MISP
/
misp-modules
mirror of https://github.com/MISP/misp-modules
2
0
Fork 0
Code Issues Releases Wiki Activity

add: Starting parsing network behavior fields

pull/304/head
chrisr3d 2019-05-17 22:18:11 +02:00
parent f9515c14d0
commit 0d5f867825
No known key found for this signature in database
GPG Key ID: 6BBED1B63A6D639F
1 changed files with 27 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
misp_modules/modules/import_mod/joe_import.py
View File

@ -21,6 +21,8 @@ file_object_mapping = {'entropy': ('float', 'entropy'),
'filetype': ('mime-type', 'mimetype')}
file_references_mapping = {'fileCreated': 'creates', 'fileDeleted': 'deletes',
'fileMoved': 'moves', 'fileRead': 'reads', 'fileWritten': 'writes'}
network_connection_object_mapping = {'srcip': ('ip-src', 'ip-src'), 'dstip': ('ip-dst', 'ip-dst'),
'srcport': ('port', 'src-port'), 'dstport': ('port', 'dst-port')}
pe_object_fields = {'entrypoint': ('text', 'entrypoint-address'),
'imphash': ('imphash', 'imphash')}
pe_object_mapping = {'CompanyName': 'company-name', 'FileDescription': 'file-description',
@ -81,6 +83,25 @@ class JoeParser():
def parse_behavior_network(self):
network = self.data['behavior']['network']
protocols = {'tcp': 4, 'udp': 4, 'icmp': 3,
'http': 7, 'https': 7, 'ftp': 7}
fields = ('srcip', 'dstip', 'srcport', 'dstport')
for protocol, layer in protocols.items():
if network.get(protocol):
connections = defaultdict(list)
for packet in network[protocol]['packet']:
timestamp = self.parse_timestamp(packet['timestamp'])
connections[(packet[field] for field in fields)].append(datetime.strptime(timestamp, '%B %d, %Y %H:%M:%S.%f'))
for connection, timestamps in connections.items():
network_connection_object = MISPObject('network-connection')
for field, value in zip(fields, connection):
attribute_type, object_relation = network_connection_object_mapping[field]
network_connection_object.add_attribute(object_relation, **{'type': attribute_type, 'value': value})
network_connection_object.add_attribute('first-packet-seen', **{'type': 'datetime', 'value': min(timestamps)})
network_connection_object.add_attribute('layer{}-protocol'.format(layer),
**{'type': 'text', 'value': protocol})
self.misp_event.add_object(**network_connection_object)
self.references[self.fileinfo_uuid].append({'idref': network_connection_object.uuid, 'relationship': 'initiates'})
def parse_behavior_system(self):
system = self.data['behavior']['system']
@ -181,6 +202,12 @@ class JoeParser():
event = json.loads(self.misp_event.to_json())['Event']
self.results = {key: event[key] for key in ('Attribute', 'Object') if (key in event and event[key])}
@staticmethod
def parse_timestamp(timestamp):
timestamp = timestamp.split(':')
timestamp[-1] = str(round(float(timestamp[-1].split(' ')[0]), 6))
return ':'.join(timestamp)
def handler(q=False):
if q is False: