mirror of https://github.com/MISP/misp-modules
8ear
4 years ago
parent
fa410e314d
commit
c34e1ddd29
14 changed files with 2625 additions and 489 deletions
@ -0,0 +1,19 @@ |
||||
|
||||
.PHONY: prepare_docs generate_docs ci_generate_docs test_docs |
||||
|
||||
prepare_docs: |
||||
cd doc; python generate_documentation.py
|
||||
mkdir -p docs/expansion/logos docs/export_mod/logos docs/import_mod/logos
|
||||
cp -R doc/logos/* docs/expansion/logos
|
||||
cp -R doc/logos/* docs/export_mod/logos
|
||||
cp -R doc/logos/* docs/import_mod/logos
|
||||
cp LICENSE docs/license.md
|
||||
|
||||
generate_docs: prepare_docs |
||||
docker run --rm -it -v $(PWD):/docs squidfunk/mkdocs-material build
|
||||
|
||||
ci_generate_docs: prepare_docs |
||||
mkdocs gh-deploy
|
||||
|
||||
test_docs: prepare_docs |
||||
docker run --rm -it -p 8000:8000 -v $(PWD):/docs squidfunk/mkdocs-material
|
||||
@ -0,0 +1,3 @@ |
||||
mkdocs |
||||
mkdocs-material |
||||
markdown_include |
||||
@ -0,0 +1,373 @@ |
||||
## How to add your own MISP modules? |
||||
|
||||
Create your module in [misp_modules/modules/expansion/](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/), [misp_modules/modules/export_mod/](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/export_mod/), or [misp_modules/modules/import_mod/](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/import_mod/). The module should have at minimum three functions: |
||||
|
||||
* **introspection** function that returns a dict of the supported attributes (input and output) by your expansion module. |
||||
* **handler** function which accepts a JSON document to expand the values and return a dictionary of the expanded values. |
||||
* **version** function that returns a dict with the version and the associated meta-data including potential configurations required of the module. |
||||
|
||||
Don't forget to return an error key and value if an error is raised to propagate it to the MISP user-interface. |
||||
|
||||
Your module's script name should also be added in the `__all__` list of `<module type folder>/__init__.py` in order for it to be loaded. |
||||
|
||||
~~~python |
||||
... |
||||
# Checking for required value |
||||
if not request.get('ip-src'): |
||||
# Return an error message |
||||
return {'error': "A source IP is required"} |
||||
... |
||||
~~~ |
||||
|
||||
|
||||
### introspection |
||||
|
||||
The function that returns a dict of the supported attributes (input and output) by your expansion module. |
||||
|
||||
~~~python |
||||
mispattributes = {'input': ['link', 'url'], |
||||
'output': ['attachment', 'malware-sample']} |
||||
|
||||
def introspection(): |
||||
return mispattributes |
||||
~~~ |
||||
|
||||
### version |
||||
|
||||
The function that returns a dict with the version and the associated meta-data including potential configurations required of the module. |
||||
|
||||
|
||||
### Additional Configuration Values |
||||
|
||||
If your module requires additional configuration (to be exposed via the MISP user-interface), you can define those in the moduleconfig value returned by the version function. |
||||
|
||||
~~~python |
||||
# config fields that your code expects from the site admin |
||||
moduleconfig = ["apikey", "event_limit"] |
||||
|
||||
def version(): |
||||
moduleinfo['config'] = moduleconfig |
||||
return moduleinfo |
||||
~~~ |
||||
|
||||
|
||||
When you do this a config array is added to the meta-data output containing all the potential configuration values: |
||||
|
||||
~~~ |
||||
"meta": { |
||||
"description": "PassiveTotal expansion service to expand values with multiple Passive DNS sources", |
||||
"config": [ |
||||
"username", |
||||
"password" |
||||
], |
||||
"module-type": [ |
||||
"expansion", |
||||
"hover" |
||||
], |
||||
|
||||
... |
||||
~~~ |
||||
|
||||
|
||||
