MISP
/
mail_to_misp
mirror of https://github.com/MISP/mail_to_misp
2
0
Fork 0
Code Issues Releases Wiki Activity

reorganization

slight_refactoring
Sascha Rommelfangen 2018-01-16 07:03:53 +01:00 committed by GitHub
parent 9e98bf11b4
commit f27bf2addb
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 6 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
mail_to_misp.py
View File

@ -169,6 +169,12 @@ def init(url, key):
return PyMISP(url, key, misp_verifycert, 'json', debug=True) return PyMISP(url, key, misp_verifycert, 'json', debug=True)
# Create the MISP event
misp = init(misp_url, misp_key)
new_event = misp.new_event(info=email_subject, distribution=0, threat_level_id=3, analysis=1)
misp_event = MISPEvent()
misp_event.load(new_event)
# Evaluate classification # Evaluate classification
tlp_tag = tlptag_default tlp_tag = tlptag_default
tlptags = config.tlptags tlptags = config.tlptags
@ -176,13 +182,6 @@ for tag in tlptags:
for alternativetag in tlptags[tag]: for alternativetag in tlptags[tag]:
if alternativetag in email_data.lower(): if alternativetag in email_data.lower():
tlp_tag = tag tlp_tag = tag
# Create the MISP event
misp = init(misp_url, misp_key)
new_event = misp.new_event(info=email_subject, distribution=0, threat_level_id=3, analysis=1)
misp_event = MISPEvent()
misp_event.load(new_event)
misp.tag(misp_event.uuid, tlp_tag) misp.tag(misp_event.uuid, tlp_tag)
if attach_original_mail and original_email_data: if attach_original_mail and original_email_data: