MISP
/
misp-modules
mirror of https://github.com/MISP/misp-modules
2
0
Fork 0
Code Issues Releases Wiki Activity

fixed metatag; convert summaries generator to list for error handling

pull/409/head
Jesse Hedden 2020-06-25 10:54:34 -07:00
parent b188d2da4e
commit 61fbb30e1c
1 changed files with 7 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
misp_modules/modules/expansion/trustar_enrich.py
View File

@ -14,7 +14,7 @@ moduleinfo = {'version': "0.1", 'author': "Jesse Hedden",
moduleconfig = ["user_api_key", "user_api_secret", "enclave_ids"] moduleconfig = ["user_api_key", "user_api_secret", "enclave_ids"]
MAX_PAGE_SIZE = 100 # Max allowable page size returned from /1.3/indicators/summaries endpoint MAX_PAGE_SIZE = 100 # Max allowable page size returned from /1.3/indicators/summaries endpoint
class TruSTARParser: class TruSTARParser:
@ -35,13 +35,11 @@ class TruSTARParser:
REPORT_BASE_URL = "https://station.trustar.co/constellation/reports/{}" REPORT_BASE_URL = "https://station.trustar.co/constellation/reports/{}"
CLIENT_METATAG = "misp-v2" CLIENT_METATAG = "MISP-{}".format(pymisp.__version__)
CLIENT_VERSION = "{}".format(pymisp.__version__)
def __init__(self, attribute, config): def __init__(self, attribute, config):
config['enclave_ids'] = config.get('enclave_ids', "").strip().split(',') config['enclave_ids'] = config.get('enclave_ids', "").strip().split(',')
config['client_metatag'] = self.CLIENT_METATAG config['client_metatag'] = self.CLIENT_METATAG
config['client_version'] = self.CLIENT_VERSION
self.ts_client = TruStar(config=config) self.ts_client = TruStar(config=config)
self.misp_event = MISPEvent() self.misp_event = MISPEvent()
@ -81,14 +79,13 @@ class TruSTARParser:
for summary in summaries: for summary in summaries:
trustar_obj = MISPObject('trustar_report') trustar_obj = MISPObject('trustar_report')
summary_dict = summary.to_dict() summary_type = summary.type
summary_type = summary_dict.get('type') summary_value = summary.value
summary_value = summary_dict.get('value')
if summary_type in self.ENTITY_TYPE_MAPPINGS: if summary_type in self.ENTITY_TYPE_MAPPINGS:
trustar_obj.add_attribute(summary_type, attribute_type=self.ENTITY_TYPE_MAPPINGS[summary_type], trustar_obj.add_attribute(summary_type, attribute_type=self.ENTITY_TYPE_MAPPINGS[summary_type],
value=summary_value) value=summary_value)
trustar_obj.add_attribute("INDICATOR_SUMMARY", attribute_type="text", trustar_obj.add_attribute("INDICATOR_SUMMARY", attribute_type="text",
value=json.dumps(summary_dict, sort_keys=True, indent=4)) value=json.dumps(summary.to_dict(), sort_keys=True, indent=4))
report_links = self.generate_trustar_links(summary_value) report_links = self.generate_trustar_links(summary_value)
for link in report_links: for link in report_links:
trustar_obj.add_attribute("REPORT_LINK", attribute_type="link", value=link) trustar_obj.add_attribute("REPORT_LINK", attribute_type="link", value=link)
@ -116,7 +113,8 @@ class TruSTARParser:
trustar_parser = TruSTARParser(attribute, config) trustar_parser = TruSTARParser(attribute, config)
try: try:
summaries = trustar_parser.ts_client.get_indicator_summaries([attribute['value']], page_size=MAX_PAGE_SIZE) summaries = list(
trustar_parser.ts_client.get_indicator_summaries([attribute['value']], page_size=MAX_PAGE_SIZE))
except Exception as e: except Exception as e:
misperrors['error'] = "Unable to retrieve TruSTAR summary data: {}".format(e) misperrors['error'] = "Unable to retrieve TruSTAR summary data: {}".format(e)
return misperrors return misperrors