MISP
/
mail_to_misp
mirror of https://github.com/MISP/mail_to_misp
2
0
Fork 0
Code Issues Releases Wiki Activity

added feature #14 (2): configurable attachment upload

slight_refactoring
Sascha Rommelfangen 2018-04-03 11:46:04 +02:00
parent a560f8b92a
commit 6cc680e50b
2 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
mail_to_misp.py
View File

@ -133,6 +133,7 @@ misp_key = config.misp_key
misp_verifycert = config.misp_verifycert
m2m_key = config.m2m_key
m2m_auto_distribution = config.m2m_auto_distribution
m2m_attachment_keyword = config.m2m_attachment_keyword
resolver = dns.resolver.Resolver(configure=False)
resolver.nameservers = config.nameservers
@ -332,9 +333,12 @@ if stdin_used:
if debug:
syslog.syslog(str(attachment)[:200])
event_id = misp_event.id
misp.upload_sample(filename, output_path, event_id, distribution=5, to_ids=True)
file_hash = hashlib.sha256(open(output_path, 'rb').read()).hexdigest()
sight(sighting, file_hash)
if m2m_attachment_keyword in email_data:
misp.add_attachment(misp_event, output_path, filename=filename, category="External analysis")
else:
misp.upload_sample(filename, output_path, event_id, distribution=5, to_ids=True)
file_hash = hashlib.sha256(open(output_path, 'rb').read()).hexdigest()
sight(sighting, file_hash)
if auto_publish:
misp.publish(misp_event, alert=False)

1
mail_to_misp_config.py-example
View File

@ -8,6 +8,7 @@ misp_key = 'YOUR_KEY_HERE' # The MISP auth key can be found on the MISP web inte
misp_verifycert = True
m2m_key = 'YOUSETYOURKEYHERE'
m2m_auto_distribution = '3' # 3 = All communities
m2m_attachment_keyword = 'attachment:benign'
debug = False
nameservers = ['149.13.33.69']