misp-modules/misp_modules/modules/expansion/xforceexchange.py

102 lines
2.7 KiB
Python
Raw Normal View History

2017-01-31 16:34:41 +01:00
import requests
2017-01-21 23:31:19 +01:00
import json
import sys
2017-01-31 16:57:16 +01:00
2017-01-21 23:31:19 +01:00
BASEurl = "https://api.xforce.ibmcloud.com/"
extensions = {"ip1": "ipr/%s",
2017-02-01 14:05:29 +01:00
"ip2": "ipr/malware/%s",
"url": "url/%s",
"hash": "malware/%s",
"vuln": "/vulnerabilities/search/%s",
"dns": "resolve/%s"}
2017-01-21 23:31:19 +01:00
sys.path.append('./')
misperrors = {'error': 'Error'}
mispattributes = {'input': ['ip-src','ip-dst' 'vulnerability', 'md5', 'sha1', 'sha256'],
2017-02-01 14:05:29 +01:00
'output': ['ip-src', 'ip-dst', 'text', 'domain']}
2017-01-21 23:31:19 +01:00
# possible module-types: 'expansion', 'hover' or both
moduleinfo = {'version': '1', 'author': 'Joerg Stephan (@johest)',
'description': 'IBM X-Force Exchange expansion module',
'module-type': ['expansion', 'hover']}
# config fields that your code expects from the site admin
moduleconfig = ["apikey", "event_limit"]
limit = 5000 #Default
def MyHeader(key=False):
global limit
if key is False:
return None
return {"Authorization": "Basic %s " % key,
"Accept": "application/json",
'User-Agent': 'Mozilla 5.0'}
def handler(q=False):
global limit
if q is False:
return False
q = json.loads(q)
key = q["config"]["apikey"]
limit = int(q["config"].get("event_limit", 5))
r = {"results": []}
if "ip-src" in q:
2017-02-01 14:05:29 +01:00
r["results"] += apicall("dns", q["ip-src"], key)
2017-01-21 23:31:19 +01:00
if "ip-dst" in q:
2017-02-01 14:05:29 +01:00
r["results"] += apicall("dns", q["ip-dst"], key)
2017-01-21 23:31:19 +01:00
if "md5" in q:
r["results"] += apicall("hash", q["md5"], key)
if "sha1" in q:
r["results"] += apicall("hash", q["sha1"], key)
if "sha256" in q:
r["results"] += apicall("hash", q["sha256"], key)
if 'vulnerability' in q:
r["results"] += apicall("vuln", q["vulnerability"], key)
2017-02-01 14:05:29 +01:00
if "domain" in q:
r["results"] += apicall("dns", q["domain"], key)
2017-01-21 23:31:19 +01:00
uniq = []
for res in r["results"]:
if res not in uniq:
uniq.append(res)
r["results"] = uniq
return r
def apicall(indicator_type, indicator, key=False):
2017-01-31 16:57:16 +01:00
try:
2017-01-21 23:31:19 +01:00
myURL = BASEurl + (extensions[str(indicator_type)])%indicator
2017-01-31 16:34:41 +01:00
jsondata = requests.get(myURL, headers=MyHeader(key)).json()
2017-01-31 16:57:16 +01:00
except:
2017-02-01 14:05:29 +01:00
jsondata = None
redata = []
#print(jsondata)
if not jsondata is None:
if indicator_type is "hash":
if "malware" in jsondata:
lopointer = jsondata["malware"]
redata.append({"type": "text", "values": lopointer["risk"]})
if indicator_type is "dns":
if "records" in str(jsondata):
lopointer = jsondata["Passive"]["records"]
for dataset in lopointer:
redata.append({"type":"domain", "values": dataset["value"]})
return redata
2017-01-21 23:31:19 +01:00
def introspection():
2017-01-31 16:34:41 +01:00
return mispattributes
2017-01-21 23:31:19 +01:00
def version():
2017-01-31 16:34:41 +01:00
moduleinfo['config'] = moduleconfig
2017-02-01 14:05:29 +01:00
return moduleinfo