PyMISP/pymisp/tools/objectgenerator.py

119 lines
5.0 KiB
Python

#!/usr/bin/env python
# -*- coding: utf-8 -*-
from pymisp import MISPEvent, MISPAttribute, AbstractMISP
import os
import json
import uuid
import abc
import sys
import six # Remove that import when discarding python2 support.
class MISPObjectException(Exception):
pass
class InvalidMISPObject(MISPObjectException):
"""Exception raised when an object doesn't contains the required field(s)"""
pass
if six.PY2:
import warnings
warnings.warn("You're using python 2, it is strongly recommended to use python >=3.5")
class MISPObjectReference(AbstractMISP):
attributes = ['uuid', 'relationship_type', 'comment']
def __init__(self, uuid, relationship_type, comment=None):
self['uuid'] = uuid
self['relationship_type'] = relationship_type
self['comment'] = comment
class MISPObjectGenerator(AbstractMISP):
def __init__(self, template_dir):
"""This class is used to fill a new MISP object with the default values defined in the object template
* template is the path to the template within the misp-object repository
* misp_objects_path is the path to the misp-object repository
"""
self.misp_objects_path = os.path.join(
os.path.abspath(os.path.dirname(sys.modules['pymisp'].__file__)),
'data', 'misp-objects', 'objects')
with open(os.path.join(self.misp_objects_path, template_dir, 'definition.json'), 'r') as f:
self.definition = json.load(f)
self.attributes = self.definition['attributes'].keys()
self.misp_event = MISPEvent()
self.uuid = str(uuid.uuid4())
self.references = []
def _create_attribute(self, object_type, **value):
if value.get('value') is None:
return None
# Initialize the new MISPAttribute
# Get the misp attribute type from the definition
value['type'] = self.definition['attributes'][object_type]['misp-attribute']
if value.get('disable_correlation') is None:
# The correlation can be disabled by default in the object definition.
# Use this value if it isn't overloaded by the object
value['disable_correlation'] = self.definition['attributes'][object_type].get('disable_correlation')
if value.get('to_ids') is None:
# Same for the to_ids flag
value['to_ids'] = self.definition['attributes'][object_type].get('to_ids')
# Set all the values in the MISP attribute
attribute = MISPAttribute(self.misp_event.describe_types)
attribute.set_all_values(**value)
self[object_type] = attribute
def dump(self, strict=True):
"""Create a new object with the values gathered by the sub-class, use the default values from the template if needed"""
if strict:
self._validate()
# Create an empty object based om the object definition
new_object = self.__new_empty_object(self.definition)
for object_type, attribute in self.items():
# Add all the values as MISPAttributes to the current object
if attribute.value is None:
continue
# Finalize the actual MISP Object
# FIXME: This only works on python >= 3.5
# new_object['Attribute'].append({'object_relation': object_type, **attribute._json()})
# ### BEGIN ####
# Because we still need to support old python.
temp_attribute = {'object_relation': object_type}
temp_attribute.update(attribute._json())
new_object['Attribute'].append(temp_attribute)
# ### END ####
return new_object, [r.to_dict() for r in self.references]
def _validate(self):
"""Make sure the object we're creating has the required fields"""
all_attribute_names = set(self.keys())
if self.definition.get('requiredOneOf'):
if not set(self.definition['requiredOneOf']) & all_attribute_names:
raise InvalidMISPObject('At least one of the following attributes is required: {}'.format(', '.join(self.definition['requiredOneOf'])))
if self.definition.get('required'):
for r in self.definition.get('required'):
if r not in all_attribute_names:
raise InvalidMISPObject('{} is required is required'.format(r))
return True
def add_reference(self, uuid, relationship_type, comment=None):
"""Add a link (uuid) to an other object"""
self.references.append(MISPObjectReference(uuid, relationship_type, comment))
def __new_empty_object(self, object_definiton):
"""Create a new empty object out of the template"""
return {'name': object_definiton['name'], 'meta-category': object_definiton['meta-category'],
'uuid': self.uuid, 'description': object_definiton['description'],
'version': object_definiton['version'], 'Attribute': []}
@abc.abstractmethod
def generate_attributes(self):
"""Contains the logic where all the values of the object are gathered"""
pass