MISP
/
mail_to_misp
mirror of https://github.com/MISP/mail_to_misp
2
0
Fork 0
Code Issues Releases Wiki Activity

temporary fix for attachments

pull/38/head
Sascha Rommelfangen 2019-07-18 11:06:26 +02:00
parent e713ab2939
commit e9a707a2fa
1 changed files with 14 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
mail_to_misp.py
View File

@ -82,13 +82,13 @@ class Mail2MISP():
# Attach sane file # Attach sane file
self.misp_event.add_attribute('attachment', value='Report', self.misp_event.add_attribute('attachment', value='Report',
data=BytesIO(attachment.get_content().as_bytes())) data=BytesIO(attachment.get_content().as_bytes()))
else: #else:
f_object, main_object, sections = make_binary_objects(pseudofile=BytesIO(attachment.get_content()), #f_object, main_object, sections = make_binary_objects(pseudofile=BytesIO(attachment.get_content()),
filename=attachment.get_filename(), standalone=False) # filename=attachment.get_filename(), standalone=False)
self.misp_event.add_object(f_object) #self.misp_event.add_object(f_object)
if main_object: #if main_object:
self.misp_event.add_object(main_object) # self.misp_event.add_object(main_object)
[self.misp_event.add_object(section) for section in sections] # [self.misp_event.add_object(section) for section in sections]
def email_from_spamtrap(self): def email_from_spamtrap(self):
'''The email comes from a spamtrap and should be attached as-is.''' '''The email comes from a spamtrap and should be attached as-is.'''
@ -108,13 +108,13 @@ class Mail2MISP():
for attachment_name, attachment in email_object.attachments: for attachment_name, attachment in email_object.attachments:
if not attachment_name: if not attachment_name:
attachment_name = 'NameMissing' attachment_name = 'NameMissing'
f_object, main_object, sections = make_binary_objects(pseudofile=attachment, filename=attachment_name, standalone=False) #f_object, main_object, sections = make_binary_objects(pseudofile=attachment, filename=attachment_name, standalone=False)
self.misp_event.add_object(f_object) #self.misp_event.add_object(f_object)
if main_object: #if main_object:
self.misp_event.add_object(main_object) # self.misp_event.add_object(main_object)
for section in sections: # for section in sections:
self.misp_event.add_object(section) # self.misp_event.add_object(section)
email_object.add_reference(f_object.uuid, 'related-to', 'Email attachment') #email_object.add_reference(f_object.uuid, 'related-to', 'Email attachment')
self.process_body_iocs(email_object) self.process_body_iocs(email_object)
self.misp_event.add_object(email_object) self.misp_event.add_object(email_object)