new: [expansion] Added skeleton module for the misp_standard format

pull/700/head
Sami Mokaddem 2024-10-02 12:14:07 +02:00
parent 75576f0016
commit 4ea30ae3a8
No known key found for this signature in database
GPG Key ID: 164C473F627A06FA
1 changed files with 73 additions and 0 deletions

View File

@ -0,0 +1,73 @@
import json
from pymisp import MISPEvent
from . import check_input_attribute, standard_error_message
misperrors = {'error': 'Error'}
mispattributes = {
'input': [
# 'hostname',
# 'domain',
# 'ip-dst',
# 'url',
# Any other Attribute type...
],
'format': 'misp_standard'
}
moduleinfo = {
'version': '1',
'author': 'MISP',
'description': 'MISP module using the MISP standard skeleton',
'module-type': [ # possible module-types: 'expansion', 'hover' or both
'expansion',
'hover'
]
}
# config fields that your code expects from the site admin
moduleconfig = [
'config_name_1',
]
def DO_STUFF(misp_event, attribute):
return misp_event
def handler(q=False):
if q is False:
return False
request = json.loads(q)
# Input sanity check
if not request.get('attribute') or not check_input_attribute(request['attribute']):
return {'error': f'{standard_error_message}, which should contain at least a type, a value and an uuid.'}
attribute = request['attribute']
# Make sure the Attribute's type is one of the expected type
if attribute['type'] not in mispattributes['input']:
return {'error': 'Unsupported attribute type.'}
# Use PyMISP to create compatible MISP Format
misp_event = MISPEvent()
DO_STUFF(misp_event, attribute)
# Convert to the format understood by MISP
results = {}
event = misp_event.to_dict()
for key in ('Attribute', 'Object', 'EventReport'):
if key in event:
results[key] = event[key]
return {'results': results}
def introspection():
return mispattributes
def version():
moduleinfo['config'] = moduleconfig
return moduleinfo