8ear
2 년 전
14개의 변경된 파일과 2625개의 추가작업 그리고 489개의 파일을 삭제
@ -0,0 +1,19 @@ |
|||
|
|||
.PHONY: prepare_docs generate_docs ci_generate_docs test_docs |
|||
|
|||
prepare_docs: |
|||
cd doc; python generate_documentation.py |
|||
mkdir -p docs/expansion/logos docs/export_mod/logos docs/import_mod/logos |
|||
cp -R doc/logos/* docs/expansion/logos |
|||
cp -R doc/logos/* docs/export_mod/logos |
|||
cp -R doc/logos/* docs/import_mod/logos |
|||
cp LICENSE docs/license.md |
|||
|
|||
generate_docs: prepare_docs |
|||
docker run --rm -it -v $(PWD):/docs squidfunk/mkdocs-material build |
|||
|
|||
ci_generate_docs: prepare_docs |
|||
mkdocs gh-deploy |
|||
|
|||
test_docs: prepare_docs |
|||
docker run --rm -it -p 8000:8000 -v $(PWD):/docs squidfunk/mkdocs-material |
|||
@ -0,0 +1,3 @@ |
|||
mkdocs |
|||
mkdocs-material |
|||
markdown_include |
|||
@ -0,0 +1,373 @@ |
|||
## How to add your own MISP modules? |
|||
|
|||
Create your module in [misp_modules/modules/expansion/](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/), [misp_modules/modules/export_mod/](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/export_mod/), or [misp_modules/modules/import_mod/](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/import_mod/). The module should have at minimum three functions: |
|||
|
|||
* **introspection** function that returns a dict of the supported attributes (input and output) by your expansion module. |
|||
* **handler** function which accepts a JSON document to expand the values and return a dictionary of the expanded values. |
|||
* **version** function that returns a dict with the version and the associated meta-data including potential configurations required of the module. |
|||
|
|||
Don't forget to return an error key and value if an error is raised to propagate it to the MISP user-interface. |
|||
|
|||
Your module's script name should also be added in the `__all__` list of `<module type folder>/__init__.py` in order for it to be loaded. |
|||
|
|||
~~~python |
|||
... |
|||
# Checking for required value |
|||
if not request.get('ip-src'): |
|||
# Return an error message |
|||
return {'error': "A source IP is required"} |
|||
... |
|||
~~~ |
|||
|
|||
|
|||
### introspection |
|||
|
|||
The function that returns a dict of the supported attributes (input and output) by your expansion module. |
|||
|
|||
~~~python |
|||
mispattributes = {'input': ['link', 'url'], |
|||
'output': ['attachment', 'malware-sample']} |
|||
|
|||
def introspection(): |
|||
return mispattributes |
|||
~~~ |
|||
|
|||
### version |
|||
|
|||
The function that returns a dict with the version and the associated meta-data including potential configurations required of the module. |
|||
|
|||
|
|||
### Additional Configuration Values |
|||
|
|||
If your module requires additional configuration (to be exposed via the MISP user-interface), you can define those in the moduleconfig value returned by the version function. |
|||
|
|||
~~~python |
|||
# config fields that your code expects from the site admin |
|||
moduleconfig = ["apikey", "event_limit"] |
|||
|
|||
def version(): |
|||
moduleinfo['config'] = moduleconfig |
|||
return moduleinfo |
|||
~~~ |
|||
|
|||
|
|||
When you do this a config array is added to the meta-data output containing all the potential configuration values: |
|||
|
|||
~~~ |
|||
"meta": { |
|||
"description": "PassiveTotal expansion service to expand values with multiple Passive DNS sources", |
|||
"config": [ |
|||
"username", |
|||
"password" |
|||
], |
|||
"module-type": [ |
|||
"expansion", |
|||
"hover" |
|||
], |
|||
|
|||
... |
|||
~~~ |
|||
|
|||
|
|||
If you want to use the configuration values set in the web interface they are stored in the key `config` in the JSON object passed to the handler. |
|||
|
|||
~~~ |
|||
def handler(q=False): |
|||
|
|||
# Check if we were given a configuration |
|||
config = q.get("config", {}) |
|||
|
|||
# Find out if there is a username field |
|||
username = config.get("username", None) |
|||
~~~ |
|||
|
|||
|
|||
### handler |
|||
|
|||
The function which accepts a JSON document to expand the values and return a dictionary of the expanded values. |
|||
|
|||
~~~python |
|||
def handler(q=False): |
|||
"Fully functional rot-13 encoder" |
|||
if q is False: |
|||
return False |
|||
request = json.loads(q) |
|||
src = request.get('ip-src') |
|||
if src is None: |
|||
# Return an error message |
|||
return {'error': "A source IP is required"} |
|||
else: |
|||
return {'results': |
|||
codecs.encode(src, "rot-13")} |
|||
~~~ |
|||
|
|||
#### export module |
|||
|
|||
For an export module, the `request["data"]` object corresponds to a list of events (dictionaries) to handle. |
|||
|
|||
Iterating over events attributes is performed using their `Attribute` key. |
|||
|
|||
~~~python |
|||
... |
|||
for event in request["data"]: |
|||
for attribute in event["Attribute"]: |
|||
# do stuff w/ attribute['type'], attribute['value'], ... |
|||
... |
|||
|
|||
### Returning Binary Data |
|||
|
|||
If you want to return a file or other data you need to add a data attribute. |
|||
|
|||
~~~python |
|||
{"results": {"values": "filename.txt", |
|||
"types": "attachment", |
|||
"data" : base64.b64encode(<ByteIO>) # base64 encode your data first |
|||
"comment": "This is an attachment"}} |
|||
~~~ |
|||
|
|||
If the binary file is malware you can use 'malware-sample' as the type. If you do this the malware sample will be automatically zipped and password protected ('infected') after being uploaded. |
|||
|
|||
|
|||
~~~python |
|||
{"results": {"values": "filename.txt", |
|||
"types": "malware-sample", |
|||
"data" : base64.b64encode(<ByteIO>) # base64 encode your data first |
|||
"comment": "This is an attachment"}} |
|||
~~~ |
|||
|
|||
[To learn more about how data attributes are processed you can read the processing code here.](https://github.com/MISP/PyMISP/blob/4f230c9299ad9d2d1c851148c629b61a94f3f117/pymisp/mispevent.py#L185-L200) |
|||
|
|||
|
|||
### Module type |
|||
|
|||
A MISP module can be of four types: |
|||
|
|||
- **expansion** - service related to an attribute that can be used to extend and update an existing event. |
|||
- **hover** - service related to an attribute to provide additional information to the users without updating the event. |
|||
- **import** - service related to importing and parsing an external object that can be used to extend an existing event. |
|||
- **export** - service related to exporting an object, event, or data. |
|||
|
|||
module-type is an array where the list of supported types can be added. |
|||
|
|||
## Testing your modules? |
|||
|
|||
MISP uses the **modules** function to discover the available MISP modules and their supported MISP attributes: |
|||
|
|||
~~~ |
|||
% curl -s http://127.0.0.1:6666/modules | jq . |
|||
[ |
|||
{ |
|||
"name": "passivetotal", |
|||
"type": "expansion", |
|||
"mispattributes": { |
|||
"input": [ |
|||
"hostname", |
|||
"domain", |
|||
"ip-src", |
|||
"ip-dst" |
|||
], |
|||
"output": [ |
|||
"ip-src", |
|||
"ip-dst", |
|||
"hostname", |
|||
"domain" |
|||
] |
|||
}, |
|||
"meta": { |
|||
"description": "PassiveTotal expansion service to expand values with multiple Passive DNS sources", |
|||
"config": [ |
|||
"username", |
|||
"password" |
|||
], |
|||
"author": "Alexandre Dulaunoy", |
|||
"version": "0.1" |
|||
} |
|||
}, |
|||
{ |
|||
"name": "sourcecache", |
|||
"type": "expansion", |
|||
"mispattributes": { |
|||
"input": [ |
|||
"link" |
|||
], |
|||
"output": [ |
|||
"link" |
|||
] |
|||
}, |
|||
"meta": { |
|||
"description": "Module to cache web pages of analysis reports, OSINT sources. The module returns a link of the cached page.", |
|||
"author": "Alexandre Dulaunoy", |
|||
"version": "0.1" |
|||
} |
|||
}, |
|||
{ |
|||
"name": "dns", |
|||
"type": "expansion", |
|||
"mispattributes": { |
|||
"input": [ |
|||
"hostname", |
|||
"domain" |
|||
], |
|||
"output": [ |
|||
"ip-src", |
|||
"ip-dst" |
|||
] |
|||
}, |
|||
"meta": { |
|||
"description": "Simple DNS expansion service to resolve IP address from MISP attributes", |
|||
"author": "Alexandre Dulaunoy", |
|||
"version": "0.1" |
|||
} |
|||
} |
|||
] |
|||
|
|||
~~~ |
|||
|
|||
The MISP module service returns the available modules in a JSON array containing each module name along with their supported input attributes. |
|||
|
|||
Based on this information, a query can be built in a JSON format and saved as body.json: |
|||
|
|||
~~~json |
|||
{ |
|||
"hostname": "www.foo.be", |
|||
"module": "dns" |
|||
} |
|||
~~~ |
|||
|
|||
