misp-modules/misp_modules/modules/import_mod/openiocimport.py

90 lines
2.5 KiB
Python
Raw Normal View History

2017-02-27 13:32:31 +01:00
import json
import base64
from pymisp.tools import openioc
misperrors = {'error': 'Error'}
2017-10-25 17:27:59 +02:00
userConfig = {'not save ioc': {'type': 'Boolean',
'message': 'If you check this box, IOC file will not save as an attachment in MISP'
},
'default tag': {
'type': 'String',
'message': 'Add tags spaced by a comma (tlp:white,misp:threat-level="no-risk")',
'validation': '0'}
}
2017-05-02 15:07:33 +02:00
inputSource = ['file']
2017-02-27 13:32:31 +01:00
moduleinfo = {'version': '0.1', 'author': 'Raphaël Vinot',
2017-10-25 17:27:59 +02:00
'description': 'Import OpenIOC package',
'module-type': ['import']}
2017-02-27 13:32:31 +01:00
moduleconfig = []
def handler(q=False):
2017-05-11 09:56:43 +02:00
# Just in case we have no data
if q is False:
return False
# The return value
r = {'results': []}
# Load up that JSON
q = json.loads(q)
# It's b64 encoded, so decode that stuff
package = base64.b64decode(q.get("data")).decode('utf-8')
# If something really weird happened
if not package:
return json.dumps({"success": 0})
pkg = openioc.load_openioc(package)
if q.get('config'):
if q['config'].get('not save ioc') == "0":
2017-10-25 17:27:59 +02:00
addFile = {"values": [q.get('filename')],
"types": ['attachment'],
"categories": ['Support Tool'],
"data": q.get('data')}
2017-05-11 09:56:43 +02:00
# add tag
if q['config'].get('default tag') is not None:
addFile["tags"] = q['config']['default tag'].split(",")
# add file as attachment
r["results"].append(addFile)
# return all attributes
for attrib in pkg.attributes:
toAppend = {
"values": [attrib.value],
"types": [attrib.type],
"categories": [attrib.category],
2017-10-25 17:27:59 +02:00
"comment": getattr(attrib, 'comment', '')}
2017-05-24 07:39:18 +02:00
# add tag
if q.get('config') and q['config'].get('default tag') is not None:
2019-02-04 11:05:51 +01:00
toAppend["tags"] = q['config']['default tag'].split(",")
2017-05-11 09:56:43 +02:00
r["results"].append(toAppend)
return r
2017-02-27 13:32:31 +01:00
def introspection():
2017-05-11 09:56:43 +02:00
modulesetup = {}
try:
userConfig
modulesetup['userConfig'] = userConfig
except NameError:
pass
try:
inputSource
modulesetup['inputSource'] = inputSource
except NameError:
pass
return modulesetup
2017-02-27 13:32:31 +01:00
def version():
2017-05-11 09:56:43 +02:00
moduleinfo['config'] = moduleconfig
return moduleinfo