MISP
/
misp-modules
mirror of https://github.com/MISP/misp-modules
2
0
Fork 0
Code Issues Releases Wiki Activity

add targeting os

pull/193/head
Sebdraven 2018-06-11 11:25:17 +02:00
parent 7580c63433
commit 2e0e63fad6
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
misp_modules/modules/expansion/onyphe.py
View File

@ -58,16 +58,22 @@ def handle_expansion(api, ip, misperrors):
result_filtered = {"results": []}
urls_pasties = []
asn_list = []
os_list = []
for r in result['results']:
if r['@category'] == 'pastries':
if r['@type'] == 'pastebin':
urls_pasties.append('https://pastebin.com/raw/%s' % r['key'])
elif r['@category'] == 'synscan':
asn_list.append(r['asn'])
os_list.append(r['os'])
result_filtered['results'].append({'types': ['url'], 'values': urls_pasties,
'categories': ['External analysis']})
result_filtered['results'].append({'types': ['AS'], 'values': list(set(asn_list)),
'categories': ['Network activity']})
result_filtered['results'].append({'types': ['target-machine'],
'values': list(set(os_list)),
'categories': ['Targeting data']})
return result_filtered