Then you can POST this JSON format query towards the MISP object server: |
|||
|
|||
~~~bash |
|||
curl -s http://127.0.0.1:6666/query -H "Content-Type: application/json" --data @body.json -X POST |
|||
~~~ |
|||
|
|||
The module should output the following JSON: |
|||
|
|||
~~~json |
|||
{ |
|||
"results": [ |
|||
{ |
|||
"types": [ |
|||
"ip-src", |
|||
"ip-dst" |
|||
], |
|||
"values": [ |
|||
"188.65.217.78" |
|||
] |
|||
} |
|||
] |
|||
} |
|||
~~~ |
|||
|
|||
It is also possible to restrict the category options of the resolved attributes by passing a list of categories along (optional): |
|||
|
|||
~~~json |
|||
{ |
|||
"results": [ |
|||
{ |
|||
"types": [ |
|||
"ip-src", |
|||
"ip-dst" |
|||
], |
|||
"values": [ |
|||
"188.65.217.78" |
|||
], |
|||
"categories": [ |
|||
"Network activity", |
|||
"Payload delivery" |
|||
] |
|||
} |
|||
] |
|||
} |
|||
~~~ |
|||
|
|||
For both the type and the category lists, the first item in the list will be the default setting on the interface. |
|||
|
|||
### Enable your module in the web interface |
|||
|
|||
For a module to be activated in the MISP web interface it must be enabled in the "Plugin Settings. |
|||
|
|||
Go to "Administration > Server Settings" in the top menu |
|||
- Go to "Plugin Settings" in the top "tab menu bar" |
|||
- Click on the name of the type of module you have created to expand the list of plugins to show your module. |
|||
- Find the name of your plugin's "enabled" value in the Setting Column. |
|||
"Plugin.[MODULE NAME]_enabled" |
|||
- Double click on its "Value" column |
|||
|
|||
~~~ |
|||
Priority Setting Value Description Error Message |
|||
Recommended Plugin.Import_ocr_enabled false Enable or disable the ocr module. Value not set. |
|||
~~~ |
|||
|
|||
- Use the drop-down to set the enabled value to 'true' |
|||
|
|||
~~~ |
|||
Priority Setting Value Description Error Message |
|||
Recommended Plugin.Import_ocr_enabled true Enable or disable the ocr module. Value not set. |
|||
~~~ |
|||
|
|||
### Set any other required settings for your module |
|||
|
|||
In this same menu set any other plugin settings that are required for testing. |
|||
|
|||
|
|||
|
|||
## Documentation |
|||
|
|||
In order to provide documentation about some modules that require specific input / output / configuration, the [doc](https://github.com/MISP/misp-modules/tree/master/doc) directory contains detailed information about the general purpose, requirements, features, input and output of each of these modules: |
|||
|
|||
- ***description** - quick description of the general purpose of the module, as the one given by the moduleinfo |
|||
- **requirements** - special libraries needed to make the module work |
|||
- **features** - description of the way to use the module, with the required MISP features to make the module give the intended result |
|||
- **references** - link(s) giving additional information about the format concerned in the module |
|||
- **input** - description of the format of data used in input |
|||
- **output** - description of the format given as the result of the module execution |
|||
|
|||
|
|||
|
|||
|
|||
|
|||
## Tips for developers creating modules |
|||
|
|||
Download a pre-built virtual image from the [MISP training materials](https://www.circl.lu/services/misp-training-materials/). |
|||
|
|||
- Create a Host-Only adapter in VirtualBox |
|||
- Set your Misp OVA to that Host-Only adapter |
|||
- Start the virtual machine |
|||
- Get the IP address of the virutal machine |
|||
- SSH into the machine (Login info on training page) |
|||
- Go into the misp-modules directory |
|||
|
|||
~~~bash |
|||
cd /usr/local/src/misp-modules |
|||
~~~ |
|||
|
|||
Set the git repo to your fork and checkout your development branch. If you SSH'ed in as the misp user you will have to use sudo. |
|||
|
|||
~~~bash |
|||
sudo git remote set-url origin https://github.com/YourRepo/misp-modules.git |
|||
sudo git pull |
|||
sudo git checkout MyModBranch |
|||
~~~ |
|||
|
|||
Remove the contents of the build directory and re-install misp-modules. |
|||
|
|||
~~~python |
|||
sudo rm -fr build/* |
|||
sudo pip3 install --upgrade . |
|||
~~~ |
|||
|
|||
SSH in with a different terminal and run `misp-modules` with debugging enabled. |
|||
|
|||
~~~python |
|||
sudo killall misp-modules |
|||
misp-modules -d |
|||
~~~ |
|||
|
|||
|
|||
In your original terminal you can now run your tests manually and see any errors that arrive |
|||
|
|||
~~~bash |
|||
cd tests/ |
|||
curl -s http://127.0.0.1:6666/query -H "Content-Type: application/json" --data @MY_TEST_FILE.json -X POST |
|||
cd ../ |
|||
~~~ |
|||
|
After Width: | Height: | Size: 1.1 KiB |
|
After Width: | Height: | Size: 10 KiB |
@ -0,0 +1,97 @@ |
|||
# Home |
|||
|
|||
[](https://travis-ci.org/MISP/misp-modules) |
|||
[](https://coveralls.io/github/MISP/misp-modules?branch=master) |
|||
[](https://codecov.io/gh/MISP/misp-modules) |
|||
[](https://app.fossa.io/projects/git%2Bgithub.com%2F8ear%2Fmisp-modules?ref=badge_shield) |
|||
|
|||
MISP modules are autonomous modules that can be used for expansion and other services in [MISP](https://github.com/MISP/MISP). |
|||
|
|||
The modules are written in Python 3 following a simple API interface. The objective is to ease the extensions of MISP functionalities |
|||
without modifying core components. The API is available via a simple REST API which is independent from MISP installation or configuration. |
|||
|
|||
MISP modules support is included in MISP starting from version `2.4.28`. |
|||
|
|||
For more information: [Extending MISP with Python modules](https://www.circl.lu/assets/files/misp-training/switch2016/2-misp-modules.pdf) slides from MISP training. |
|||
|
|||
|
|||
## Existing MISP modules |
|||
|
|||
### Expansion modules |
|||
|
|||
* [BGP Ranking](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/bgpranking.py) - a hover and expansion module to expand an AS number with the ASN description, its history, and position in BGP Ranking. |
|||
* [BTC transactions](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/btc_steroids.py) - An expansion hover module to get a blockchain balance and the transactions from a BTC address in MISP. |
|||
* [CIRCL Passive DNS](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/circl_passivedns.py) - a hover and expansion module to expand hostname and IP addresses with passive DNS information. |
|||
* [CIRCL Passive SSL](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/circl_passivessl.py) - a hover and expansion module to expand IP addresses with the X.509 certificate seen. |
|||
* [countrycode](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/countrycode.py) - a hover module to tell you what country a URL belongs to. |
|||
* [CrowdStrike Falcon](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/crowdstrike_falcon.py) - an expansion module to expand using CrowdStrike Falcon Intel Indicator API. |
|||
* [CVE](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/cve.py) - a hover module to give more information about a vulnerability (CVE). |
|||
* [DBL Spamhaus](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/dbl_spamhaus.py) - a hover module to check Spamhaus DBL for a domain name. |
|||
* [DNS](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/dns.py) - a simple module to resolve MISP attributes like hostname and domain to expand IP addresses attributes. |
|||
* [DomainTools](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/domaintools.py) - a hover and expansion module to get information from [DomainTools](http://www.domaintools.com/) whois. |
|||
* [EUPI](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/eupi.py) - a hover and expansion module to get information about an URL from the [Phishing Initiative project](https://phishing-initiative.eu/?lang=en). |
|||
* [Farsight DNSDB Passive DNS](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/farsight_passivedns.py) - a hover and expansion module to expand hostname and IP addresses with passive DNS information. |
|||
* [GeoIP](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/geoip_country.py) - a hover and expansion module to get GeoIP information from geolite/maxmind. |
|||
* [hashdd](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/hashdd.py) - a hover module to check file hashes against [hashdd.com](http://www.hashdd.com) including NSLR dataset. |
|||
* [intel471](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/intel471.py) - an expansion module to get info from [Intel471](https://intel471.com). |
