misp-modules/misp_modules/modules/expansion/onyphe.py

109 lines
3.6 KiB
Python
Raw Normal View History

2018-06-08 16:38:41 +02:00
# -*- coding: utf-8 -*-
import json
try:
from onyphe import Onyphe
except ImportError:
print("pyonyphe module not installed.")
misperrors = {'error': 'Error'}
2018-12-11 15:29:09 +01:00
mispattributes = {'input': ['ip-src', 'ip-dst', 'hostname', 'domain'],
'output': ['hostname', 'domain', 'ip-src', 'ip-dst', 'url']}
2018-06-08 16:38:41 +02:00
# possible module-types: 'expansion', 'hover' or both
moduleinfo = {'version': '1', 'author': 'Sebastien Larinier @sebdraven',
'description': 'Query on Onyphe',
'module-type': ['expansion', 'hover']}
# config fields that your code expects from the site admin
moduleconfig = ['apikey']
def handler(q=False):
2018-06-11 13:34:45 +02:00
if q:
2018-06-08 16:38:41 +02:00
2018-06-11 13:34:45 +02:00
request = json.loads(q)
2018-06-08 16:38:41 +02:00
2018-06-11 13:34:45 +02:00
if not request.get('config') and not (request['config'].get('apikey')):
misperrors['error'] = 'Onyphe authentication is missing'
return misperrors
2018-06-08 16:38:41 +02:00
2018-06-11 13:34:45 +02:00
api = Onyphe(request['config'].get('apikey'))
2018-06-08 16:38:41 +02:00
2018-06-11 13:34:45 +02:00
if not api:
misperrors['error'] = 'Onyphe Error instance api'
ip = ''
if request.get('ip-src'):
ip = request['ip-src']
elif request.get('ip-dst'):
ip = request['ip-dst']
else:
misperrors['error'] = "Unsupported attributes type"
return misperrors
2018-06-08 16:38:41 +02:00
2018-06-11 13:34:45 +02:00
return handle_expansion(api, ip, misperrors)
else:
return False
2018-06-08 16:38:41 +02:00
def handle_expansion(api, ip, misperrors):
result = api.ip(ip)
2018-06-08 17:53:50 +02:00
2018-06-08 16:38:41 +02:00
if result['status'] == 'nok':
misperrors['error'] = result['message']
return misperrors
2018-12-11 15:29:09 +01:00
# categories = list(set([item['@category'] for item in result['results']]))
2018-06-08 17:53:50 +02:00
2018-06-08 18:31:08 +02:00
result_filtered = {"results": []}
2018-06-08 17:53:50 +02:00
urls_pasties = []
2018-06-08 18:31:08 +02:00
asn_list = []
2018-06-11 11:25:17 +02:00
os_list = []
2018-06-11 11:59:00 +02:00
domains_resolver = []
domains_forward = []
2018-06-11 13:21:21 +02:00
2018-06-08 17:53:50 +02:00
for r in result['results']:
if r['@category'] == 'pastries':
2018-11-11 15:49:14 +01:00
if r['source'] == 'pastebin':
2018-06-08 17:53:50 +02:00
urls_pasties.append('https://pastebin.com/raw/%s' % r['key'])
2018-06-08 18:31:08 +02:00
elif r['@category'] == 'synscan':
2018-06-11 10:41:05 +02:00
asn_list.append(r['asn'])
2018-06-11 11:59:00 +02:00
os_target = r['os']
if os_target != 'Unknown':
os_list.append(r['os'])
2018-12-11 15:29:09 +01:00
elif r['@category'] == 'resolver' and r['type'] == 'reverse':
2018-06-11 11:59:00 +02:00
domains_resolver.append(r['reverse'])
2018-12-11 15:29:09 +01:00
elif r['@category'] == 'resolver' and r['type'] == 'forward':
2018-06-11 11:59:00 +02:00
domains_forward.append(r['forward'])
2018-06-11 10:54:06 +02:00
result_filtered['results'].append({'types': ['url'], 'values': urls_pasties,
2018-06-11 10:56:40 +02:00
'categories': ['External analysis']})
2018-06-11 11:59:00 +02:00
2018-06-11 10:59:06 +02:00
result_filtered['results'].append({'types': ['AS'], 'values': list(set(asn_list)),
'categories': ['Network activity']})
2018-06-11 11:25:17 +02:00
result_filtered['results'].append({'types': ['target-machine'],
'values': list(set(os_list)),
'categories': ['Targeting data']})
2018-06-11 11:59:00 +02:00
2018-06-11 12:02:34 +02:00
result_filtered['results'].append({'types': ['domain'],
2018-06-11 11:59:00 +02:00
'values': list(set(domains_resolver)),
'categories': ['Network activity'],
2018-12-11 15:29:09 +01:00
'comment': 'resolver to %s' % ip})
2018-06-11 11:59:00 +02:00
2018-06-11 12:02:34 +02:00
result_filtered['results'].append({'types': ['domain'],
2018-06-11 12:00:46 +02:00
'values': list(set(domains_forward)),
2018-06-11 11:59:00 +02:00
'categories': ['Network activity'],
2018-06-11 12:29:51 +02:00
'comment': 'forward to %s' % ip})
2018-06-08 17:53:50 +02:00
return result_filtered
2018-06-08 16:38:41 +02:00
def introspection():
return mispattributes
def version():
moduleinfo['config'] = moduleconfig
2018-11-11 15:49:14 +01:00
return moduleinfo