new: Add bindings for Galaxies and Taxonimies

examples/lookup.py

@@ -0,0 +1,28 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+
+from pymisp.tools import ext_lookups
+import argparse
+
+
+if __name__ == '__main__':
+
+    parser = argparse.ArgumentParser(description='Search is galaxies or taxonomies.')
+    parser.add_argument("-q", "--query", help="Query.")
+
+    args = parser.parse_args()
+
+    tag_gal = ext_lookups.revert_tag_from_galaxies(args.query)
+    tag_tax = ext_lookups.revert_tag_from_taxonomies(args.query)
+
+    found_tax = ext_lookups.search_taxonomies(args.query)
+    found_gal = ext_lookups.search_galaxies(args.query)
+
+    if tag_gal:
+        print(tag_gal)
+    if tag_tax:
+        print(tag_tax)
+    if found_tax:
+        print(found_tax)
+    if found_gal:
+        print(found_gal)

pymisp/__init__.py

@@ -40,6 +40,7 @@ try:
     from .tools import stix  # noqa
     from .tools import openioc  # noqa
     from .tools import load_warninglists  # noqa
+    from .tools import ext_lookups  # noqa
     logger.debug('pymisp loaded properly')
 except ImportError as e:
     logger.warning('Unable to load pymisp properly: {}'.format(e))

pymisp/tools/ext_lookups.py

@@ -0,0 +1,43 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+
+try:
+    from pymispgalaxies import Clusters
+    has_pymispgalaxies = True
+except ImportError:
+    has_pymispgalaxies = False
+
+try:
+    from pytaxonomies import Taxonomies
+    has_pymispgalaxies = True
+except ImportError:
+    has_pymispgalaxies = False
+
+
+def revert_tag_from_galaxies(tag):
+    clusters = Clusters()
+    try:
+        return clusters.revert_machinetag(tag)
+    except Exception:
+        return []
+
+
+def revert_tag_from_taxonomies(tag):
+    taxonomies = Taxonomies()
+    try:
+        return taxonomies.revert_machinetag(tag)
+    except Exception:
+        return []
+
+
+def search_taxonomies(query):
+    taxonomies = Taxonomies()
+    found = taxonomies.search(query)
+    if not found:
+        found = taxonomies.search(query, expanded=True)
+    return found
+
+
+def search_galaxies(query):
+    clusters = Clusters()
+    return clusters.search(query)