MISP
/
misp-modules
mirror of https://github.com/MISP/misp-modules
2
0
Fork 0
Code Issues Releases Wiki Activity

fix: OpenIOC importer

pull/139/head
Raphaël Vinot 2017-10-25 11:27:59 -04:00
parent 2f6406b1e5
commit 951a0f974b
1 changed files with 15 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
misp_modules/modules/import_mod/openiocimport.py
View File

@ -4,23 +4,20 @@ import base64
from pymisp.tools import openioc from pymisp.tools import openioc
misperrors = {'error': 'Error'} misperrors = {'error': 'Error'}
userConfig = { userConfig = {'not save ioc': {'type': 'Boolean',
'not save ioc': { 'message': 'If you check this box, IOC file will not save as an attachment in MISP'
'type': 'Boolean', },
'message': 'If you check this box, IOC file will not save as an attachment in MISP' 'default tag': {
}, 'type': 'String',
'default tag': { 'message': 'Add tags spaced by a comma (tlp:white,misp:threat-level="no-risk")',
'type': 'String', 'validation': '0'}
'message': 'Add tags spaced by a comma (tlp:white,misp:threat-level="no-risk")', }
'validation' : '0'
}
}
inputSource = ['file'] inputSource = ['file']
moduleinfo = {'version': '0.1', 'author': 'Raphaël Vinot', moduleinfo = {'version': '0.1', 'author': 'Raphaël Vinot',
'description': 'Import OpenIOC package', 'description': 'Import OpenIOC package',
'module-type': ['import']} 'module-type': ['import']}
moduleconfig = [] moduleconfig = []
@ -47,27 +44,23 @@ def handler(q=False):
if q.get('config'): if q.get('config'):
if q['config'].get('not save ioc') == "0": if q['config'].get('not save ioc') == "0":
addFile = { addFile = {"values": [q.get('filename')],
"values": [q.get('filename')], "types": ['attachment'],
"types": ['attachment'], "categories": ['Support Tool'],
"categories": ['Support Tool'], "data": q.get('data')}
"data" : q.get('data'),
}
# add tag # add tag
if q['config'].get('default tag') is not None: if q['config'].get('default tag') is not None:
addFile["tags"] = q['config']['default tag'].split(",") addFile["tags"] = q['config']['default tag'].split(",")
# add file as attachment # add file as attachment
r["results"].append(addFile) r["results"].append(addFile)
# return all attributes # return all attributes
for attrib in pkg.attributes: for attrib in pkg.attributes:
toAppend = { toAppend = {
"values": [attrib.value], "values": [attrib.value],
"types": [attrib.type], "types": [attrib.type],
"categories": [attrib.category], "categories": [attrib.category],
"comment":attrib.comment "comment": getattr(attrib, 'comment', '')}
}
# add tag # add tag
if q.get('config') and q['config'].get('default tag') is not None: if q.get('config') and q['config'].get('default tag') is not None:
toAppend["tags"] = q['config']['default tag'].split(",") toAppend["tags"] = q['config']['default tag'].split(",")