Merge pull request #95 from juancmontes/master

Use new Modules Controller
pull/96/head
Alexandre Dulaunoy 2018-02-23 10:15:47 +01:00 committed by GitHub
commit 833f66f48c
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 116 additions and 1 deletions

View File

@ -27,7 +27,6 @@ The authorization is performed by using the following header:
~~~~
Authorization: YOUR API KEY
~~~~
### Accept and Content-Type headers
When performing your request, depending on the type of request, you might need to explicitly specify in what content type you want to get your results. This is done by setting one of the below Accept headers:
@ -1978,6 +1977,122 @@ An example output of https://<misp url>/users/statistics.json:
}
~~~~
# MISP modules
## Description
It is possible call misp-modules directly from API.
If the module needs credentials, API will get the information directly from MISP configuration.
### GET /modules/
Retrieve a list of all modules enabled.
#### Example
~~~bash
curl --header "Authorization: <APIKEY> " --header "Accept: application/json" --header "Content-Type: application/json" -X GET http://<MISP>/modules/
~~~
#### Output
~~~json
[
{
"name": "passivetotal",
"type": "expansion",
"mispattributes": {
"input": [
"hostname",
"domain",
"ip-src",
"ip-dst"
],
"output": [
"ip-src",
"ip-dst",
"hostname",
"domain"
]
},
"meta": {
"description": "PassiveTotal expansion service to expand values with multiple Passive DNS sources",
"config": [
"username",
"password"
],
"author": "Alexandre Dulaunoy",
"version": "0.1"
}
},
{
"name": "sourcecache",
"type": "expansion",
"mispattributes": {
"input": [
"link"
],
"output": [
"link"
]
},
"meta": {
"description": "Module to cache web pages of analysis reports, OSINT sources. The module returns a link of the cached page.",
"author": "Alexandre Dulaunoy",
"version": "0.1"
}
},
{
"name": "dns",
"type": "expansion",
"mispattributes": {
"input": [
"hostname",
"domain"
],
"output": [
"ip-src",
"ip-dst"
]
},
"meta": {
"description": "Simple DNS expansion service to resolve IP address from MISP attributes",
"author": "Alexandre Dulaunoy",
"version": "0.1"
}
}
]
~~~
### POST /modules/queryEnrichment
Call any enabled module.
#### Example
Content of dns.json
~~~json
{
"hostname": "www.foo.be",
"module": "dns"
}
~~~
Query using MISP API
~~~bash
curl --header "Authorization: <APIKEY> " --header "Accept: application/json" --header "Content-Type: application/json" --data @dns.json -X POST http://<MISP>/modules/queryEnrichment
~~~
The output will be following JSON:
~~~json
{
"results": [
{
"types": [
"ip-src",
"ip-dst"
],
"values": [
"188.65.217.78"
]
}
]
}
~~~