MISP
/
misp-modules
mirror of https://github.com/MISP/misp-modules
2
0
Fork 0
Code Issues Releases Wiki Activity

add: Added initial event to reference it from the vulnerability object created out of it

pull/326/head
chrisr3d 2019-08-02 15:35:33 +02:00
parent 034222d7b3
commit 4df528c331
No known key found for this signature in database
GPG Key ID: 6BBED1B63A6D639F
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
misp_modules/modules/expansion/cve_advanced.py
View File

@ -13,9 +13,11 @@ cveapi_url = 'https://cve.circl.lu/api/cve/'
class VulnerabilityParser(): class VulnerabilityParser():
def __init__(self, vulnerability): def __init__(self, attribute, vulnerability):
self.attribute = attribute
self.vulnerability = vulnerability self.vulnerability = vulnerability
self.misp_event = MISPEvent() self.misp_event = MISPEvent()
self.misp_event.add_attribute(**attribute)
self.references = defaultdict(list) self.references = defaultdict(list)
self.capec_features = ('id', 'name', 'summary', 'prerequisites', 'solutions') self.capec_features = ('id', 'name', 'summary', 'prerequisites', 'solutions')
self.vulnerability_mapping = { self.vulnerability_mapping = {
@ -48,6 +50,7 @@ class VulnerabilityParser():
attribute_type, relation = self.vulnerability_mapping[feature] attribute_type, relation = self.vulnerability_mapping[feature]
for value in self.vulnerability[feature]: for value in self.vulnerability[feature]:
vulnerability_object.add_attribute(relation, **{'type': attribute_type, 'value': value}) vulnerability_object.add_attribute(relation, **{'type': attribute_type, 'value': value})
vulnerability_object.add_reference(self.attribute['uuid'], 'related-to')
self.misp_event.add_object(**vulnerability_object) self.misp_event.add_object(**vulnerability_object)
if 'cwe' in self.vulnerability: if 'cwe' in self.vulnerability:
self.__parse_weakness(vulnerability_object.uuid) self.__parse_weakness(vulnerability_object.uuid)
@ -110,7 +113,7 @@ def handler(q=False):
else: else:
misperrors['error'] = 'cve.circl.lu API not accessible' misperrors['error'] = 'cve.circl.lu API not accessible'
return misperrors['error'] return misperrors['error']
parser = VulnerabilityParser(vulnerability) parser = VulnerabilityParser(attribute, vulnerability)
parser.parse_vulnerability_information() parser.parse_vulnerability_information()
return parser.get_result() return parser.get_result()