misp_connection
|
|
|
|
__author__ = 'Christophe Vandeplas'
|
|
__copyright__ = 'Copyright 2018, MISP_maltego Project'
|
|
__credits__ = []
|
|
|
|
__license__ = 'AGPLv3'
|
|
__version__ = '0.1'
|
|
__maintainer__ = 'Christophe Vandeplas'
|
|
__email__ = 'christophe@vandeplas.com'
|
|
__status__ = 'Development'
|
|
|
|
|
|
# @EnableDebugWindow
|
|
class AttributeToEvent(Transform):
|
|
# The transform input entity type.
|
|
input_type = None
|
|
|
|
def do_transform(self, request, response, config):
|
|
maltego_misp_attribute = request.entity
|
|
misp = get_misp_connection(config)
|
|
# misp.
|
|
events_json = misp.search(controller='events', values=maltego_misp_attribute.value, withAttachments=False)
|
|
for e in events_json['response']:
|
|
response += MISPEvent(e['Event']['id'], uuid=e['Event']['uuid'], info=e['Event']['info'])
|
|
return response
|
|
|
|
def on_terminate(self):
|
|
"""This method gets called when transform execution is prematurely terminated. It is only applicable for local
|
|
transforms. It can be excluded if you don't need it."""
|
|
pass
|
|
|
|
|
|
class HashToEvent(AttributeToEvent):
|
|
input_type = Hash
|
|
|
|
|
|
class DomainToEvent(AttributeToEvent):
|
|
input_type = Domain
|
|
|
|
|
|
class IPv4AddressToEvent(AttributeToEvent):
|
|
display_name = 'IPv4AddressToEvent'
|
|
input_type = IPv4Address
|
|
|
|
|
|
class URLToEvent(AttributeToEvent):
|
|
display_name = 'URLToEvent'
|
|
input_type = URL
|
|
|
|
|
|
class DNSNameToEvent(AttributeToEvent):
|
|
display_name = 'DNSNameToEvent'
|
|
input_type = DNSName
|
|
|
|
|
|
class ASToEvent(AttributeToEvent):
|
|
display_name = 'ASToEvent'
|
|
input_type = AS
|
|
|
|
|
|
class WebsiteToEvent(AttributeToEvent):
|
|
input_type = Website
|
|
|
|
|
|
class NSRecordToEvent(AttributeToEvent):
|
|
display_name = 'NSRecordToEvent'
|
|
input_type = NSRecord
|
|
|
|
|
|
class PhoneNumberToEvent(AttributeToEvent):
|
|
input_type = PhoneNumber
|
|
|
|
|
|
class EmailAddressToEvent(AttributeToEvent):
|
|
input_type = EmailAddress
|
|
|
|
|
|
class FileToEvent(AttributeToEvent):
|
|
input_type = File
|