mirror of https://github.com/MISP/misp-modules
Merge branch 'master' of https://github.com/MISP/misp-modules
commit
c34628890e
|
@ -7,8 +7,12 @@ without modifying core components. The API is available via a simple REST API wh
|
||||||
|
|
||||||
MISP modules support is included in MISP starting from version 2.4.28.
|
MISP modules support is included in MISP starting from version 2.4.28.
|
||||||
|
|
||||||
|
For more information: [Extending MISP with Python modules](https://www.circl.lu/assets/files/misp-training/3.1-MISP-modules.pdf) slides from MISP training.
|
||||||
|
|
||||||
## Existing MISP modules
|
## Existing MISP modules
|
||||||
|
|
||||||
|
* [CIRCL Passive SSL](modules/expansion/circl_passivessl.py) - a hover and expansion module to expand IP addresses with the X.509 certificate seen.
|
||||||
|
* [CIRCL Passive DNS](modules/expansion/circl_passivedns.py) - a hover and expansion module to expand hostname and IP addresses with passive DNS information.
|
||||||
* [CVE](modules/expansion/cve.py) - a hover module to give more information about a vulnerability (CVE).
|
* [CVE](modules/expansion/cve.py) - a hover module to give more information about a vulnerability (CVE).
|
||||||
* [DNS](modules/expansion/dns.py) - a simple module to resolve MISP attributes like hostname and domain to expand IP addresses attributes.
|
* [DNS](modules/expansion/dns.py) - a simple module to resolve MISP attributes like hostname and domain to expand IP addresses attributes.
|
||||||
* [passivetotal](modules/expansion/passivetotal.py) - a [passivetotal](https://www.passivetotal.org/) module that queries a number of different PassiveTotal datasets.
|
* [passivetotal](modules/expansion/passivetotal.py) - a [passivetotal](https://www.passivetotal.org/) module that queries a number of different PassiveTotal datasets.
|
||||||
|
@ -17,7 +21,8 @@ MISP modules support is included in MISP starting from version 2.4.28.
|
||||||
## How to install and start MISP modules?
|
## How to install and start MISP modules?
|
||||||
|
|
||||||
~~~~bash
|
~~~~bash
|
||||||
git clone git@github.com:MISP/misp-modules.git
|
apt-get install python-dev python3-pip
|
||||||
|
git clone https://github.com/MISP/misp-modules.git
|
||||||
cd misp-modules
|
cd misp-modules
|
||||||
pip3 install -r REQUIREMENTS
|
pip3 install -r REQUIREMENTS
|
||||||
cd bin
|
cd bin
|
||||||
|
|
|
@ -4,3 +4,4 @@ requests
|
||||||
urlarchiver
|
urlarchiver
|
||||||
passivetotal
|
passivetotal
|
||||||
PyPDNS
|
PyPDNS
|
||||||
|
pypssl
|
||||||
|
|
|
@ -2,8 +2,13 @@ import json
|
||||||
import dns.resolver
|
import dns.resolver
|
||||||
|
|
||||||
misperrors = {'error': 'Error'}
|
misperrors = {'error': 'Error'}
|
||||||
mispattributes = {'input': ['hostname', 'domain'], 'output': ['ip-src', 'ip-dst']}
|
mispattributes = {'input': ['hostname', 'domain'], 'output': ['ip-src',
|
||||||
moduleinfo = {'version': '0.1', 'author': 'Alexandre Dulaunoy', 'description': 'Simple DNS expansion service to resolve IP address from MISP attributes', 'module-type': ['expansion', 'hover']}
|
'ip-dst']}
|
||||||
|
moduleinfo = {'version': '0.2', 'author': 'Alexandre Dulaunoy',
|
||||||
|
'description': 'Simple DNS expansion service to resolve IP address from MISP attributes',
|
||||||
|
'module-type': ['expansion', 'hover']}
|
||||||
|
|
||||||
|
moduleconfig = ['nameserver']
|
||||||
|
|
||||||
|
|
||||||
def handler(q=False):
|
def handler(q=False):
|
||||||
|
@ -19,7 +24,15 @@ def handler(q=False):
|
||||||
r = dns.resolver.Resolver()
|
r = dns.resolver.Resolver()
|
||||||
r.timeout = 2
|
r.timeout = 2
|
||||||
r.lifetime = 2
|
r.lifetime = 2
|
||||||
r.nameservers = ['8.8.8.8']
|
|
||||||
|
if request.get('config'):
|
||||||
|
if request['config'].get('nameserver'):
|
||||||
|
nameservers = []
|
||||||
|
nameservers.append(request['config'].get('nameserver'))
