From 76a733fa6682601700a3e632a9c67c5e780c1065 Mon Sep 17 00:00:00 2001 From: Viktor von Drakk Date: Fri, 25 Aug 2017 05:45:57 -0700 Subject: [PATCH 1/4] Added code to allow 3rd party modules The new '-m pip.module.name' feature allows a pip-installed module to be specified on the command line and then loaded into the available modules without having to copy-paste files into the appropriate directories of this package. --- misp_modules/__init__.py | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/misp_modules/__init__.py b/misp_modules/__init__.py index 1edfc86..c18b55d 100644 --- a/misp_modules/__init__.py +++ b/misp_modules/__init__.py @@ -217,6 +217,7 @@ def main(): argParser.add_argument('-d', default=False, action='store_true', help='Enable debugging') argParser.add_argument('-p', default=6666, help='misp-modules TCP port (default 6666)') argParser.add_argument('-l', default='localhost', help='misp-modules listen address (default localhost)') + argParser.add_argument('-m', action='append', help='Register a custom module') args = argParser.parse_args() port = args.p listen = args.l @@ -232,6 +233,11 @@ def main(): helpersdir = 'helpers' load_helpers(helpersdir=helpersdir) mhandlers, loaded_modules = load_modules(modulesdir) + + for module in args.m: + mispmod = importlib.import_module(module) + mispmod.register(mhandlers, loaded_modules) + service = [(r'/modules', ListModules), (r'/query', QueryModule)] application = tornado.web.Application(service) From 113ac21a5d183e00121ce88644a6240068fbab49 Mon Sep 17 00:00:00 2001 From: Viktor von Drakk Date: Fri, 1 Sep 2017 07:44:53 -0700 Subject: [PATCH 2/4] added default parameter for new -m flag --- misp_modules/__init__.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/misp_modules/__init__.py b/misp_modules/__init__.py index c18b55d..1c1713b 100644 --- a/misp_modules/__init__.py +++ b/misp_modules/__init__.py @@ -217,7 +217,7 @@ def main(): argParser.add_argument('-d', default=False, action='store_true', help='Enable debugging') argParser.add_argument('-p', default=6666, help='misp-modules TCP port (default 6666)') argParser.add_argument('-l', default='localhost', help='misp-modules listen address (default localhost)') - argParser.add_argument('-m', action='append', help='Register a custom module') + argParser.add_argument('-m', default=[], action='append', help='Register a custom module') args = argParser.parse_args() port = args.p listen = args.l From 03baa0b84d70852b2e5557efacaaf4b20a008a26 Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Sat, 21 Oct 2017 19:52:19 +0200 Subject: [PATCH 3/4] fix: #137 when a CVE is not found, a return message is given --- misp_modules/modules/expansion/cve.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/misp_modules/modules/expansion/cve.py b/misp_modules/modules/expansion/cve.py index e370116..81d8db5 100755 --- a/misp_modules/modules/expansion/cve.py +++ b/misp_modules/modules/expansion/cve.py @@ -19,8 +19,11 @@ def handler(q=False): r = requests.get(cveapi_url + request.get('vulnerability')) if r.status_code == 200: vulnerability = json.loads(r.text) - if vulnerability.get('summary'): - summary = vulnerability['summary'] + if vulnerability: + if vulnerability.get('summary'): + summary = vulnerability['summary'] + else: + summary = 'Non existing CVE' else: misperrors['error'] = 'cve.circl.lu API not accessible' return misperrors['error'] From 951a0f974b5946c0e6c26ddaf7c948b53228c07e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rapha=C3=ABl=20Vinot?= Date: Wed, 25 Oct 2017 11:27:59 -0400 Subject: [PATCH 4/4] fix: OpenIOC importer --- .../modules/import_mod/openiocimport.py | 37 ++++++++----------- 1 file changed, 15 insertions(+), 22 deletions(-) diff --git a/misp_modules/modules/import_mod/openiocimport.py b/misp_modules/modules/import_mod/openiocimport.py index d5e39a0..c237bdc 100755 --- a/misp_modules/modules/import_mod/openiocimport.py +++ b/misp_modules/modules/import_mod/openiocimport.py @@ -4,23 +4,20 @@ import base64 from pymisp.tools import openioc misperrors = {'error': 'Error'} -userConfig = { - 'not save ioc': { - 'type': 'Boolean', - 'message': 'If you check this box, IOC file will not save as an attachment in MISP' - }, - 'default tag': { - 'type': 'String', - 'message': 'Add tags spaced by a comma (tlp:white,misp:threat-level="no-risk")', - 'validation' : '0' - } - } +userConfig = {'not save ioc': {'type': 'Boolean', + 'message': 'If you check this box, IOC file will not save as an attachment in MISP' + }, + 'default tag': { + 'type': 'String', + 'message': 'Add tags spaced by a comma (tlp:white,misp:threat-level="no-risk")', + 'validation': '0'} + } inputSource = ['file'] moduleinfo = {'version': '0.1', 'author': 'Raphaël Vinot', - 'description': 'Import OpenIOC package', - 'module-type': ['import']} + 'description': 'Import OpenIOC package', + 'module-type': ['import']} moduleconfig = [] @@ -47,27 +44,23 @@ def handler(q=False): if q.get('config'): if q['config'].get('not save ioc') == "0": - addFile = { - "values": [q.get('filename')], - "types": ['attachment'], - "categories": ['Support Tool'], - "data" : q.get('data'), - } + addFile = {"values": [q.get('filename')], + "types": ['attachment'], + "categories": ['Support Tool'], + "data": q.get('data')} # add tag if q['config'].get('default tag') is not None: addFile["tags"] = q['config']['default tag'].split(",") # add file as attachment r["results"].append(addFile) - # return all attributes for attrib in pkg.attributes: toAppend = { "values": [attrib.value], "types": [attrib.type], "categories": [attrib.category], - "comment":attrib.comment - } + "comment": getattr(attrib, 'comment', '')} # add tag if q.get('config') and q['config'].get('default tag') is not None: toAppend["tags"] = q['config']['default tag'].split(",")