mirror of https://github.com/MISP/misp-modules
chg: [documentation] updated
parent
9ea5c97c32
commit
9a1140c671
|
|
@ -58,7 +58,7 @@ A module tu query the AssemblyLine API with a submission ID to get the submissio
|
|||
- **output**:
|
||||
>MISP attributes & objects parsed from the AssemblyLine submission.
|
||||
- **references**:
|
||||
>https://www.cyber.cg.ca/en/assemblyline
|
||||
>https://www.cyber.gc.ca/en/assemblyline
|
||||
- **requirements**:
|
||||
>assemblyline_client: Python library to query the AssemblyLine rest API.
|
||||
|
||||
|
|
@ -207,6 +207,39 @@ Modules to access CIRCL Passive SSL.
|
|||
|
||||
-----
|
||||
|
||||
#### [cluster25_expand](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/expansion/cluster25_expand.py)
|
||||
|
||||
<img src=logos/cluster25.png height=60>
|
||||
|
||||
Module to query Cluster25 CTI.
|
||||
- **features**:
|
||||
>This module takes a MISP attribute value as input to query the Cluster25CTI API. The result is then mapped into compatible MISP Objects and relative attributes.
|
||||
>
|
||||
- **input**:
|
||||
>An Indicator value of type included in the following list:
|
||||
>- domain
|
||||
>- email-src
|
||||
>- email-dst
|
||||
>- filename
|
||||
>- md5
|
||||
>- sha1
|
||||
>- sha256
|
||||
>- ip-src
|
||||
>- ip-dst
|
||||
>- url
|
||||
>- vulnerability
|
||||
>- btc
|
||||
>- xmr
|
||||
> ja3-fingerprint-md5
|
||||
- **output**:
|
||||
>A series of c25 MISP Objects with colletion of attributes mapped from Cluster25 CTI query result.
|
||||
- **references**:
|
||||
>
|
||||
- **requirements**:
|
||||
>A Cluster25 API access (API id & key)
|
||||
|
||||
-----
|
||||
|
||||
#### [countrycode](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/expansion/countrycode.py)
|
||||
|
||||
Module to expand country codes.
|
||||
|
|
@ -780,6 +813,28 @@ Module to access intelmqs eventdb.
|
|||
|
||||
-----
|
||||
|
||||
#### [ip2locationio](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/expansion/ip2locationio.py)
|
||||
|
||||
<img src=logos/ip2locationio.png height=60>
|
||||
|
||||
An expansion module to query IP2Location.io to gather more information on a given IP address.
|
||||
- **features**:
|
||||
>The module takes an IP address attribute as input and queries the IP2Location.io API.
|
||||
>Free plan user will get the basic geolocation informaiton, and different subsription plan will get more information on the IP address.
|
||||
> Refer to [pricing page](https://www.ip2location.io/pricing) for more information on data available for each plan.
|
||||
>
|
||||
>More information on the responses content is available in the [documentation](https://www.ip2location.io/ip2location-documentation).
|
||||
- **input**:
|
||||
>IP address attribute.
|
||||
- **output**:
|
||||
>Additional information on the IP address, such as geolocation, proxy and so on. Refer to the Response Format section in https://www.ip2location.io/ip2location-documentation to find out the full format of the data returned.
|
||||
- **references**:
|
||||
>https://www.ip2location.io/ip2location-documentation
|
||||
- **requirements**:
|
||||
>An IP2Location.io token
|
||||
|
||||
-----
|
||||
|
||||
#### [ipasn](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/expansion/ipasn.py)
|
||||
|
||||
Module to query an IP ASN history service (https://github.com/D4-project/IPASN-History).
|
||||
|
|
@ -1459,6 +1514,24 @@ An expansion hover module to perform a syntax check on sigma rules.
|
|||
|
||||
-----
|
||||
|
||||
#### [sigmf-expand](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/expansion/sigmf-expand.py)
|
||||
|
||||
Enrichs a SigMF Recording or extracts a SigMF Archive into a SigMF Recording.
|
||||
- **features**:
|
||||
>This module can be used to expand a SigMF Recording object into a SigMF Expanded Recording object with a waterfall plot or to extract a SigMF Archive object into a SigMF Recording objet.
|
||||
- **input**:
|
||||
>Object of sigmf-archive or sigmf-recording template.
|
||||
- **output**:
|
||||
>Object of sigmf-expanded-recording or sigmf-recording template.
|
||||
- **references**:
|
||||
>https://github.com/sigmf/SigMF
|
||||
- **requirements**:
|
||||
> - matplotlib: For plotting the waterfall plot of the recording.
|
||||
> - numpy: For the waterfall plot of the recording.
|
||||
> - sigmf: For validating SigMF files.
|
||||
|
||||
-----
|
||||
|
||||
#### [socialscan](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/expansion/socialscan.py)
|
||||
|
||||
A hover module to get information on the availability of an email address or username on some online platforms.