|
||||||
|
r.nameservers = nameservers
|
||||||
|
else:
|
||||||
|
r.nameservers = ['8.8.8.8']
|
||||||
|
|
||||||
try:
|
try:
|
||||||
answer = r.query(toquery, 'A')
|
answer = r.query(toquery, 'A')
|
||||||
except dns.resolver.NXDOMAIN:
|
except dns.resolver.NXDOMAIN:
|
||||||
|
@ -31,7 +44,9 @@ def handler(q=False):
|
||||||
except:
|
except:
|
||||||
misperrors['error'] = "DNS resolving error"
|
misperrors['error'] = "DNS resolving error"
|
||||||
return misperrors
|
return misperrors
|
||||||
r = {'results': [{'types': mispattributes['output'], 'values':[str(answer[0])]}]}
|
|
||||||
|
r = {'results': [{'types': mispattributes['output'],
|
||||||
|
'values':[str(answer[0])]}]}
|
||||||
return r
|
return r
|
||||||
|
|
||||||
|
|
||||||
|
@ -40,4 +55,5 @@ def introspection():
|
||||||
|
|
||||||
|
|
||||||
def version():
|
def version():
|
||||||
|
moduleinfo['config'] = moduleconfig
|
||||||
return moduleinfo
|
return moduleinfo
|
||||||
|
|
|
@ -0,0 +1,67 @@
|
||||||
|
import json
|
||||||
|
import psycopg2
|
||||||
|
|
||||||
|
misperrors = {'error': 'Error'}
|
||||||
|
mispattributes = {'input': ['hostname', 'domain', 'ip-src', 'ip-dst', 'AS'], 'output': ['freetext']}
|
||||||
|
moduleinfo = {'version': '0.1', 'author': 'L. Aaron Kaplan <kaplan@cert.at>', 'description': 'Module to access intelmqs eventdb', 'module-type': ['expansion', 'hover']}
|
||||||
|
moduleconfig = ['username', 'password', 'hostname', 'database']
|
||||||
|
|
||||||
|
|
||||||
|
def connect(user, password, host, dbname):
|
||||||
|
try:
|
||||||
|
conn = psycopg2.connect(database=dbname, user=user, host=host, password=password)
|
||||||
|
except Exception as e:
|
||||||
|
print("I am unable to connect to the database: %s" %e)
|
||||||
|
return conn
|
||||||
|
|
||||||
|
|
||||||
|
def handler(q=False):
|
||||||
|
if q is False:
|
||||||
|
return False
|
||||||
|
request = json.loads(q)
|
||||||
|
#if request.get('hostname'):
|
||||||
|
# toquery = request['hostname']
|
||||||
|
#elif request.get('domain'):
|
||||||
|
# toquery = request['domain']
|
||||||
|
if request.get('ip-src'):
|
||||||
|
toquery = request['ip-src']
|
||||||
|
#elif request.get('ip-dst'):
|
||||||
|
# toquery = request['ip-dst']
|
||||||
|
#elif request.get('AS'):
|
||||||
|
# toquery = request['AS']
|
||||||
|
else:
|
||||||
|
misperrors['error'] = "Unsupported attributes type"
|
||||||
|
return misperrors
|
||||||
|
|
||||||
|
if (request.get('config')):
|
||||||
|
if (request['config'].get('username') is None) or (request['config'].get('password') is None):
|
||||||
|
misperrors['error'] = 'intelmq eventdb authentication is missing'
|
||||||
|
return misperrors
|
||||||
|
|
||||||
|
conn = connect(request['config']['username'], request['config']['password'], request['config']['hostname'], request['config']['database'])
|
||||||
|
cur = conn.cursor()
|
||||||
|
SQL1 = 'SELECT COUNT(*) from events where "source.ip" = \'%s\'' %(toquery)
|
||||||
|
try:
|
||||||
|
cur.execute(SQL1)
|
||||||
|
except Exception as e:
|
||||||
|
misperrors['error'] = 'can not query database'
|
||||||
|
print(e)
|
||||||
|
return misperrors
|
||||||
|
|
||||||
|
results = cur.fetchone()
|
||||||
|
|
||||||
|
out = ''
|
||||||
|
out = out + "{} ".format(results[0]) + " results found in the DB"
|
||||||
|
|
||||||
|
r = {'results': [{'types': mispattributes['output'], 'values': out}]}
|
||||||
|
conn.close()
|
||||||
|
return r
|
||||||
|
|
||||||
|
|
||||||
|
def introspection():
|
||||||
|
return mispattributes
|
||||||
|
|
||||||
|
|
||||||
|
def version():
|
||||||
|
moduleinfo['config'] = moduleconfig
|
||||||
|
return moduleinfo
|
|
@ -1 +1 @@
|
||||||
{"module": "dns", "hostname": "www.circl.lu"}
|
{"module": "dns", "hostname": "www.circl.lu", "config" : {"nameserver":"8.8.8.8"}}
|
||||||
|
|
Loading…
Reference in New Issue