|||
* [IPASN](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/ipasn.py) - a hover and expansion to get the BGP ASN of an IP address. |
|||
* [iprep](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/iprep.py) - an expansion module to get IP reputation from packetmail.net. |
|||
* [macaddress.io](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/macaddress_io.py) - a hover module to retrieve vendor details and other information regarding a given MAC address or an OUI from [MAC address Vendor Lookup](https:/macaddress.io). See [integration tutorial here](https:/macaddress.io/integrations/MISP-module). |
|||
* [onyphe](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/onyphe.py) - a modules to process queries on Onyphe. |
|||
* [onyphe_full](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/onyphe_full.py) - a modules to process full queries on Onyphe. |
|||
* [OTX](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/otx.py) - an expansion module for [OTX](https://otx.alienvault.com/). |
|||
* [passivetotal](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/passivetotal.py) - a [passivetotal](https://www.passivetotal.org/) module that queries a number of different PassiveTotal datasets. |
|||
* [rbl](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/rbl.py) - a module to get RBL (Real-Time Blackhost List) values from an attribute. |
|||
* [reversedns](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/reversedns.py) - Simple Reverse DNS expansion service to resolve reverse DNS from MISP attributes. |
|||
* [securitytrails](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/securitytrails.py) - an expansion module for [securitytrails](https://securitytrails.com/). |
|||
* [shodan](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/shodan.py) - a minimal [shodan](https://www.shodan.io/) expansion module. |
|||
* [Sigma queries](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/sigma_queries.py) - Experimental expansion module querying a sigma rule to convert it into all the available SIEM signatures. |
|||
* [Sigma syntax validator](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/sigma_syntax_validator.py) - Sigma syntax validator. |
|||
* [sourcecache](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/sourcecache.py) - a module to cache a specific link from a MISP instance. |
|||
* [STIX2 pattern syntax validator](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/stix2_pattern_syntax_validator.py) - a module to check a STIX2 pattern syntax. |
|||
* [ThreatCrowd](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/threatcrowd.py) - an expansion module for [ThreatCrowd](https://www.threatcrowd.org/). |
|||
* [threatminer](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/threatminer.py) - an expansion module to expand from [ThreatMiner](https://www.threatminer.org/). |
|||
* [urlscan](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/urlscan.py) - an expansion module to query [urlscan.io](https://urlscan.io). |
|||
* [virustotal](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/virustotal.py) - an expansion module to pull known resolutions and malware samples related with an IP/Domain from virusTotal (this modules require a VirusTotal private API key) |
|||
* [VMray](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/vmray_submit.py) - a module to submit a sample to VMray. |
|||
* [VulnDB](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/vulndb.py) - a module to query [VulnDB](https://www.riskbasedsecurity.com/). |
|||
* [Vulners](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/vulners.py) - an expansion module to expand information about CVEs using Vulners API. |
|||
* [whois](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion) - a module to query a local instance of [uwhois](https://github.com/rafiot/uwhoisd). |
|||
* [wikidata](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/wiki.py) - a [wikidata](https://www.wikidata.org) expansion module. |
|||
* [xforce](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/xforceexchange.py) - an IBM X-Force Exchange expansion module. |
|||
* [YARA query](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/yara_query.py) - a module to create YARA rules from single hash attributes. |
|||
* [YARA syntax validator](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/yara_syntax_validator.py) - YARA syntax validator. |
|||
|
|||
### Export modules |
|||
|
|||
* [CEF](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/export_mod/cef_export.py) module to export Common Event Format (CEF). |
|||
* [GoAML export](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/export_mod/goamlexport.py) module to export in [GoAML format](http://goaml.unodc.org/goaml/en/index.html). |
|||
* [Lite Export](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/export_mod/liteexport.py) module to export a lite event. |
|||
* [Simple PDF export](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/export_mod/pdfexport.py) module to export in PDF (required: asciidoctor-pdf). |
|||
* [Nexthink query format](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/export_mod/nexthinkexport.py) module to export in Nexthink query format. |
|||
* [osquery](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/export_mod/osqueryexport.py) module to export in [osquery](https://osquery.io/) query format. |
|||
* [ThreatConnect](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/export_mod/threat_connect_export.py) module to export in ThreatConnect CSV format. |
|||
* [ThreatStream](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/export_mod/threatStream_misp_export.py) module to export in ThreatStream format. |
|||
|
|||
### Import modules |
|||
|
|||
* [CSV import](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/import_mod/csvimport.py) Customizable CSV import module. |
|||
* [Cuckoo JSON](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/import_mod/cuckooimport.py) Cuckoo JSON import. |
|||
* [Email Import](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/import_mod/email_import.py) Email import module for MISP to import basic metadata. |
|||
* [GoAML import](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/import_mod/) Module to import [GoAML](http://goaml.unodc.org/goaml/en/index.html) XML format. |
|||
* [OCR](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/import_mod/ocr.py) Optical Character Recognition (OCR) module for MISP to import attributes from images, scan or faxes. |
|||
* [OpenIOC](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/import_mod/openiocimport.py) OpenIOC import based on PyMISP library. |
|||
* [ThreatAnalyzer](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/import_mod/threatanalyzer_import.py) - An import module to process ThreatAnalyzer archive.zip/analysis.json sandbox exports. |
|||
* [VMRay](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/import_mod/vmray_import.py) - An import module to process VMRay export. |
|||
|
|||
|
|||
## How to contribute your own module? |
|||
|
|||
Fork the project, add your module, test it and make a pull-request. Modules can be also private as you can add a module in your own MISP installation. |
|||
For further information please see [Contribute](contribute/). |
|||
|
|||
|
|||
## Licenses |
|||
[](https://app.fossa.io/projects/git%2Bgithub.com%2Fmisp%2Fmisp-modules?ref=badge_large) |
|||
|
|||
For further Information see also the [license file](license/). |
|||
@ -0,0 +1,92 @@ |
|||
## How to install and start MISP modules in a Python virtualenv? |
|||
|
|||
~~~~bash |
|||
sudo apt-get install python3-dev python3-pip libpq5 libjpeg-dev tesseract-ocr imagemagick |
|||
sudo -u www-data virtualenv -p python3 /var/www/MISP/venv |
|||
cd /usr/local/src/ |
|||
sudo git clone https://github.com/MISP/misp-modules.git |
|||
cd misp-modules |
|||
sudo -u www-data /var/www/MISP/venv/bin/pip install -I -r REQUIREMENTS |
|||
sudo -u www-data /var/www/MISP/venv/bin/pip install . |
|||
sudo apt install ruby-pygments.rb -y |
|||
sudo gem install asciidoctor-pdf --pre |
|||
sudo sed -i -e '$i \sudo -u www-data /var/www/MISP/venv/bin/misp-modules -l 127.0.0.1 -s > /tmp/misp-modules_rc.local.log &\n' /etc/rc.local |
|||
/var/www/MISP/venv/bin/misp-modules -l 127.0.0.1 -s & #to start the modules |
|||
~~~~ |
|||
|
|||
## How to install and start MISP modules? |
|||
|
|||
~~~~bash |
|||
sudo apt-get install python3-dev python3-pip libpq5 libjpeg-dev tesseract-ocr imagemagick |
|||
cd /usr/local/src/ |
|||