|
||||
|
|
|
|||
|
|
@ -55,7 +55,7 @@ A module tu query the AssemblyLine API with a submission ID to get the submissio
|
|||
- **output**:
|
||||
>MISP attributes & objects parsed from the AssemblyLine submission.
|
||||
- **references**:
|
||||
>https://www.cyber.cg.ca/en/assemblyline
|
||||
>https://www.cyber.gc.ca/en/assemblyline
|
||||
- **requirements**:
|
||||
>assemblyline_client: Python library to query the AssemblyLine rest API.
|
||||
|
||||
|
|
@ -204,6 +204,39 @@ Modules to access CIRCL Passive SSL.
|
|||
|
||||
-----
|
||||
|
||||
#### [cluster25_expand](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/expansion/cluster25_expand.py)
|
||||
|
||||
<img src=../logos/cluster25.png height=60>
|
||||
|
||||
Module to query Cluster25 CTI.
|
||||
- **features**:
|
||||
>This module takes a MISP attribute value as input to query the Cluster25CTI API. The result is then mapped into compatible MISP Objects and relative attributes.
|
||||
>
|
||||
- **input**:
|
||||
>An Indicator value of type included in the following list:
|
||||
>- domain
|
||||
>- email-src
|
||||
>- email-dst
|
||||
>- filename
|
||||
>- md5
|
||||
>- sha1
|
||||
>- sha256
|
||||
>- ip-src
|
||||
>- ip-dst
|
||||
>- url
|
||||
>- vulnerability
|
||||
>- btc
|
||||
>- xmr
|
||||
> ja3-fingerprint-md5
|
||||
- **output**:
|
||||
>A series of c25 MISP Objects with colletion of attributes mapped from Cluster25 CTI query result.
|
||||
- **references**:
|
||||
>
|
||||
- **requirements**:
|
||||
>A Cluster25 API access (API id & key)
|
||||
|
||||
-----
|
||||
|
||||
#### [countrycode](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/expansion/countrycode.py)
|
||||
|
||||
Module to expand country codes.
|
||||
|
|
@ -777,6 +810,28 @@ Module to access intelmqs eventdb.
|
|||
|
||||
-----
|
||||
|
||||
#### [ip2locationio](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/expansion/ip2locationio.py)
|
||||
|
||||
<img src=../logos/ip2locationio.png height=60>
|
||||
|
||||
An expansion module to query IP2Location.io to gather more information on a given IP address.
|
||||
- **features**:
|
||||
>The module takes an IP address attribute as input and queries the IP2Location.io API.
|
||||
>Free plan user will get the basic geolocation informaiton, and different subsription plan will get more information on the IP address.
|
||||
> Refer to [pricing page](https://www.ip2location.io/pricing) for more information on data available for each plan.
|
||||
>
|
||||
>More information on the responses content is available in the [documentation](https://www.ip2location.io/ip2location-documentation).
|
||||
- **input**:
|
||||
>IP address attribute.
|
||||
- **output**:
|
||||
>Additional information on the IP address, such as geolocation, proxy and so on. Refer to the Response Format section in https://www.ip2location.io/ip2location-documentation to find out the full format of the data returned.
|
||||
- **references**:
|
||||
>https://www.ip2location.io/ip2location-documentation
|
||||
- **requirements**:
|
||||
>An IP2Location.io token
|
||||
|
||||
-----
|
||||
|
||||
#### [ipasn](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/expansion/ipasn.py)
|
||||
|
||||
Module to query an IP ASN history service (https://github.com/D4-project/IPASN-History).
|
||||
|
|
@ -1456,6 +1511,24 @@ An expansion hover module to perform a syntax check on sigma rules.
|
|||
|
||||
-----
|
||||
|
||||
#### [sigmf-expand](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/expansion/sigmf-expand.py)
|
||||
|
||||
Enrichs a SigMF Recording or extracts a SigMF Archive into a SigMF Recording.
|
||||
- **features**:
|
||||
>This module can be used to expand a SigMF Recording object into a SigMF Expanded Recording object with a waterfall plot or to extract a SigMF Archive object into a SigMF Recording objet.
|
||||
- **input**:
|
||||
>Object of sigmf-archive or sigmf-recording template.
|
||||
- **output**:
|
||||
>Object of sigmf-expanded-recording or sigmf-recording template.
|
||||
- **references**:
|
||||
>https://github.com/sigmf/SigMF
|
||||
- **requirements**:
|
||||
> - matplotlib: For plotting the waterfall plot of the recording.
|
||||
> - numpy: For the waterfall plot of the recording.
|
||||
> - sigmf: For validating SigMF files.
|
||||
|
||||
-----
|
||||
|
||||
#### [socialscan](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/expansion/socialscan.py)
|
||||
|
||||
A hover module to get information on the availability of an email address or username on some online platforms.
|
||||
|
|
|
|||
Loading…
Reference in New Issue