mirror of https://github.com/MISP/PyMISP
91 lines
3.2 KiB
Python
91 lines
3.2 KiB
Python
#!/usr/bin/env python3
|
|
import redis
|
|
import json
|
|
|
|
|
|
class MISPItemToRedis:
|
|
"""This class provides a simple normalization to add MISP item to
|
|
redis, so that they can easily be processed and added to MISP later on."""
|
|
SUFFIX_SIGH = '_sighting'
|
|
SUFFIX_ATTR = '_attribute'
|
|
SUFFIX_OBJ = '_object'
|
|
SUFFIX_LIST = [SUFFIX_SIGH, SUFFIX_ATTR, SUFFIX_OBJ]
|
|
|
|
def __init__(self, keyname, host='localhost', port=6379, db=0):
|
|
self.host = host
|
|
self.port = port
|
|
self.db = db
|
|
self.keyname = keyname
|
|
self.serv = redis.StrictRedis(self.host, self.port, self.db)
|
|
|
|
def push_json(self, jdata, keyname, action):
|
|
all_action = [s.lstrip('_') for s in self.SUFFIX_LIST]
|
|
if action not in all_action:
|
|
raise('Error: Invalid action. (Allowed: {})'.format(all_action))
|
|
key = keyname + '_' + action
|
|
self.serv.lpush(key, jdata)
|
|
|
|
def push_attribute(self, type_value, value, category=None, to_ids=False,
|
|
comment=None, distribution=None, proposal=False, **kwargs):
|
|
to_push = {}
|
|
to_push['type'] = type_value
|
|
to_push['value'] = value
|
|
if category is not None:
|
|
to_push['category'] = category
|
|
if to_ids is not None:
|
|
to_push['to_ids'] = to_ids
|
|
if comment is not None:
|
|
to_push['comment'] = comment
|
|
if distribution is not None:
|
|
to_push['distribution'] = distribution
|
|
if proposal is not None:
|
|
to_push['proposal'] = proposal
|
|
for k, v in kwargs.items():
|
|
to_push[k] = v
|
|
key = self.keyname + self.SUFFIX_ATTR
|
|
self.serv.lpush(key, json.dumps(to_push))
|
|
|
|
def push_attribute_obj(self, MISP_Attribute, keyname):
|
|
key = keyname + self.SUFFIX_ATTR
|
|
jdata = MISP_Attribute.to_json()
|
|
self.serv.lpush(key, jdata)
|
|
|
|
def push_object(self, dict_values):
|
|
# check that 'name' field is present
|
|
if 'name' not in dict_values:
|
|
print("Error: JSON must contain the field 'name'")
|
|
key = self.keyname + self.SUFFIX_OBJ
|
|
self.serv.lpush(key, json.dumps(dict_values))
|
|
|
|
def push_object_obj(self, MISP_Object, keyname):
|
|
key = keyname + self.SUFFIX_OBJ
|
|
jdata = MISP_Object.to_json()
|
|
self.serv.lpush(key, jdata)
|
|
|
|
def push_sighting(self, value=None, uuid=None, id=None, source=None,
|
|
type=0, timestamp=None, **kargs):
|
|
to_push = {}
|
|
if value is not None:
|
|
to_push['value'] = value
|
|
if uuid is not None:
|
|
to_push['uuid'] = uuid
|
|
if id is not None:
|
|
to_push['id'] = id
|
|
if source is not None:
|
|
to_push['source'] = source
|
|
if type is not None:
|
|
to_push['type'] = type
|
|
if timestamp is not None:
|
|
to_push['timestamp'] = timestamp
|
|
|
|
for k, v in kargs.items():
|
|
if v is not None:
|
|
to_push[k] = v
|
|
key = self.keyname + self.SUFFIX_SIGH
|
|
self.serv.lpush(key, json.dumps(to_push))
|
|
|
|
def push_sighting_obj(self, MISP_Sighting, keyname):
|
|
key = keyname + self.SUFFIX_SIGH
|
|
jdata = MISP_Sighting.to_json()
|
|
self.serv.lpush(key, jdata)
|