sudo git clone https://github.com/MISP/misp-modules.git |
|||
cd misp-modules |
|||
sudo pip3 install -I -r REQUIREMENTS |
|||
sudo pip3 install -I . |
|||
sudo apt install ruby-pygments.rb -y |
|||
sudo gem install asciidoctor-pdf --pre |
|||
sudo sed -i -e '$i \sudo -u www-data /var/www/MISP/venv/bin/misp-modules -l 127.0.0.1 -s > /tmp/misp-modules_rc.local.log &\n' /etc/rc.local |
|||
/var/www/MISP/venv/bin/misp-modules -l 127.0.0.1 -s & #to start the modules |
|||
~~~~ |
|||
|
|||
## How to use an MISP modules Docker container |
|||
|
|||
### Docker run |
|||
|
|||
~~~~bash |
|||
# Start Redis |
|||
docker run --rm -d --container_name misp-redis redis:alpine |
|||
docker run \ |
|||
--rm -d --container_name misp-modules \ |
|||
-e REDIS_BACKEND=misp-redis \ |
|||
-e REDIS_PORT="6379" \ |
|||
-e REDIS_PW="" \ |
|||
-e REDIS_DATABASE="245" \ |
|||
-e MISP_MODULES_DEBUG: "false" \ |
|||
dcso/misp-dockerized-redis |
|||
~~~~ |
|||
|
|||
### Docker-compose |
|||
|
|||
~~~~yml |
|||
services: |
|||
misp-modules: |
|||
# https://hub.docker.com/r/dcso/misp-dockerized-misp-modules |
|||
image: dcso/misp-dockerized-misp-modules:3 |
|||
environment: |
|||
# Redis |
|||
REDIS_BACKEND: misp-redis |
|||
REDIS_PORT: "6379" |
|||
REDIS_DATABASE: "245" |
|||
# System PROXY (OPTIONAL) |
|||
http_proxy: |
|||
https_proxy: |
|||
no_proxy: 0.0.0.0 |
|||
# Timezone (OPTIONAL) |
|||
TZ: Europe/Berlin |
|||
# MISP-Modules (OPTIONAL) |
|||
MISP_MODULES_DEBUG: "false" |
|||
# Logging options (OPTIONAL) |
|||
LOG_SYSLOG_ENABLED: "no" |
|||
misp-redis: |
|||
# https://hub.docker.com/_/redis or alternative https://hub.docker.com/r/dcso/misp-dockerized-redis/ |
|||
image: redis:alpine |
|||
~~~~ |
|||
|
|||
## Install misp-module on an offline instance. |
|||
First, you need to grab all necessary packages for example like this : |
|||
|
|||
Use pip wheel to create an archive |
|||
~~~ |
|||
mkdir misp-modules-offline |
|||
pip3 wheel -r REQUIREMENTS shodan --wheel-dir=./misp-modules-offline |
|||
tar -cjvf misp-module-bundeled.tar.bz2 ./misp-modules-offline/* |
|||
~~~ |
|||
On offline machine : |
|||
~~~ |
|||
mkdir misp-modules-bundle |
|||
tar xvf misp-module-bundeled.tar.bz2 -C misp-modules-bundle |
|||
cd misp-modules-bundle |
|||
ls -1|while read line; do sudo pip3 install --force-reinstall --ignore-installed --upgrade --no-index --no-deps ${line};done |
|||
~~~ |
|||
Next you can follow standard install procedure. |
|||
@ -0,0 +1,661 @@ |
|||
GNU AFFERO GENERAL PUBLIC LICENSE |
|||
Version 3, 19 November 2007 |
|||
|
|||
Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/> |
|||
Everyone is permitted to copy and distribute verbatim copies |
|||
of this license document, but changing it is not allowed. |
|||
|
|||
Preamble |
|||
|
|||
The GNU Affero General Public License is a free, copyleft license for |
|||
software and other kinds of works, specifically designed to ensure |
|||
cooperation with the community in the case of network server software. |
|||
|
|||
The licenses for most software and other practical works are designed |
|||
to take away your freedom to share and change the works. By contrast, |
|||
our General Public Licenses are intended to guarantee your freedom to |
|||
share and change all versions of a program--to make sure it remains free |
|||
software for all its users. |
|||
|
|||
When we speak of free software, we are referring to freedom, not |
|||
price. Our General Public Licenses are designed to make sure that you |
|||
have the freedom to distribute copies of free software (and charge for |
|||
them if you wish), that you receive source code or can get it if you |
|||
want it, that you can change the software or use pieces of it in new |
|||
free programs, and that you know you can do these things. |
|||
|
|||
Developers that use our General Public Licenses protect your rights |
|||
with two steps: (1) assert copyright on the software, and (2) offer |
|||
you this License which gives you legal permission to copy, distribute |
|||
and/or modify the software. |
|||
|
|||
A secondary benefit of defending all users' freedom is that |
|||
improvements made in alternate versions of the program, if they |
|||
receive widespread use, become available for other developers to |
|||
incorporate. Many developers of free software are heartened and |
|||
encouraged by the resulting cooperation. However, in the case of |
|||
software used on network servers, this result may fail to come about. |
|||
The GNU General Public License permits making a modified version and |
|||
letting the public access it on a server without ever releasing its |
|||
source code to the public. |
|||
|
|||
The GNU Affero General Public License is designed specifically to |
|||
ensure that, in such cases, the modified source code becomes available |
|||
to the community. It requires the operator of a network server to |
|||
provide the source code of the modified version running there to the |
|||
users of that server. Therefore, public use of a modified version, on |
|||
a publicly accessible server, gives the public access to the source |
|||
code of the modified version. |
|||
|
|||
An older license, called the Affero General Public License and |
|||
published by Affero, was designed to accomplish similar goals. This is |
|||
a different license, not a version of the Affero GPL, but Affero has |
|||
released a new version of the Affero GPL which permits relicensing under |
|||
this license. |
|||
|
|||
The precise terms and conditions for copying, distribution and |
|||
modification follow. |
|||
|
|||
TERMS AND CONDITIONS |
|||
|
|||
0. Definitions. |
|||
|
|||
"This License" refers to version 3 of the GNU Affero General Public License. |
|||
|
|||
"Copyright" also means copyright-like laws that apply to other kinds of |
|||
works, such as semiconductor masks. |
|||
|
|||
"The Program" refers to any copyrightable work licensed under this |
|||
License. Each licensee is addressed as "you". "Licensees" and |
|||
"recipients" may be individuals or organizations. |
|||
|
|||
To "modify" a work means to copy from or adapt all or part of the work |
|||
in a fashion requiring copyright permission, other than the making of an |
|||
exact copy. The resulting work is called a "modified version" of the |
|||
earlier work or a work "based on" the earlier work. |
|||
|
|||
A "covered work" means either the unmodified Program or a work based |
|||
on the Program. |
|||
|
|||
To "propagate" a work means to do anything with it that, without |
|||
permission, would make you directly or secondarily liable for |
|||
infringement under applicable copyright law, except executing it on a |
|||
computer or modifying a private copy. Propagation includes copying, |
|||
distribution (with or without modification), making available to the |
|||
public, and in some countries other activities as well. |
|||
|
|||
To "convey" a work means any kind of propagation that enables other |
|||
parties to make or receive copies. Mere interaction with a user through |
|||
a computer network, with no transfer of a copy, is not conveying. |
|||
|
|||
An interactive user interface displays "Appropriate Legal Notices" |
|||
to the extent that it includes a convenient and prominently visible |
|||
feature that (1) displays an appropriate copyright notice, and (2) |
|||
tells the user that there is no warranty for the work (except to the |
|||
extent that warranties are provided), that licensees may convey the |
|||
work under this License, and how to view a copy of this License. If |
|||
the interface presents a list of user commands or options, such as a |
|||
menu, a prominent item in the list meets this criterion. |
|||
|
|||
1. Source Code. |
|||
|
|||
The "source code" for a work means the preferred form of the work |
|||
for making modifications to it. "Object code" means any non-source |
|||
form of a work. |
|||
|
|||
A "Standard Interface" means an interface that either is an official |
|||
standard defined by a recognized standards body, or, in the case of |
|||
interfaces specified for a particular programming language, one that |
|||
is widely used among developers working in that language. |
|||
|
|||
The "System Libraries" of an executable work include anything, other |
|||
than the work as a whole, that (a) is included in the normal form of |
|||
packaging a Major Component, but which is not part of that Major |
|||
Component, and (b) serves only to enable use of the work with that |
|||
Major Component, or to implement a Standard Interface for which an |
|||
