diff --git a/examples/lookup.py b/examples/lookup.py new file mode 100755 index 0000000..e718c3d --- /dev/null +++ b/examples/lookup.py @@ -0,0 +1,28 @@ +#!/usr/bin/env python +# -*- coding: utf-8 -*- + +from pymisp.tools import ext_lookups +import argparse + + +if __name__ == '__main__': + + parser = argparse.ArgumentParser(description='Search is galaxies or taxonomies.') + parser.add_argument("-q", "--query", help="Query.") + + args = parser.parse_args() + + tag_gal = ext_lookups.revert_tag_from_galaxies(args.query) + tag_tax = ext_lookups.revert_tag_from_taxonomies(args.query) + + found_tax = ext_lookups.search_taxonomies(args.query) + found_gal = ext_lookups.search_galaxies(args.query) + + if tag_gal: + print(tag_gal) + if tag_tax: + print(tag_tax) + if found_tax: + print(found_tax) + if found_gal: + print(found_gal) diff --git a/pymisp/__init__.py b/pymisp/__init__.py index 47a3187..294694b 100644 --- a/pymisp/__init__.py +++ b/pymisp/__init__.py @@ -40,6 +40,7 @@ try: from .tools import stix # noqa from .tools import openioc # noqa from .tools import load_warninglists # noqa + from .tools import ext_lookups # noqa logger.debug('pymisp loaded properly') except ImportError as e: logger.warning('Unable to load pymisp properly: {}'.format(e)) diff --git a/pymisp/tools/ext_lookups.py b/pymisp/tools/ext_lookups.py new file mode 100644 index 0000000..7a439c4 --- /dev/null +++ b/pymisp/tools/ext_lookups.py @@ -0,0 +1,43 @@ +#!/usr/bin/env python +# -*- coding: utf-8 -*- + +try: + from pymispgalaxies import Clusters + has_pymispgalaxies = True +except ImportError: + has_pymispgalaxies = False + +try: + from pytaxonomies import Taxonomies + has_pymispgalaxies = True +except ImportError: + has_pymispgalaxies = False + + +def revert_tag_from_galaxies(tag): + clusters = Clusters() + try: + return clusters.revert_machinetag(tag) + except Exception: + return [] + + +def revert_tag_from_taxonomies(tag): + taxonomies = Taxonomies() + try: + return taxonomies.revert_machinetag(tag) + except Exception: + return [] + + +def search_taxonomies(query): + taxonomies = Taxonomies() + found = taxonomies.search(query) + if not found: + found = taxonomies.search(query, expanded=True) + return found + + +def search_galaxies(query): + clusters = Clusters() + return clusters.search(query)