PyMISP/examples/events/tools.py

#!/usr/bin/env python
# -*- coding: utf-8 -*-

import random
from random import randint
import string
from pymisp import MISPEvent, MISPAttribute


def randomStringGenerator(size, chars=string.ascii_lowercase + string.digits):
    return ''.join(random.choice(chars) for _ in range(size))


def randomIpGenerator():
    return str(randint(0, 255)) + '.' + str(randint(0, 255)) + '.' + str(randint(0, 255)) + '.' + str(randint(0, 255))


def _attribute(category, type, value):
    attribute = MISPAttribute()
    attribute.category = category
    attribute.type = type
    attribute.value = value
    return attribute


def floodtxt(misp, event, maxlength=255):
    text = randomStringGenerator(randint(1, maxlength))
    choose_from = [('Internal reference', 'comment', text), ('Internal reference', 'text', text),
                   ('Internal reference', 'other', text), ('Network activity', 'email-subject', text),
                   ('Artifacts dropped', 'mutex', text), ('Artifacts dropped', 'filename', text)]
    misp.add_attribute(event, _attribute(*random.choice(choose_from)))


def floodip(misp, event):
    ip = randomIpGenerator()
    choose_from = [('Network activity', 'ip-src', ip), ('Network activity', 'ip-dst', ip)]
    misp.add_attribute(event, _attribute(*random.choice(choose_from)))


def flooddomain(misp, event, maxlength=25):
    a = randomStringGenerator(randint(1, maxlength))
    b = randomStringGenerator(randint(2, 3), chars=string.ascii_lowercase)
    domain = a + '.' + b
    choose_from = [('Network activity', 'domain', domain), ('Network activity', 'hostname', domain)]
    misp.add_attribute(event, _attribute(*random.choice(choose_from)))


def floodemail(misp, event, maxlength=25):
    a = randomStringGenerator(randint(1, maxlength))
    b = randomStringGenerator(randint(1, maxlength))
    c = randomStringGenerator(randint(2, 3), chars=string.ascii_lowercase)
    email = a + '@' + b + '.' + c
    choose_from = [('Network activity', 'email-dst', email), ('Network activity', 'email-src', email)]
    misp.add_attribute(event, _attribute(*random.choice(choose_from)))


def create_dummy_event(misp):
    return misp.new_event(0, 4, 0, 'dummy event')


def create_massive_dummy_events(misp, nbattribute):
    event = MISPEvent()
    event.info = 'massive dummy event'
    event = misp.add_event(event)
    print(event)
    functions = [floodtxt, floodip, flooddomain, floodemail]
    for i in range(nbattribute):
        functions[random.randint(0, len(functions) - 1)](misp, event)