implementation is available to the public in source code form. A |
|||
"Major Component", in this context, means a major essential component |
|||
(kernel, window system, and so on) of the specific operating system |
|||
(if any) on which the executable work runs, or a compiler used to |
|||
produce the work, or an object code interpreter used to run it. |
|||
|
|||
The "Corresponding Source" for a work in object code form means all |
|||
the source code needed to generate, install, and (for an executable |
|||
work) run the object code and to modify the work, including scripts to |
|||
control those activities. However, it does not include the work's |
|||
System Libraries, or general-purpose tools or generally available free |
|||
programs which are used unmodified in performing those activities but |
|||
which are not part of the work. For example, Corresponding Source |
|||
includes interface definition files associated with source files for |
|||
the work, and the source code for shared libraries and dynamically |
|||
linked subprograms that the work is specifically designed to require, |
|||
such as by intimate data communication or control flow between those |
|||
subprograms and other parts of the work. |
|||
|
|||
The Corresponding Source need not include anything that users |
|||
can regenerate automatically from other parts of the Corresponding |
|||
Source. |
|||
|
|||
The Corresponding Source for a work in source code form is that |
|||
same work. |
|||
|
|||
2. Basic Permissions. |
|||
|
|||
All rights granted under this License are granted for the term of |
|||
copyright on the Program, and are irrevocable provided the stated |
|||
conditions are met. This License explicitly affirms your unlimited |
|||
permission to run the unmodified Program. The output from running a |
|||
covered work is covered by this License only if the output, given its |
|||
content, constitutes a covered work. This License acknowledges your |
|||
rights of fair use or other equivalent, as provided by copyright law. |
|||
|
|||
You may make, run and propagate covered works that you do not |
|||
convey, without conditions so long as your license otherwise remains |
|||
in force. You may convey covered works to others for the sole purpose |
|||
of having them make modifications exclusively for you, or provide you |
|||
with facilities for running those works, provided that you comply with |
|||
the terms of this License in conveying all material for which you do |
|||
not control copyright. Those thus making or running the covered works |
|||
for you must do so exclusively on your behalf, under your direction |
|||
and control, on terms that prohibit them from making any copies of |
|||
your copyrighted material outside their relationship with you. |
|||
|
|||
Conveying under any other circumstances is permitted solely under |
|||
the conditions stated below. Sublicensing is not allowed; section 10 |
|||
makes it unnecessary. |
|||
|
|||
3. Protecting Users' Legal Rights From Anti-Circumvention Law. |
|||
|
|||
No covered work shall be deemed part of an effective technological |
|||
measure under any applicable law fulfilling obligations under article |
|||
11 of the WIPO copyright treaty adopted on 20 December 1996, or |
|||
similar laws prohibiting or restricting circumvention of such |
|||
measures. |
|||
|
|||
When you convey a covered work, you waive any legal power to forbid |
|||
circumvention of technological measures to the extent such circumvention |
|||
is effected by exercising rights under this License with respect to |
|||
the covered work, and you disclaim any intention to limit operation or |
|||
modification of the work as a means of enforcing, against the work's |
|||
users, your or third parties' legal rights to forbid circumvention of |
|||
technological measures. |
|||
|
|||
4. Conveying Verbatim Copies. |
|||
|
|||
You may convey verbatim copies of the Program's source code as you |
|||
receive it, in any medium, provided that you conspicuously and |
|||
appropriately publish on each copy an appropriate copyright notice; |
|||
keep intact all notices stating that this License and any |
|||
non-permissive terms added in accord with section 7 apply to the code; |
|||
keep intact all notices of the absence of any warranty; and give all |
|||
recipients a copy of this License along with the Program. |
|||
|
|||
You may charge any price or no price for each copy that you convey, |
|||
and you may offer support or warranty protection for a fee. |
|||
|
|||
5. Conveying Modified Source Versions. |
|||
|
|||
You may convey a work based on the Program, or the modifications to |
|||
produce it from the Program, in the form of source code under the |
|||
terms of section 4, provided that you also meet all of these conditions: |
|||
|
|||
a) The work must carry prominent notices stating that you modified |
|||
it, and giving a relevant date. |
|||
|
|||
b) The work must carry prominent notices stating that it is |
|||
released under this License and any conditions added under section |
|||
7. This requirement modifies the requirement in section 4 to |
|||
"keep intact all notices". |
|||
|
|||
c) You must license the entire work, as a whole, under this |
|||
License to anyone who comes into possession of a copy. This |
|||
License will therefore apply, along with any applicable section 7 |
|||
additional terms, to the whole of the work, and all its parts, |
|||
regardless of how they are packaged. This License gives no |
|||
permission to license the work in any other way, but it does not |
|||
invalidate such permission if you have separately received it. |
|||
|
|||
d) If the work has interactive user interfaces, each must display |
|||
Appropriate Legal Notices; however, if the Program has interactive |
|||
interfaces that do not display Appropriate Legal Notices, your |
|||
work need not make them do so. |
|||
|
|||
A compilation of a covered work with other separate and independent |
|||
works, which are not by their nature extensions of the covered work, |
|||
and which are not combined with it such as to form a larger program, |
|||
in or on a volume of a storage or distribution medium, is called an |
|||
"aggregate" if the compilation and its resulting copyright are not |
|||
used to limit the access or legal rights of the compilation's users |
|||
beyond what the individual works permit. Inclusion of a covered work |
|||
in an aggregate does not cause this License to apply to the other |
|||
parts of the aggregate. |
|||
|
|||
6. Conveying Non-Source Forms. |
|||
|
|||
You may convey a covered work in object code form under the terms |
|||
of sections 4 and 5, provided that you also convey the |
|||
machine-readable Corresponding Source under the terms of this License, |
|||
in one of these ways: |
|||
|
|||
a) Convey the object code in, or embodied in, a physical product |
|||
(including a physical distribution medium), accompanied by the |
|||
Corresponding Source fixed on a durable physical medium |
|||
customarily used for software interchange. |
|||
|
|||
b) Convey the object code in, or embodied in, a physical product |
|||
(including a physical distribution medium), accompanied by a |
|||
written offer, valid for at least three years and valid for as |
|||
long as you offer spare parts or customer support for that product |
|||
model, to give anyone who possesses the object code either (1) a |
|||
copy of the Corresponding Source for all the software in the |
|||
product that is covered by this License, on a durable physical |
|||
medium customarily used for software interchange, for a price no |
|||
more than your reasonable cost of physically performing this |
|||
conveying of source, or (2) access to copy the |
|||
Corresponding Source from a network server at no charge. |
|||
|
|||
c) Convey individual copies of the object code with a copy of the |
|||
written offer to provide the Corresponding Source. This |
|||
alternative is allowed only occasionally and noncommercially, and |
|||
only if you received the object code with such an offer, in accord |
|||
with subsection 6b. |
|||
|
|||
d) Convey the object code by offering access from a designated |
|||
place (gratis or for a charge), and offer equivalent access to the |
|||
Corresponding Source in the same way through the same place at no |
|||
further charge. You need not require recipients to copy the |
|||
Corresponding Source along with the object code. If the place to |
|||
copy the object code is a network server, the Corresponding Source |
