MISP
/
misp-modules
mirror of https://github.com/MISP/misp-modules
2
0
Fork 0
Code Issues Releases Wiki Activity

fix: Support of the latest version of sigmatools

pull/307/head
chrisr3d 2019-06-15 08:06:47 +02:00
parent 1ac85a4879
commit 2f3ce1b615
No known key found for this signature in database
GPG Key ID: 6BBED1B63A6D639F
1 changed files with 8 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
misp_modules/modules/expansion/sigma_queries.py
View File

@ -4,7 +4,6 @@ import json
try: try:
from sigma.parser.collection import SigmaCollectionParser from sigma.parser.collection import SigmaCollectionParser
from sigma.configuration import SigmaConfiguration from sigma.configuration import SigmaConfiguration
from sigma.backends.base import BackendOptions
from sigma.backends.discovery import getBackend from sigma.backends.discovery import getBackend
except ImportError: except ImportError:
print("sigma or yaml is missing, use 'pip3 install sigmatools' to install it.") print("sigma or yaml is missing, use 'pip3 install sigmatools' to install it.")
@ -25,24 +24,20 @@ def handler(q=False):
misperrors['error'] = 'Sigma rule missing' misperrors['error'] = 'Sigma rule missing'
return misperrors return misperrors
config = SigmaConfiguration() config = SigmaConfiguration()
backend_options = BackendOptions(None)
f = io.TextIOWrapper(io.BytesIO(request.get('sigma').encode()), encoding='utf-8') f = io.TextIOWrapper(io.BytesIO(request.get('sigma').encode()), encoding='utf-8')
parser = SigmaCollectionParser(f, config, None) parser = SigmaCollectionParser(f, config)
targets = [] targets = []
old_stdout = sys.stdout results = []
result = io.StringIO()
sys.stdout = result
for t in sigma_targets: for t in sigma_targets:
backend = getBackend(t)(config, backend_options, None) backend = getBackend(t)(config, {'rulecomment': False})
try: try:
parser.generate(backend) parser.generate(backend)
backend.finalize() result = backend.finalize()
print("#NEXT") if result:
targets.append(t) results.append(result)
except Exception: targets.append(t)
except Exception as e:
continue continue
sys.stdout = old_stdout
results = result.getvalue()[:-5].split('#NEXT')
d_result = {t: r.strip() for t, r in zip(targets, results)} d_result = {t: r.strip() for t, r in zip(targets, results)}
return {'results': [{'types': mispattributes['output'], 'values': d_result}]} return {'results': [{'types': mispattributes['output'], 'values': d_result}]}