Feature request #14 - auto publish when key is given

slight_refactoring
Sascha Rommelfangen 2018-04-03 11:09:54 +02:00
parent 1b3c0c3f5f
commit abfec60361
2 changed files with 17 additions and 1 deletions

View File

@ -131,6 +131,8 @@ if debug:
misp_url = config.misp_url
misp_key = config.misp_key
misp_verifycert = config.misp_verifycert
m2m_key = config.m2m_key
m2m_auto_distribution = config.m2m_auto_distribution
resolver = dns.resolver.Resolver(configure=False)
resolver.nameservers = config.nameservers
@ -162,8 +164,16 @@ for ignoreline in ignorelist:
for removeword in removelist:
email_subject = re.sub(removeword, "", email_subject)
# Check if autopublish key is present and valid
autopublish_key = "key:" + m2m_key
if autopublish_key in email_data:
auto_publish = True
# Create the MISP event
misp = init(misp_url, misp_key)
if auto_publish:
new_event = misp.new_event(info=email_subject, distribution=m2m_auto_distribution, threat_level_id=3, analysis=1)
else:
new_event = misp.new_event(info=email_subject, distribution=0, threat_level_id=3, analysis=1)
# Load the MISP event
@ -217,6 +227,7 @@ urllist += re.findall(urlmarker.IP_REGEX, email_data)
if debug:
syslog.syslog(str(urllist))
# Init Faup
f = Faup()
@ -324,4 +335,7 @@ if stdin_used:
file_hash = hashlib.sha256(open(output_path, 'rb').read()).hexdigest()
sight(sighting, file_hash)
if auto_publish:
misp.publish(misp_event, alert=False)
syslog.syslog("Job finished.")

View File

@ -6,6 +6,8 @@ import os
misp_url = 'YOUR_MISP_URL'
misp_key = 'YOUR_KEY_HERE' # The MISP auth key can be found on the MISP web interface under the automation section
misp_verifycert = True
m2m_key = 'YOUSETYOURKEYHERE'
m2m_auto_distribution = '3' # 3 = All communities
debug = False
nameservers = ['149.13.33.69']