From 7781a0cae7586843344eec8f7c1a0142d3727fd4 Mon Sep 17 00:00:00 2001
From: Sebdraven <sebdraven@protonmail.com>
Date: Fri, 5 Feb 2021 10:18:52 +0100
Subject: [PATCH] add new module

new module yeti
---
 REQUIREMENTS                           |  4 ++--
 misp_modules/modules/expansion/yeti.py | 17 +++++++++++++++++
 2 files changed, 19 insertions(+), 2 deletions(-)
 create mode 100644 misp_modules/modules/expansion/yeti.py

diff --git a/REQUIREMENTS b/REQUIREMENTS
index 73b002a..92175f2 100644
--- a/REQUIREMENTS
+++ b/REQUIREMENTS
@@ -8,7 +8,7 @@
 -e git+https://github.com/cartertemm/ODTReader.git/@49d6938693f6faa3ff09998f86dba551ae3a996b#egg=odtreader
 -e git+https://github.com/sebdraven/pydnstrails@48c1f740025c51289f43a24863d1845ff12fd21a#egg=pydnstrails
 -e git+https://github.com/sebdraven/pyonyphe@1ce15581beebb13e841193a08a2eb6f967855fcb#egg=pyonyphe
--e git+https://github.com/stricaud/faup.git#egg=pyfaup&subdirectory=src/lib/bindings/python
+#-e git+https://github.com/stricaud/faup.git#egg=pyfaup&subdirectory=src/lib/bindings/python
 aiohttp==3.4.4
 antlr4-python3-runtime==4.8 ; python_version >= '3'
 apiosintds==1.8.3
@@ -44,7 +44,7 @@ importlib-metadata==1.6.0 ; python_version < '3.8'
 isodate==0.6.0
 jbxapi==3.4.0
 jsonschema==3.2.0
-lief==0.10.1
+
 lxml==4.5.0
 maclookup==1.0.3
 maxminddb==1.5.2
diff --git a/misp_modules/modules/expansion/yeti.py b/misp_modules/modules/expansion/yeti.py
new file mode 100644
index 0000000..5742a08
--- /dev/null
+++ b/misp_modules/modules/expansion/yeti.py
@@ -0,0 +1,17 @@
+import json
+
+import json
+try:
+    import pyeti
+except ImportError:
+    print("pyeti module not installed.")
+
+misperrors = {'error': 'Error'}
+
+mispattributes = {'input': ['ip-src', 'ip-dst', 'hostname', 'domain'],
+                  'output': ['hostname', 'domain', 'ip-src', 'ip-dst', 'url']}
+# possible module-types: 'expansion', 'hover' or both
+moduleinfo = {'version': '1', 'author': 'Sebastien Larinier @sebdraven',
+              'description': 'Query on yeti',
+              'module-type': ['expansion', 'hover']}
+