|||
may be on a different server (operated by you or a third party) |
|||
that supports equivalent copying facilities, provided you maintain |
|||
clear directions next to the object code saying where to find the |
|||
Corresponding Source. Regardless of what server hosts the |
|||
Corresponding Source, you remain obligated to ensure that it is |
|||
available for as long as needed to satisfy these requirements. |
|||
|
|||
e) Convey the object code using peer-to-peer transmission, provided |
|||
you inform other peers where the object code and Corresponding |
|||
Source of the work are being offered to the general public at no |
|||
charge under subsection 6d. |
|||
|
|||
A separable portion of the object code, whose source code is excluded |
|||
from the Corresponding Source as a System Library, need not be |
|||
included in conveying the object code work. |
|||
|
|||
A "User Product" is either (1) a "consumer product", which means any |
|||
tangible personal property which is normally used for personal, family, |
|||
or household purposes, or (2) anything designed or sold for incorporation |
|||
into a dwelling. In determining whether a product is a consumer product, |
|||
doubtful cases shall be resolved in favor of coverage. For a particular |
|||
product received by a particular user, "normally used" refers to a |
|||
typical or common use of that class of product, regardless of the status |
|||
of the particular user or of the way in which the particular user |
|||
actually uses, or expects or is expected to use, the product. A product |
|||
is a consumer product regardless of whether the product has substantial |
|||
commercial, industrial or non-consumer uses, unless such uses represent |
|||
the only significant mode of use of the product. |
|||
|
|||
"Installation Information" for a User Product means any methods, |
|||
procedures, authorization keys, or other information required to install |
|||
and execute modified versions of a covered work in that User Product from |
|||
a modified version of its Corresponding Source. The information must |
|||
suffice to ensure that the continued functioning of the modified object |
|||
code is in no case prevented or interfered with solely because |
|||
modification has been made. |
|||
|
|||
If you convey an object code work under this section in, or with, or |
|||
specifically for use in, a User Product, and the conveying occurs as |
|||
part of a transaction in which the right of possession and use of the |
|||
User Product is transferred to the recipient in perpetuity or for a |
|||
fixed term (regardless of how the transaction is characterized), the |
|||
Corresponding Source conveyed under this section must be accompanied |
|||
by the Installation Information. But this requirement does not apply |
|||
if neither you nor any third party retains the ability to install |
|||
modified object code on the User Product (for example, the work has |
|||
been installed in ROM). |
|||
|
|||
The requirement to provide Installation Information does not include a |
|||
requirement to continue to provide support service, warranty, or updates |
|||
for a work that has been modified or installed by the recipient, or for |
|||
the User Product in which it has been modified or installed. Access to a |
|||
network may be denied when the modification itself materially and |
|||
adversely affects the operation of the network or violates the rules and |
|||
protocols for communication across the network. |
|||
|
|||
Corresponding Source conveyed, and Installation Information provided, |
|||
in accord with this section must be in a format that is publicly |
|||
documented (and with an implementation available to the public in |
|||
source code form), and must require no special password or key for |
|||
unpacking, reading or copying. |
|||
|
|||
7. Additional Terms. |
|||
|
|||
"Additional permissions" are terms that supplement the terms of this |
|||
License by making exceptions from one or more of its conditions. |
|||
Additional permissions that are applicable to the entire Program shall |
|||
be treated as though they were included in this License, to the extent |
|||
that they are valid under applicable law. If additional permissions |
|||
apply only to part of the Program, that part may be used separately |
|||
under those permissions, but the entire Program remains governed by |
|||
this License without regard to the additional permissions. |
|||
|
|||
When you convey a copy of a covered work, you may at your option |
|||
remove any additional permissions from that copy, or from any part of |
|||
it. (Additional permissions may be written to require their own |
|||
removal in certain cases when you modify the work.) You may place |
|||
additional permissions on material, added by you to a covered work, |
|||
for which you have or can give appropriate copyright permission. |
|||
|
|||
Notwithstanding any other provision of this License, for material you |
|||
add to a covered work, you may (if authorized by the copyright holders of |
|||
that material) supplement the terms of this License with terms: |
|||
|
|||
a) Disclaiming warranty or limiting liability differently from the |
|||
terms of sections 15 and 16 of this License; or |
|||
|
|||
b) Requiring preservation of specified reasonable legal notices or |
|||
author attributions in that material or in the Appropriate Legal |
|||
Notices displayed by works containing it; or |
|||
|
|||
c) Prohibiting misrepresentation of the origin of that material, or |
|||
requiring that modified versions of such material be marked in |
|||
reasonable ways as different from the original version; or |
|||
|
|||
d) Limiting the use for publicity purposes of names of licensors or |
|||
authors of the material; or |
|||
|
|||
e) Declining to grant rights under trademark law for use of some |
|||
trade names, trademarks, or service marks; or |
|||
|
|||
f) Requiring indemnification of licensors and authors of that |
|||
material by anyone who conveys the material (or modified versions of |
|||
it) with contractual assumptions of liability to the recipient, for |
|||
any liability that these contractual assumptions directly impose on |
|||
those licensors and authors. |
|||
|
|||
All other non-permissive additional terms are considered "further |
|||
restrictions" within the meaning of section 10. If the Program as you |
|||
received it, or any part of it, contains a notice stating that it is |
|||
governed by this License along with a term that is a further |
|||
restriction, you may remove that term. If a license document contains |
|||
a further restriction but permits relicensing or conveying under this |
|||
License, you may add to a covered work material governed by the terms |
|||
of that license document, provided that the further restriction does |
|||
not survive such relicensing or conveying. |
|||
|
|||
If you add terms to a covered work in accord with this section, you |
|||
must place, in the relevant source files, a statement of the |
|||
additional terms that apply to those files, or a notice indicating |
|||
where to find the applicable terms. |
|||
|
|||
Additional terms, permissive or non-permissive, may be stated in the |
|||
form of a separately written license, or stated as exceptions; |
|||
the above requirements apply either way. |
|||
|
|||
8. Termination. |
|||
|
|||
You may not propagate or modify a covered work except as expressly |
|||
provided under this License. Any attempt otherwise to propagate or |
|||
modify it is void, and will automatically terminate your rights under |
|||
this License (including any patent licenses granted under the third |
|||
paragraph of section 11). |
|||
|
|||
However, if you cease all violation of this License, then your |
|||
license from a particular copyright holder is reinstated (a) |
|||
provisionally, unless and until the copyright holder explicitly and |
|||
finally terminates your license, and (b) permanently, if the copyright |
|||
holder fails to notify you of the violation by some reasonable means |
|||
prior to 60 days after the cessation. |
|||
|
|||
Moreover, your license from a particular copyright holder is |
|||
reinstated permanently if the copyright holder notifies you of the |
|||
violation by some reasonable means, this is the first time you have |
|||
received notice of violation of this License (for any work) from that |
|||
copyright holder, and you cure the violation prior to 30 days after |
|||
your receipt of the notice. |
|||
|
|||
