add: Added documentation for the socialscan new module

- Also quick fix of the message for an invalid
  result or response concerning the queried email
  address or username
pull/429/head
chrisr3d 2020-10-02 17:01:02 +02:00
parent 95f5df7a91
commit 48635d8f1b
No known key found for this signature in database
GPG Key ID: 6BBED1B63A6D639F
4 changed files with 27 additions and 2 deletions

View File

@ -75,7 +75,8 @@ For more information: [Extending MISP with Python modules](https://www.misp-proj
* [shodan](misp_modules/modules/expansion/shodan.py) - a minimal [shodan](https://www.shodan.io/) expansion module. * [shodan](misp_modules/modules/expansion/shodan.py) - a minimal [shodan](https://www.shodan.io/) expansion module.
* [Sigma queries](misp_modules/modules/expansion/sigma_queries.py) - Experimental expansion module querying a sigma rule to convert it into all the available SIEM signatures. * [Sigma queries](misp_modules/modules/expansion/sigma_queries.py) - Experimental expansion module querying a sigma rule to convert it into all the available SIEM signatures.
* [Sigma syntax validator](misp_modules/modules/expansion/sigma_syntax_validator.py) - Sigma syntax validator. * [Sigma syntax validator](misp_modules/modules/expansion/sigma_syntax_validator.py) - Sigma syntax validator.
* [SophosLabs Intelix](misp_modules/modules/expansion/sophoslabs_intelix.py) - SophosLabs Intelix is an API for Threat Intelligence and Analysis (free tier availible). [SophosLabs](https://aws.amazon.com/marketplace/pp/B07SLZPMCS) * [Socialscan](misp_modules/modules/expansion/socialscan.py) - a hover module to check if an email address or a username is used on different online platforms, using the [socialscan](https://github.com/iojw/socialscan) python library
* [SophosLabs Intelix](misp_modules/modules/expansion/sophoslabs_intelix.py) - SophosLabs Intelix is an API for Threat Intelligence and Analysis (free tier available). [SophosLabs](https://aws.amazon.com/marketplace/pp/B07SLZPMCS)
* [sourcecache](misp_modules/modules/expansion/sourcecache.py) - a module to cache a specific link from a MISP instance. * [sourcecache](misp_modules/modules/expansion/sourcecache.py) - a module to cache a specific link from a MISP instance.
* [STIX2 pattern syntax validator](misp_modules/modules/expansion/stix2_pattern_syntax_validator.py) - a module to check a STIX2 pattern syntax. * [STIX2 pattern syntax validator](misp_modules/modules/expansion/stix2_pattern_syntax_validator.py) - a module to check a STIX2 pattern syntax.
* [ThreatCrowd](misp_modules/modules/expansion/threatcrowd.py) - an expansion module for [ThreatCrowd](https://www.threatcrowd.org/). * [ThreatCrowd](misp_modules/modules/expansion/threatcrowd.py) - an expansion module for [ThreatCrowd](https://www.threatcrowd.org/).

View File

@ -1214,6 +1214,22 @@ An expansion hover module to perform a syntax check on sigma rules.
----- -----
#### [socialscan](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/socialscan.py)
A hover module to get information on the availability of an email address or username on some online platforms.
- **features**:
>The module takes an email address or username as input and check its availability on some online platforms. The results for each platform are then returned to see if the email address or the username is used, available or if there is an issue with it.
- **input**:
>An email address or usename attribute.
- **output**:
>Text containing information about the availability of an email address or a username in some online platforms.
- **references**:
>https://github.com/iojw/socialscan
- **requirements**:
>The socialscan python library
-----
#### [sophoslabs_intelix](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/sophoslabs_intelix.py) #### [sophoslabs_intelix](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/sophoslabs_intelix.py)
<img src=logos/sophoslabs_intelix.svg height=60> <img src=logos/sophoslabs_intelix.svg height=60>

View File

@ -0,0 +1,8 @@
{
"description": "A hover module to get information on the availability of an email address or username on some online platforms.",
"requirements": ["The socialscan python library"],
"input": "An email address or usename attribute.",
"output": "Text containing information about the availability of an email address or a username in some online platforms.",
"references": ["https://github.com/iojw/socialscan"],
"features": "The module takes an email address or username as input and check its availability on some online platforms. The results for each platform are then returned to see if the email address or the username is used, available or if there is an issue with it."
}

View File

@ -51,7 +51,7 @@ def parse_results(query_results, feature):
results.append(f'Unable to retrieve the {feature} on {result.platform}.') results.append(f'Unable to retrieve the {feature} on {result.platform}.')
continue continue
if not result.valid: if not result.valid:
results.append(f'Invalid response from {result.platform}.') results.append(f'Invalid response from {result.platform}, or invalid {feature}.')
continue continue
statement = 'No account' if result.available else 'There is an account' statement = 'No account' if result.available else 'There is an account'
results.append(f'{statement} linked to the {feature} on {result.platform}.') results.append(f'{statement} linked to the {feature} on {result.platform}.')