MISP
/
misp-modules
mirror of https://github.com/MISP/misp-modules
2
0
Fork 0
Code Issues Releases Wiki Activity

Add a field for user to add tag for this import

pull/122/head
Tristan METAYER 2017-05-11 09:54:25 +02:00
parent abf8b8989a
commit ba1d715ad1
1 changed files with 65 additions and 52 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

117
misp_modules/modules/import_mod/openiocimport.py
View File

@ -5,79 +5,92 @@ from pymisp.tools import openioc
misperrors = {'error': 'Error'} misperrors = {'error': 'Error'}
userConfig = { userConfig = {
'not save ioc': { 'not save ioc': {
'type': 'Boolean', 'type': 'Boolean',
'message': 'If you check this box, IOC file will not save as an attachment in MISP' 'message': 'If you check this box, IOC file will not save as an attachment in MISP'
} },
} 'default tag': {
'type': 'String',
'message': 'Add tags spaced by a comma (tlp:white,misp:threat-level="no-risk")',
'validation' : '0'
}
}
inputSource = ['file'] inputSource = ['file']
moduleinfo = {'version': '0.1', 'author': 'Raphaël Vinot', moduleinfo = {'version': '0.1', 'author': 'Raphaël Vinot',
'description': 'Import OpenIOC package', 'description': 'Import OpenIOC package',
'module-type': ['import']} 'module-type': ['import']}
moduleconfig = [] moduleconfig = []
def handler(q=False): def handler(q=False):
# Just in case we have no data # Just in case we have no data
if q is False: if q is False:
return False return False
# The return value # The return value
r = {'results': []} r = {'results': []}
# Load up that JSON # Load up that JSON
q = json.loads(q) q = json.loads(q)
# It's b64 encoded, so decode that stuff # It's b64 encoded, so decode that stuff
package = base64.b64decode(q.get("data")).decode('utf-8') package = base64.b64decode(q.get("data")).decode('utf-8')
# If something really weird happened # If something really weird happened
if not package: if not package:
return json.dumps({"success": 0}) return json.dumps({"success": 0})
pkg = openioc.load_openioc(package) pkg = openioc.load_openioc(package)
if q.get('config'): if q.get('config'):
if q['config'].get('not save ioc') == "0": if q['config'].get('not save ioc') == "0":
addFile = {
"values": [q.get('filename')],
"types": ['attachment'],
"categories": ['Support Tool'],
"data" : q.get('data'),
}
# add tag
if q['config'].get('default tag') is not None:
addFile["tags"] = q['config']['default tag'].split(",")
# add file as attachment
r["results"].append(addFile)
# add origin file as attachment
if q.get("filename"):
r["results"].append({
"values": [q.get('filename')],
"types": ['attachment'],
"categories": ['Support Tool'],
"data" : q.get('data'),
})
# return all attributes # return all attributes
for attrib in pkg.attributes: for attrib in pkg.attributes:
r["results"].append({ toAppend = {
"values": [attrib.value], "values": [attrib.value],
"types": [attrib.type], "types": [attrib.type],
"categories": [attrib.category], "categories": [attrib.category],
"comment":attrib.comment}) "comment":attrib.comment
}
# add tag
if q['config'].get('default tag') is not None:
toAppend["tags"] = q['config']['default tag'].split(",")
return r r["results"].append(toAppend)
return r
def introspection(): def introspection():
modulesetup = {} modulesetup = {}
try: try:
userConfig userConfig
modulesetup['userConfig'] = userConfig modulesetup['userConfig'] = userConfig
except NameError: except NameError:
pass pass
try: try:
inputSource inputSource
modulesetup['inputSource'] = inputSource modulesetup['inputSource'] = inputSource
except NameError: except NameError:
pass pass
return modulesetup return modulesetup
def version(): def version():
moduleinfo['config'] = moduleconfig moduleinfo['config'] = moduleconfig
return moduleinfo return moduleinfo