MISP
/
PyMISP
mirror of https://github.com/MISP/PyMISP
2
0
Fork 0
Code Issues Releases Wiki Activity

Merge branch 'master' of github.com:MISP/PyMISP

pull/202/merge
Raphaël Vinot 2018-07-23 09:49:22 +02:00
parent 4f33ab9ab4 d256f21f7e
commit 13a40d31ca
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
examples/yara_dump.py
View File

@ -17,7 +17,8 @@ def dirty_cleanup(value):
('“', '"'), ('“', '"'),
('″', '"'), ('″', '"'),
('`', "'"), ('`', "'"),
('\r', '') ('\r', ''),
('Rule ', 'rule ') # some people write this with the wrong case
# ('$ ', '$'), # this breaks rules # ('$ ', '$'), # this breaks rules
# ('\t\t', '\n'), # this breaks rules # ('\t\t', '\n'), # this breaks rules
) )
@ -49,6 +50,10 @@ if 'response' in result and 'Attribute' in result['response']:
attr_cnt_changed += 1 attr_cnt_changed += 1
if 'global rule' in value: # refuse any global rules as they might disable everything if 'global rule' in value: # refuse any global rules as they might disable everything
continue continue
if 'private rule' in value: # private rules need some more rewriting
priv_rules = re.findall('private rule (\w+)', value, flags=re.MULTILINE)
for priv_rule in priv_rules:
value = re.sub(priv_rule, 'misp_e{}_{}'.format(event_id, priv_rule), value, flags=re.MULTILINE)
# compile the yara rule to confirm it's validity # compile the yara rule to confirm it's validity
# if valid, ignore duplicate rules # if valid, ignore duplicate rules