Termination of your rights under this section does not terminate the |
|||
licenses of parties who have received copies or rights from you under |
|||
this License. If your rights have been terminated and not permanently |
|||
reinstated, you do not qualify to receive new licenses for the same |
|||
material under section 10. |
|||
|
|||
9. Acceptance Not Required for Having Copies. |
|||
|
|||
You are not required to accept this License in order to receive or |
|||
run a copy of the Program. Ancillary propagation of a covered work |
|||
occurring solely as a consequence of using peer-to-peer transmission |
|||
to receive a copy likewise does not require acceptance. However, |
|||
nothing other than this License grants you permission to propagate or |
|||
modify any covered work. These actions infringe copyright if you do |
|||
not accept this License. Therefore, by modifying or propagating a |
|||
covered work, you indicate your acceptance of this License to do so. |
|||
|
|||
10. Automatic Licensing of Downstream Recipients. |
|||
|
|||
Each time you convey a covered work, the recipient automatically |
|||
receives a license from the original licensors, to run, modify and |
|||
propagate that work, subject to this License. You are not responsible |
|||
for enforcing compliance by third parties with this License. |
|||
|
|||
An "entity transaction" is a transaction transferring control of an |
|||
organization, or substantially all assets of one, or subdividing an |
|||
organization, or merging organizations. If propagation of a covered |
|||
work results from an entity transaction, each party to that |
|||
transaction who receives a copy of the work also receives whatever |
|||
licenses to the work the party's predecessor in interest had or could |
|||
give under the previous paragraph, plus a right to possession of the |
|||
Corresponding Source of the work from the predecessor in interest, if |
|||
the predecessor has it or can get it with reasonable efforts. |
|||
|
|||
You may not impose any further restrictions on the exercise of the |
|||
rights granted or affirmed under this License. For example, you may |
|||
not impose a license fee, royalty, or other charge for exercise of |
|||
rights granted under this License, and you may not initiate litigation |
|||
(including a cross-claim or counterclaim in a lawsuit) alleging that |
|||
any patent claim is infringed by making, using, selling, offering for |
|||
sale, or importing the Program or any portion of it. |
|||
|
|||
11. Patents. |
|||
|
|||
A "contributor" is a copyright holder who authorizes use under this |
|||
License of the Program or a work on which the Program is based. The |
|||
work thus licensed is called the contributor's "contributor version". |
|||
|
|||
A contributor's "essential patent claims" are all patent claims |
|||
owned or controlled by the contributor, whether already acquired or |
|||
hereafter acquired, that would be infringed by some manner, permitted |
|||
by this License, of making, using, or selling its contributor version, |
|||
but do not include claims that would be infringed only as a |
|||
consequence of further modification of the contributor version. For |
|||
purposes of this definition, "control" includes the right to grant |
|||
patent sublicenses in a manner consistent with the requirements of |
|||
this License. |
|||
|
|||
Each contributor grants you a non-exclusive, worldwide, royalty-free |
|||
patent license under the contributor's essential patent claims, to |
|||
make, use, sell, offer for sale, import and otherwise run, modify and |
|||
propagate the contents of its contributor version. |
|||
|
|||
In the following three paragraphs, a "patent license" is any express |
|||
agreement or commitment, however denominated, not to enforce a patent |
|||
(such as an express permission to practice a patent or covenant not to |
|||
sue for patent infringement). To "grant" such a patent license to a |
|||
party means to make such an agreement or commitment not to enforce a |
|||
patent against the party. |
|||
|
|||
If you convey a covered work, knowingly relying on a patent license, |
|||
and the Corresponding Source of the work is not available for anyone |
|||
to copy, free of charge and under the terms of this License, through a |
|||
publicly available network server or other readily accessible means, |
|||
then you must either (1) cause the Corresponding Source to be so |
|||
available, or (2) arrange to deprive yourself of the benefit of the |
|||
patent license for this particular work, or (3) arrange, in a manner |
|||
consistent with the requirements of this License, to extend the patent |
|||
license to downstream recipients. "Knowingly relying" means you have |
|||
actual knowledge that, but for the patent license, your conveying the |
|||
covered work in a country, or your recipient's use of the covered work |
|||
in a country, would infringe one or more identifiable patents in that |
|||
country that you have reason to believe are valid. |
|||
|
|||
If, pursuant to or in connection with a single transaction or |
|||
arrangement, you convey, or propagate by procuring conveyance of, a |
|||
covered work, and grant a patent license to some of the parties |
|||
receiving the covered work authorizing them to use, propagate, modify |
|||
or convey a specific copy of the covered work, then the patent license |
|||
you grant is automatically extended to all recipients of the covered |
|||
work and works based on it. |
|||
|
|||
A patent license is "discriminatory" if it does not include within |
|||
the scope of its coverage, prohibits the exercise of, or is |
|||
conditioned on the non-exercise of one or more of the rights that are |
|||
specifically granted under this License. You may not convey a covered |
|||
work if you are a party to an arrangement with a third party that is |
|||
in the business of distributing software, under which you make payment |
|||
to the third party based on the extent of your activity of conveying |
|||
the work, and under which the third party grants, to any of the |
|||
parties who would receive the covered work from you, a discriminatory |
|||
patent license (a) in connection with copies of the covered work |
|||
conveyed by you (or copies made from those copies), or (b) primarily |
|||
for and in connection with specific products or compilations that |
|||
contain the covered work, unless you entered into that arrangement, |
|||
or that patent license was granted, prior to 28 March 2007. |
|||
|
|||
Nothing in this License shall be construed as excluding or limiting |
|||
any implied license or other defenses to infringement that may |
|||
otherwise be available to you under applicable patent law. |
|||
|
|||
12. No Surrender of Others' Freedom. |
|||
|
|||
If conditions are imposed on you (whether by court order, agreement or |
|||
otherwise) that contradict the conditions of this License, they do not |
|||
excuse you from the conditions of this License. If you cannot convey a |
|||
covered work so as to satisfy simultaneously your obligations under this |
|||
License and any other pertinent obligations, then as a consequence you may |
|||
not convey it at all. For example, if you agree to terms that obligate you |
|||
to collect a royalty for further conveying from those to whom you convey |
|||
the Program, the only way you could satisfy both those terms and this |
|||
License would be to refrain entirely from conveying the Program. |
|||
|
|||
13. Remote Network Interaction; Use with the GNU General Public License. |
|||
|
|||
Notwithstanding any other provision of this License, if you modify the |
|||
Program, your modified version must prominently offer all users |
|||
interacting with it remotely through a computer network (if your version |
|||
supports such interaction) an opportunity to receive the Corresponding |
|||
Source of your version by providing access to the Corresponding Source |
|||
from a network server at no charge, through some standard or customary |
|||
means of facilitating copying of software. This Corresponding Source |
|||
shall include the Corresponding Source for any work covered by version 3 |
|||
of the GNU General Public License that is incorporated pursuant to the |
|||
following paragraph. |
|||
|
|||
Notwithstanding any other provision of this License, you have |
|||
permission to link or combine any covered work with a work licensed |
|||
under version 3 of the GNU General Public License into a single |
|||
