mirror of https://github.com/MISP/misp-modules
chg: Made circl_passivedns module able to return MISP objects
parent
9c9f01b6ff
commit
b8d6141cb7
|
@ -1,41 +1,64 @@
|
||||||
import json
|
import json
|
||||||
import pypdns
|
import pypdns
|
||||||
|
from pymisp import MISPAttribute, MISPEvent, MISPObject
|
||||||
|
|
||||||
misperrors = {'error': 'Error'}
|
mispattributes = {'input': ['hostname', 'domain', 'ip-src', 'ip-dst'], 'format': 'misp_standard'}
|
||||||
mispattributes = {'input': ['hostname', 'domain', 'ip-src', 'ip-dst'], 'output': ['freetext']}
|
moduleinfo = {'version': '0.2', 'author': 'Alexandre Dulaunoy',
|
||||||
moduleinfo = {'version': '0.1', 'author': 'Alexandre Dulaunoy', 'description': 'Module to access CIRCL Passive DNS', 'module-type': ['expansion', 'hover']}
|
'description': 'Module to access CIRCL Passive DNS',
|
||||||
|
'module-type': ['expansion', 'hover']}
|
||||||
moduleconfig = ['username', 'password']
|
moduleconfig = ['username', 'password']
|
||||||
|
|
||||||
|
|
||||||
|
class PassiveDNSParser():
|
||||||
|
def __init__(self, attribute, authentication):
|
||||||
|
self.misp_event = MISPEvent()
|
||||||
|
self.attribute = MISPAttribute()
|
||||||
|
self.attribute.from_dict(**attribute)
|
||||||
|
self.misp_event.add_attribute(**self.attribute)
|
||||||
|
self.pdns = pypdns.PyPDNS(basic_auth=authentication)
|
||||||
|
|
||||||
|
def get_results(self):
|
||||||
|
if hasattr(self, 'result'):
|
||||||
|
return self.result
|
||||||
|
event = json.loads(self.misp_event.to_json())
|
||||||
|
results = {key:event[key] for key in ('Attribute', 'Object')}
|
||||||
|
return {'results': results}
|
||||||
|
|
||||||
|
def parse(self, value):
|
||||||
|
try:
|
||||||
|
results = self.pdns.query(self.attribute.value)
|
||||||
|
except Exception:
|
||||||
|
self.result = {'error': 'There is an authentication error, please make sure you supply correct credentials.'}
|
||||||
|
return
|
||||||
|
mapping = {'count': 'counter', 'origin': 'text',
|
||||||
|
'time_first': 'datetime', 'rrtype': 'text',
|
||||||
|
'rrname': 'text', 'rdata': 'text',
|
||||||
|
'time_last': 'datetime'}
|
||||||
|
for result in results:
|
||||||
|
pdns_object = MISPObject('passive-dns')
|
||||||
|
for relation, attribute_type in mapping.items():
|
||||||
|
pdns_object.add_attribute(relation, type=attribute_type, value=result[relation])
|
||||||
|
pdns_object.add_reference(self.attribute.uuid, 'associated-to')
|
||||||
|
self.misp_event.add_object(**pdns_object)
|
||||||
|
|
||||||
|
|
||||||
def handler(q=False):
|
def handler(q=False):
|
||||||
if q is False:
|
if q is False:
|
||||||
return False
|
return False
|
||||||
request = json.loads(q)
|
request = json.loads(q)
|
||||||
if request.get('hostname'):
|
if not request.get('config'):
|
||||||
toquery = request['hostname']
|
return {'error': 'CIRCL Passive DNS authentication is missing.'}
|
||||||
elif request.get('domain'):
|
if not request['config'].get('username') or not request['config'].get('password'):
|
||||||
toquery = request['domain']
|
return {'error': 'CIRCL Passive DNS authentication is incomplete, please provide your username and password.'}
|
||||||
elif request.get('ip-src'):
|
authentication = (request['config']['username'], request['config']['password'])
|
||||||
toquery = request['ip-src']
|
if not request.get('attribute'):
|
||||||
elif request.get('ip-dst'):
|
return {'error': 'Unsupported input.'}
|
||||||
toquery = request['ip-dst']
|
attribute = request['attribute']
|
||||||
else:
|
if not any(input_type == attribute['type'] for input_type in mispattributes['input']):
|
||||||
misperrors['error'] = "Unsupported attributes type"
|
return {'error': 'Unsupported attributes type'}
|
||||||
return misperrors
|
pdns_parser = PassiveDNSParser(attribute, authentication)
|
||||||
|
pdns_parser.parse(attribute['value'])
|
||||||
if (request.get('config')):
|
return pdns_parser.get_results()
|
||||||
if (request['config'].get('username') is None) or (request['config'].get('password') is None):
|
|
||||||
misperrors['error'] = 'CIRCL Passive DNS authentication is missing'
|
|
||||||
return misperrors
|
|
||||||
|
|
||||||
x = pypdns.PyPDNS(basic_auth=(request['config']['username'], request['config']['password']))
|
|
||||||
res = x.query(toquery)
|
|
||||||
out = ''
|
|
||||||
for v in res:
|
|
||||||
out = out + "{} ".format(v['rdata'])
|
|
||||||
|
|
||||||
r = {'results': [{'types': mispattributes['output'], 'values': out}]}
|
|
||||||
return r
|
|
||||||
|
|
||||||
|
|
||||||
def introspection():
|
def introspection():
|
||||||
|
|
Loading…
Reference in New Issue