MISP
/
misp-modules
mirror of https://github.com/MISP/misp-modules
2
0
Fork 0
Code Issues Releases Wiki Activity

fix the last issues of #493 

(https://github.com/MISP/misp-modules/issues/493)
pull/507/head
Aaron Kaplan 2021-06-17 14:36:27 +00:00
parent d1aeafb3ae
commit 4078119db0
1 changed files with 19 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

36
misp_modules/modules/import_mod/cof2misp.py
View File

@ -82,7 +82,7 @@ def parse_and_insert_cof(data: str) -> dict:
# o.add_tag('tlp:amber') # FIXME: we'll want to add a tlp: tag to the object # o.add_tag('tlp:amber') # FIXME: we'll want to add a tlp: tag to the object
if 'bailiwick' in entry: if 'bailiwick' in entry:
o.add_attribute('bailiwick', value=entry['bailiwick'].rstrip('.')) o.add_attribute('bailiwick', value=entry['bailiwick'].rstrip('.'), distribution=0)
# #
# handle the combinations of rrtype (domain, ip) on both left and right side # handle the combinations of rrtype (domain, ip) on both left and right side
@ -91,26 +91,26 @@ def parse_and_insert_cof(data: str) -> dict:
if create_specific_attributes: if create_specific_attributes:
if rrtype in ['A', 'AAAA', 'A6']: # address type if rrtype in ['A', 'AAAA', 'A6']: # address type
# address type # address type
o.add_attribute('rrname_domain', value=rrname) o.add_attribute('rrname_domain', value=rrname, distribution=0)
for r in rdata: for r in rdata:
o.add_attribute('rdata_ip', value=r) o.add_attribute('rdata_ip', value=r, distribution=0)
elif rrtype in ['CNAME', 'DNAME', 'NS']: # both sides are domains elif rrtype in ['CNAME', 'DNAME', 'NS']: # both sides are domains
o.add_attribute('rrname_domain', value=rrname) o.add_attribute('rrname_domain', value=rrname, distribution=0)
for r in rdata: for r in rdata:
o.add_attribute('rdata_domain', value=r) o.add_attribute('rdata_domain', value=r, distribution=0)
elif rrtype in ['SOA']: # left side is a domain, right side is text elif rrtype in ['SOA']: # left side is a domain, right side is text
o.add_attribute('rrname_domain', value=rrname) o.add_attribute('rrname_domain', value=rrname, distribution=0)
# #
# now do the regular filling up of rrname, rrtype, time_first, etc. # now do the regular filling up of rrname, rrtype, time_first, etc.
# #
o.add_attribute('rrname', value=rrname) o.add_attribute('rrname', value=rrname, distribution=0)
o.add_attribute('rrtype', value=rrtype) o.add_attribute('rrtype', value=rrtype, distribution=0)
for r in rdata: for r in rdata:
o.add_attribute('rdata', value=r) o.add_attribute('rdata', value=r, distribution=0)
o.add_attribute('raw_rdata', value=json.dumps(rdata)) # FIXME: do we need to hex encode it? o.add_attribute('raw_rdata', value=json.dumps(rdata), distribution=0) # FIXME: do we need to hex encode it?
o.add_attribute('time_first', value=entry['time_first']) o.add_attribute('time_first', value=entry['time_first'], distribution=0)
o.add_attribute('time_last', value=entry['time_last']) o.add_attribute('time_last', value=entry['time_last'], distribution=0)
o.first_seen = entry['time_first'] # is this redundant? o.first_seen = entry['time_first'] # is this redundant?
o.last_seen = entry['time_last'] o.last_seen = entry['time_last']
@ -119,7 +119,7 @@ def parse_and_insert_cof(data: str) -> dict:
# #
for k in ['count', 'sensor_id', 'origin', 'text', 'time_first_ms', 'time_last_ms', 'zone_time_first', 'zone_time_last']: for k in ['count', 'sensor_id', 'origin', 'text', 'time_first_ms', 'time_last_ms', 'zone_time_first', 'zone_time_last']:
if k in entry and entry[k]: if k in entry and entry[k]:
o.add_attribute(k, value=entry[k]) o.add_attribute(k, value=entry[k], distribution=0)
# #
# add COF entry to MISP object # add COF entry to MISP object
@ -152,7 +152,6 @@ def parse_and_insert_dnsdbflex(data: str):
try: try:
entries = ndjson.loads(data) entries = ndjson.loads(data)
for entry in entries: # iterate over all ndjson lines for entry in entries: # iterate over all ndjson lines
# validate here (simple validation or full JSON Schema validation) # validate here (simple validation or full JSON Schema validation)
if not validate_dnsdbflex(entry): if not validate_dnsdbflex(entry):
return {"error": "Could not validate the dnsdbflex input '%s'" % entry} return {"error": "Could not validate the dnsdbflex input '%s'" % entry}
@ -162,9 +161,12 @@ def parse_and_insert_dnsdbflex(data: str):
rrname = entry['rrname'].rstrip('.') rrname = entry['rrname'].rstrip('.')
# create a new MISP object, based on the passive-dns object for each nd-JSON line # create a new MISP object, based on the passive-dns object for each nd-JSON line
o = MISPObject(name='passive-dns-dnsdbflex', standalone=False, comment='created by cof2misp') try:
o.add_attribute('rrname', value=rrname) o = MISPObject(name='passive-dns', standalone=False, distribution=0, comment='DNSDBFLEX import by cof2misp')
o.add_attribute('rrtype', value=rrtype) o.add_attribute('rrtype', value=rrtype, distribution=0, comment='DNSDBFLEX import by cof2misp')
o.add_attribute('rrname', value=rrname, distribution=0, comment='DNSDBFLEX import by cof2misp')
except Exception as ex:
print("could not create object. Reason: %s" % str(ex))
# #
# add dnsdbflex entry to MISP object # add dnsdbflex entry to MISP object