#!/usr/bin/env python # -*- coding: utf-8 -*- from pymisp import MISPEvent, MISPAttribute, AbstractMISP import os import json import uuid import abc import sys import six # Remove that import when discarding python2 support. class MISPObjectException(Exception): pass class InvalidMISPObject(MISPObjectException): """Exception raised when an object doesn't contains the required field(s)""" pass if six.PY2: import warnings warnings.warn("You're using python 2, it is strongly recommended to use python >=3.5") class MISPObjectReference(AbstractMISP): attributes = ['source_uuid', 'destination_uuid', 'relationship_type', 'comment'] def __init__(self, source_uuid, destination_uuid, relationship_type, comment=None): self.source_uuid = source_uuid self.destination_uuid = destination_uuid self.relationship_type = relationship_type self.comment = comment class MISPObjectAttribute(AbstractMISP): # This list is very limited and hardcoded to fit the current needs (file/pe/pesection creation): MISPAttriute will follow the # same spec and just add one attribute: object_relation attributes = ['object_relation', 'value', 'type', 'category', 'disable_correlation', 'to_ids', 'data', 'encrypt', 'distribution', 'comment'] def __init__(self, definition, object_relation, value, **kwargs): self.object_relation = object_relation self.value = value # Initialize the new MISPAttribute # Get the misp attribute type from the definition self.type = kwargs.pop('type', None) if self.type is None: self.type = definition['misp-attribute'] self.disable_correlation = kwargs.pop('disable_correlation', None) if self.disable_correlation is None: # The correlation can be disabled by default in the object definition. # Use this value if it isn't overloaded by the object self.disable_correlation = definition.get('disable_correlation') self.to_ids = kwargs.pop('to_ids', None) if self.to_ids is None: # Same for the to_ids flag self.to_ids = definition.get('to_ids') # Initialise rest of the values for k, v in kwargs.items(): self[k] = v # FIXME: dirty hack until all the classes are ported to the new format but we get the default values temp_attribute = MISPAttribute() temp_attribute.set_all_values(**self) # Update default values self.from_dict(**temp_attribute.to_dict()) class MISPObjectGenerator(AbstractMISP): attributes = ['name', 'meta-category', 'uuid', 'description', 'version', 'Attribute'] def __init__(self, template_dir): """This class is used to fill a new MISP object with the default values defined in the object template * template is the path to the template within the misp-object repository * misp_objects_path is the path to the misp-object repository """ self.misp_objects_path = os.path.join( os.path.abspath(os.path.dirname(sys.modules['pymisp'].__file__)), 'data', 'misp-objects', 'objects') with open(os.path.join(self.misp_objects_path, template_dir, 'definition.json'), 'r') as f: self.definition = json.load(f) self.misp_event = MISPEvent() self.name = self.definition['name'] setattr(self, 'meta-category', self.definition['meta-category']) self.template_uuid = self.definition['uuid'] self.description = self.definition['description'] self.version = self.definition['version'] self.uuid = str(uuid.uuid4()) self.Attribute = [] self.references = [] def _create_attribute(self, object_type, **value): if value.get('value') is None: return None attribute = MISPObjectAttribute(self.definition['attributes'][object_type], object_type, **value) self.Attribute.append(attribute) return attribute def to_dict(self, strict=True): if strict: self._validate() return super(MISPObjectGenerator, self).to_dict() def to_json(self, strict=True): if strict: self._validate() return super(MISPObjectGenerator, self).to_json() def _validate(self): """Make sure the object we're creating has the required fields""" all_attribute_names = set() for a in self.Attribute: all_attribute_names.add(a.object_relation) if self.definition.get('requiredOneOf'): if not set(self.definition['requiredOneOf']) & all_attribute_names: raise InvalidMISPObject('At least one of the following attributes is required: {}'.format(', '.join(self.definition['requiredOneOf']))) if self.definition.get('required'): for r in self.definition.get('required'): if r not in all_attribute_names: raise InvalidMISPObject('{} is required'.format(r)) return True def add_reference(self, destination_uuid, relationship_type, comment=None): """Add a link (uuid) to an other object""" self.references.append(MISPObjectReference(self.uuid, destination_uuid, relationship_type, comment)) @abc.abstractmethod def generate_attributes(self): """Contains the logic where all the values of the object are gathered""" pass