MISP
/
misp-modules
mirror of https://github.com/MISP/misp-modules
2
0
Fork 0
Code Issues Releases Wiki Activity

added URL support

pull/448/head
milkmix 2020-11-20 18:56:28 +01:00
parent 71d2aeaacd
commit 30d9ae6032
1 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
misp_modules/modules/export_mod/defender_endpoint_export.py
View File

@ -8,7 +8,7 @@ import json
misperrors = {"error": "Error"} misperrors = {"error": "Error"}
types_to_use = ['sha1', 'md5', 'domain', 'ip'] types_to_use = ['sha1', 'md5', 'domain', 'ip', 'url']
userConfig = { userConfig = {
@ -44,12 +44,17 @@ def handle_ip(value, period):
where RemoteIP == {value}""" where RemoteIP == {value}"""
return query.replace('\n', ' ') return query.replace('\n', ' ')
def handle_url(value, period):
query = f"""find in (DeviceAlertEvents, DeviceNetworkEvents)
where RemoteUrl startswith {value}"""
return query.replace('\n', ' ')
handlers = { handlers = {
'sha1': handle_sha1, 'sha1': handle_sha1,
'md5': handle_md5, 'md5': handle_md5,
'domain': handle_domain, 'domain': handle_domain,
'ip': handle_ip 'ip': handle_ip,
'url': handle_url
} }