Browse Source

add datascan expansion

pull/197/head
Sebdraven 4 years ago
parent
commit
04e932cce0
  1. 67
      misp_modules/modules/expansion/onyphe_full.py

67
misp_modules/modules/expansion/onyphe_full.py

@ -77,13 +77,13 @@ def handle_ip(api, ip, misperrors):
misperrors['error'] = 'Error pastries result'
return misperrors
# r, status_ok = expand_datascan(api, misperrors, ip=ip)
#
# if status_ok:
# result_filtered['results'].append(r)
# else:
# return r
#
r, status_ok = expand_datascan(api, misperrors, ip=ip)
if status_ok:
result_filtered['results'].append(r)
else:
return r
r, status_ok = expand_forward(api, ip, misperrors)
if status_ok:
@ -139,12 +139,13 @@ def expand_syscan(api, ip, misperror):
'values': list(set(orgs)),
'categories': ['Targeting data'],
'comment': 'Organisations of %s found with synscan of Onyphe'
% ip
})
r.append({'types': ['AS'],
'values': list(set(asn_list)),
'categories': ['Network activity'],
'comment': 'As number of %s found with synscan of Onyphe'
'comment': 'As number of %s found with synscan of Onyphe' % ip
})
return r, status_ok
@ -152,7 +153,55 @@ def expand_syscan(api, ip, misperror):
def expand_datascan(api, misperror,**kwargs):
status_ok = False
r = None
r = []
ip = ''
query =''
asn_list = []
geoloc = []
orgs = []
ports = []
if 'ip' in kwargs:
query = kwargs.get('ip')
else:
query = kwargs.get('domain')
results = api.datascan(query)
if results['status'] == 'ok':
for elem in results['results']:
asn_list.append(elem['asn'])
os_target = elem['os']
geoloc.append(elem['location'])
orgs.append(elem['organization'])
ports.append(elem['port'])
r.append({'types': ['port'],
'values': list(set(ports)),
'categories': ['Other'],
'comment': 'Ports of %s found with datascan of Onyphe'
% ip
})
r.append({'types': ['target-location'],
'values': list(set(geoloc)),
'categories': ['Targeting data'],
'comment': 'Geolocalisation of %s found with synscan of Onyphe'
% ip
})
r.append({'types': ['target-org'],
'values': list(set(orgs)),
'categories': ['Targeting data'],
'comment': 'Organisations of %s found with synscan of Onyphe'
% ip
})
r.append({'types': ['AS'],
'values': list(set(asn_list)),
'categories': ['Network activity'],
'comment': 'As number of %s found with synscan of Onyphe' % ip
})
return r, status_ok

Loading…
Cancel
Save