MISP
/
misp-modules
mirror of https://github.com/MISP/misp-modules
2
0
Fork 0
Code Issues Releases Wiki Activity

Changed to single attribute EQL

pull/346/head
Braden Laverick 2019-10-29 20:11:35 +00:00
parent a426ad249d
commit c06ceedfb8
1 changed files with 12 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
misp_modules/modules/expansion/eql.py
View File

@ -56,23 +56,19 @@ def handler(q=False):
config = request.get("config", {"Default_Source": ""}) config = request.get("config", {"Default_Source": ""})
logging.info("Setting config to: %s", config) logging.info("Setting config to: %s", config)
# start parsing MISP data for supportedType in fieldmap.keys():
queryDict = {} if request.get(supportedType):
for event in request["data"]: attrType = supportedType
for attribute in event["Attribute"]:
if attribute["type"] in mispattributes["input"]: if attrType:
logging.debug("Adding %s to EQL query", attribute["value"]) eqlType = fieldmap[attrType]
event_type = event_types[fieldmap[attribute["type"]]] event_type = event_type[eqlType]
if event_type not in queryDict.keys(): fullEql = "{} where {} == \"{}\"".format(event_type, eqlType, request[attrType])
queryDict[event_type] = {} else:
queryDict[event_type][attribute["value"]] = fieldmap[attribute["type"]] misperrors['error'] = "Unsupported attributes type"
return misperrors
response = [] response = []
fullEql = ""
for query in queryDict.keys():
fullEql += "{} where\n".format(query)
for value in queryDict[query].keys():
fullEql += "\t{} == \"{}\"\n".format(queryDict[query][value], value)
response.append({'types': ['comment'], 'categories': ['External analysis'], 'values': fullEql, 'comment': "Event EQL queries"}) response.append({'types': ['comment'], 'categories': ['External analysis'], 'values': fullEql, 'comment': "Event EQL queries"})
return {'results': response} return {'results': response}