combined work, and to convey the resulting work. The terms of this |
|||
License will continue to apply to the part which is the covered work, |
|||
but the work with which it is combined will remain governed by version |
|||
3 of the GNU General Public License. |
|||
|
|||
14. Revised Versions of this License. |
|||
|
|||
The Free Software Foundation may publish revised and/or new versions of |
|||
the GNU Affero General Public License from time to time. Such new versions |
|||
will be similar in spirit to the present version, but may differ in detail to |
|||
address new problems or concerns. |
|||
|
|||
Each version is given a distinguishing version number. If the |
|||
Program specifies that a certain numbered version of the GNU Affero General |
|||
Public License "or any later version" applies to it, you have the |
|||
option of following the terms and conditions either of that numbered |
|||
version or of any later version published by the Free Software |
|||
Foundation. If the Program does not specify a version number of the |
|||
GNU Affero General Public License, you may choose any version ever published |
|||
by the Free Software Foundation. |
|||
|
|||
If the Program specifies that a proxy can decide which future |
|||
versions of the GNU Affero General Public License can be used, that proxy's |
|||
public statement of acceptance of a version permanently authorizes you |
|||
to choose that version for the Program. |
|||
|
|||
Later license versions may give you additional or different |
|||
permissions. However, no additional obligations are imposed on any |
|||
author or copyright holder as a result of your choosing to follow a |
|||
later version. |
|||
|
|||
15. Disclaimer of Warranty. |
|||
|
|||
THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY |
|||
APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT |
|||
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY |
|||
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, |
|||
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR |
|||
PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM |
|||
IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF |
|||
ALL NECESSARY SERVICING, REPAIR OR CORRECTION. |
|||
|
|||
16. Limitation of Liability. |
|||
|
|||
IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING |
|||
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS |
|||
THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY |
|||
GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE |
|||
USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF |
|||
DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD |
|||
PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), |
|||
EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF |
|||
SUCH DAMAGES. |
|||
|
|||
17. Interpretation of Sections 15 and 16. |
|||
|
|||
If the disclaimer of warranty and limitation of liability provided |
|||
above cannot be given local legal effect according to their terms, |
|||
reviewing courts shall apply local law that most closely approximates |
|||
an absolute waiver of all civil liability in connection with the |
|||
Program, unless a warranty or assumption of liability accompanies a |
|||
copy of the Program in return for a fee. |
|||
|
|||
END OF TERMS AND CONDITIONS |
|||
|
|||
How to Apply These Terms to Your New Programs |
|||
|
|||
If you develop a new program, and you want it to be of the greatest |
|||
possible use to the public, the best way to achieve this is to make it |
|||
free software which everyone can redistribute and change under these terms. |
|||
|
|||
To do so, attach the following notices to the program. It is safest |
|||
to attach them to the start of each source file to most effectively |
|||
state the exclusion of warranty; and each file should have at least |
|||
the "copyright" line and a pointer to where the full notice is found. |
|||
|
|||
<one line to give the program's name and a brief idea of what it does.> |
|||
Copyright (C) <year> <name of author> |
|||
|
|||
This program is free software: you can redistribute it and/or modify |
|||
it under the terms of the GNU Affero General Public License as published |
|||
by the Free Software Foundation, either version 3 of the License, or |
|||
(at your option) any later version. |
|||
|
|||
This program is distributed in the hope that it will be useful, |
|||
but WITHOUT ANY WARRANTY; without even the implied warranty of |
|||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
|||
GNU Affero General Public License for more details. |
|||
|
|||
You should have received a copy of the GNU Affero General Public License |
|||
along with this program. If not, see <http://www.gnu.org/licenses/>. |
|||
|
|||
Also add information on how to contact you by electronic and paper mail. |
|||
|
|||
If your software can interact with users remotely through a computer |
|||
network, you should also make sure that it provides a way for users to |
|||
get its source. For example, if your program is a web application, its |
|||
interface could display a "Source" link that leads users to an archive |
|||
of the code. There are many ways you could offer source, and different |
|||
solutions will be better for different programs; see section 13 for the |
|||
specific requirements. |
|||
|
|||
You should also get your employer (if you work as a programmer) or school, |
|||
if any, to sign a "copyright disclaimer" for the program, if necessary. |
|||
For more information on this, and how to apply and follow the GNU AGPL, see |
|||
<http://www.gnu.org/licenses/>. |
|||
파일 크기가 너무 크기때문에 변경 상태를 표시하지 않습니다.
@ -0,0 +1,97 @@ |
|||
# For Help: https://www.mkdocs.org/user-guide/configuration/ |
|||
# https://squidfunk.github.io/mkdocs-material/getting-started/ |
|||
# Requirements: mkdocs >1.x && mkdocs-material && markdown_include |
|||
|
|||
# Project information |
|||
site_name: MISP Modules Documentation |
|||
site_description: MISP Modules Project |
|||
site_author: MISP Project |
|||
site_url: https://www.misp-project.org/ |
|||
|
|||
# Repository |
|||
repo_name: 'MISP/misp-modules' |
|||
repo_url: https://github.com/MISP/misp-modules/ |
|||
edit_uri: "" |
|||
|
|||
use_directory_urls: true |
|||
|
|||
# Copyright |
|||
copyright: "Copyright © 2019 MISP Project" |
|||
|
|||
# Options |
|||
extra: |
|||
search: |
|||
languages: "en" |
|||
social: |
|||
- type: globe |
|||
link: https://www.misp-project.org/ |
|||
- type: github-alt |
|||
link: https://github.com/MISP |
|||
- type: twitter |
|||
link: https://twitter.com/MISPProject |
|||
|
|||
theme: |
|||
name: material |
|||
palette: |
|||
primary: 'white' |
|||
accent: 'blue' |
|||
language: en |
|||
favicon: img/favicon.ico |
|||
logo: img/misp.png |
|||
|
|||
# Extensions |
|||
markdown_extensions: |
|||
# - markdown_include.include: |
|||
# base_path: docs |
|||
# mkdcomments is buggy atm, see: https://github.com/ryneeverett/python-markdown-comments/issues/3 |
|||
#- mkdcomments |
|||
- toc: |
|||
permalink: "#" |
|||
baselevel: 2 |
|||
separator: "_" |
|||
- markdown.extensions.admonition |
|||
- markdown.extensions.codehilite: |
|||
guess_lang: false |
|||
- markdown.extensions.def_list |
|||
- markdown.extensions.footnotes |
|||
- markdown.extensions.meta |
|||
- markdown.extensions.toc: |
|||
permalink: true |
|||
- pymdownx.arithmatex |
|||
- pymdownx.betterem: |
|||
smart_enable: all |
|||
- pymdownx.caret |
|||
- pymdownx.critic |
|||
- pymdownx.details |
|||
- pymdownx.emoji: |
|||
emoji_generator: !!python/name:pymdownx.emoji.to_svg |
|||
- pymdownx.inlinehilite |
|||
- pymdownx.magiclink |
|||
- pymdownx.mark |
|||
- pymdownx.smartsymbols |
|||
- pymdownx.superfences |
|||
- pymdownx.tasklist: |
|||
custom_checkbox: true |
|||
- pymdownx.tilde |
|||
|
|||
nav: |
|||
- Home: 'index.md' |
|||
- Modules: |
|||
- Expansion Modules: expansion.md |
|||
- Export Modules: export_mod.md |
|||
- Import Modules: import_mod.md |
|||
- Install Guides: install.md |
|||
- Contribute: contribute.md |
|||
# - 'Ubuntu 18.04': 'INSTALL.ubuntu1804.md' |
|||
# - 'Kali Linux': 'INSTALL.kali.md' |
|||
# - 'RHEL7/CentOS7': 'INSTALL.rhel7.md' |
|||
# - 'RHEL8': 'INSTALL.rhel8.md' |
|||
# - Config Guides: |
|||
# - 'Elastic Search Logging': 'CONFIG.elasticsearch-logging.md' |
|||
# - 'Amazon S3 attachments': 'CONFIG.s3-attachments.md' |
|||
# - 'S/MIME': 'CONFIG.SMIME.md' |
|||
# - Update MISP: 'UPDATE.md' |
|||
# - Upgrading MISP: 'UPGRADE.md' |
|||
- About: |
|||
# - 'MISP Release Notes': 'Changelog.md' |
|||
- 'License': 'license.md' |
|||
불러오는 중...
Reference in new issue