misp-modules/misp_modules/modules/import_mod/stiximport.py

60 lines
1.2 KiB
Python
Raw Normal View History

import json
import base64
2016-11-21 11:59:30 +01:00
from pymisp.tools import stix
misperrors = {'error': 'Error'}
userConfig = {}
inputSource = ['file']
2016-11-21 11:59:30 +01:00
moduleinfo = {'version': '0.2', 'author': 'Hannah Ward',
'description': 'Import some stix stuff',
'module-type': ['import']}
2016-11-21 11:59:30 +01:00
moduleconfig = []
def handler(q=False):
2016-08-12 14:09:59 +02:00
# Just in case we have no data
if q is False:
return False
2016-08-11 17:37:29 +02:00
2016-08-12 14:09:59 +02:00
# The return value
r = {'results': []}
2016-08-11 17:37:29 +02:00
2016-08-12 14:09:59 +02:00
# Load up that JSON
q = json.loads(q)
2016-08-11 17:37:29 +02:00
2016-08-12 14:09:59 +02:00
# It's b64 encoded, so decode that stuff
2016-11-15 16:47:17 +01:00
package = base64.b64decode(q.get("data")).decode('utf-8')
2016-08-12 14:09:59 +02:00
# If something really weird happened
if not package:
2016-08-12 14:09:59 +02:00
return json.dumps({"success": 0})
2016-11-21 12:57:04 +01:00
pkg = stix.load_stix(package)
2016-11-21 11:59:30 +01:00
for attrib in pkg.attributes:
2017-01-07 02:10:44 +01:00
r["results"].append({"values": [attrib.value], "types": [attrib.type], "categories": [attrib.category]})
2016-08-12 12:34:43 +02:00
return r
2017-01-07 02:10:44 +01:00
def introspection():
modulesetup = {}
try:
userConfig
modulesetup['userConfig'] = userConfig
except NameError:
pass
try:
inputSource
modulesetup['inputSource'] = inputSource
except NameError:
pass
return modulesetup
def version():
moduleinfo['config'] = moduleconfig
return moduleinfo