MISP
/
misp-modules
mirror of https://github.com/MISP/misp-modules
2
0
Fork 0
Code Issues Releases Wiki Activity

Merge pull request #664 from VirusTotal/feat/gti-doc 

[Google Threat Intelligence] Add web doc and fix logo for the module
pull/666/head
Alexandre Dulaunoy 2024-05-14 16:25:49 +02:00 committed by GitHub
parent 8e3deb85a9 a9dda347bb
commit b5c459c71d
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 14 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
docs/logos/google_threat_intelligence.png
View File

Binary file not shown.
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 4.6 KiB

After

Width:  |  Height:  |  Size: 18 KiB

14
documentation/website/expansion/google_threat_intelligence.json Normal file
View File

@ -0,0 +1,14 @@
{
"description": "An expansion module to have the observable's threat score assessed by Google Threat Intelligence.",
"logo": "google_threat_intelligence.png",
"requirements": [
"An access to the Google Threat Intelligence API (apikey), with a high request rate limit."
],
"input": "A domain, hash (md5, sha1, sha256 or sha512), hostname or IP address attribute.",
"output": "Text fields containing the threat score, the severity, the verdict and the threat label of the observable inspected.",
"references": [
"https://www.virustotal.com/",
"https://gtidocs.virustotal.com/reference"
],
"features": "GTI assessment for the given observable, this include information about level of severity, a clear verdict (malicious, suspicious, undetected and bening) and additional information provided by the Mandiant expertise combined with the VirusTotal database.\n\n[Output example screeshot](https://github.com/MISP/MISP/assets/4747608/e275db2f-bb1e-4413-8cc0-ec3cb05e0414)"
}

2
misp_modules/modules/expansion/google_threat_intelligence.py
View File

@ -52,8 +52,6 @@ MODULE_INFO = {
DEFAULT_RESULTS_LIMIT = 10 DEFAULT_RESULTS_LIMIT = 10
class GoogleThreatIntelligenceParser: class GoogleThreatIntelligenceParser:
"""Main parser class to create the MISP event.""" """Main parser class to create the MISP event."""
def __init__(self, client: vt.Client, limit: int) -> None: def __init__(self, client: vt.Client, limit: int) -> None: