mail_to_misp/mail_to_misp_config.py-example

40 lines
1.6 KiB
Plaintext
Raw Normal View History

2017-04-27 13:58:49 +02:00
#!/usr/bin/python
misp_url = 'YOUR_MISP_URL'
misp_key = 'YOUR_KEY_HERE' # The MISP auth key can be found on the MISP web interface under the automation section
misp_verifycert = True
2017-05-23 15:19:31 +02:00
debug = False
2017-04-27 13:58:49 +02:00
debug_out_file = '/tmp/mail_to_misp-debug.txt'
nameservers = ['149.13.33.69']
2017-05-29 17:06:46 +02:00
excludelist = (b'google.com', b'microsoft.com')
externallist = (b'virustotal.com', b'malwr.com', b'hybrid-analysis.com', b'emergingthreats.net')
internallist = (b'internal.system.local')
noidsflaglist = (b'myexternalip.com', b'ipinfo.io', b'icanhazip.com', b'wtfismyip.com', b'ipecho.net', b'api.ipify.org', b'checkip.amazonaws.com', b'whatismyipaddress.com', b'google.com', b'dropbox.com')
2017-05-17 09:54:24 +02:00
# Stop parsing when this term is found
2017-05-29 17:06:46 +02:00
stopword = b'Whois & IP Information'
2017-04-27 13:58:49 +02:00
# TLP tag setup
# Tuples contain different variations of spelling
2017-05-29 17:15:52 +02:00
tlptags = { 'tlp:amber': [ 'tlp:amber', 'tlp: amber', 'tlp amber' ],
2017-05-29 10:53:10 +02:00
'tlp:green': [ 'tlp:green', 'tlp: green', 'tlp green' ],
2017-05-29 17:15:52 +02:00
'tlp:white': [ 'tlp:white', 'tlp: white', 'tlp white' ]
2017-04-27 13:58:49 +02:00
}
2017-05-24 11:03:38 +02:00
tlptag_default = sorted(tlptags.keys())[-1]
2017-04-27 13:58:49 +02:00
malwaretags = { 'locky': [ 'ecsirt:malicious-code="ransomware"', 'misp-galaxy:ransomware="Locky"' ],
'dridex': [ 'misp-galaxy:tool="dridex"' ],
'netwire': [ 'Netwire RAT' ]
}
# Tags to be set depending on the presence of other tags
dependingtags = { 'tlp:white': [ 'circl:osint-feed' ]
}
2017-05-29 15:36:27 +02:00
# Known identifiers for forwarded messages
forward_identifiers = { b'-------- Forwarded Message --------', b'Begin forwarded message:' }
# Tags to add when hashes are found (e.g. to do automatic expansion)
hash_only_tags = { 'TODO:VT-ENRICHMENT' }