If you want to use the configuration values set in the web interface they are stored in the key `config` in the JSON object passed to the handler. |
||||
|
||||
~~~ |
||||
def handler(q=False): |
||||
|
||||
# Check if we were given a configuration |
||||
config = q.get("config", {}) |
||||
|
||||
# Find out if there is a username field |
||||
username = config.get("username", None) |
||||
~~~ |
||||
|
||||
|
||||
### handler |
||||
|
||||
The function which accepts a JSON document to expand the values and return a dictionary of the expanded values. |
||||
|
||||
~~~python |
||||
def handler(q=False): |
||||
"Fully functional rot-13 encoder" |
||||
if q is False: |
||||
return False |
||||
request = json.loads(q) |
||||
src = request.get('ip-src') |
||||
if src is None: |
||||
# Return an error message |
||||
return {'error': "A source IP is required"} |
||||
else: |
||||
return {'results': |
||||
codecs.encode(src, "rot-13")} |
||||
~~~ |
||||
|
||||
#### export module |
||||
|
||||
For an export module, the `request["data"]` object corresponds to a list of events (dictionaries) to handle. |
||||
|
||||
Iterating over events attributes is performed using their `Attribute` key. |
||||
|
||||
~~~python |
||||
... |
||||
for event in request["data"]: |
||||
for attribute in event["Attribute"]: |
||||
# do stuff w/ attribute['type'], attribute['value'], ... |
||||
... |
||||
|
||||
### Returning Binary Data |
||||
|
||||
If you want to return a file or other data you need to add a data attribute. |
||||
|
||||
~~~python |
||||
{"results": {"values": "filename.txt", |
||||
"types": "attachment", |
||||
"data" : base64.b64encode(<ByteIO>) # base64 encode your data first |
||||
"comment": "This is an attachment"}} |
||||
~~~ |
||||
|
||||
If the binary file is malware you can use 'malware-sample' as the type. If you do this the malware sample will be automatically zipped and password protected ('infected') after being uploaded. |
||||
|
||||
|
||||
~~~python |
||||
{"results": {"values": "filename.txt", |
||||
"types": "malware-sample", |
||||
"data" : base64.b64encode(<ByteIO>) # base64 encode your data first |
||||
"comment": "This is an attachment"}} |
||||
~~~ |
||||
|
||||
[To learn more about how data attributes are processed you can read the processing code here.](https://github.com/MISP/PyMISP/blob/4f230c9299ad9d2d1c851148c629b61a94f3f117/pymisp/mispevent.py#L185-L200) |
||||
|
||||
|
||||
### Module type |
||||
|
||||
A MISP module can be of four types: |
||||
|
||||
- **expansion** - service related to an attribute that can be used to extend and update an existing event. |
||||
- **hover** - service related to an attribute to provide additional information to the users without updating the event. |
||||
- **import** - service related to importing and parsing an external object that can be used to extend an existing event. |
||||
- **export** - service related to exporting an object, event, or data. |
||||
|
||||
module-type is an array where the list of supported types can be added. |
||||
|
||||
## Testing your modules? |
||||
|
||||
MISP uses the **modules** function to discover the available MISP modules and their supported MISP attributes: |
||||
|
||||
~~~ |
||||
% curl -s http://127.0.0.1:6666/modules | jq . |
||||
[ |
||||
{ |
||||
"name": "passivetotal", |
||||
"type": "expansion", |
||||
"mispattributes": { |
||||
"input": [ |
||||
"hostname", |
||||
"domain", |
||||
"ip-src", |
||||
"ip-dst" |
||||
], |
||||
"output": [ |
||||
"ip-src", |
||||
"ip-dst", |
||||
"hostname", |
||||
"domain" |
||||
] |
||||
}, |
||||
"meta": { |
||||
"description": "PassiveTotal expansion service to expand values with multiple Passive DNS sources", |
||||
"config": [ |
||||
"username", |
||||
"password" |
||||
], |
||||
"author": "Alexandre Dulaunoy", |
||||
"version": "0.1" |
||||
} |
||||
}, |
||||
{ |
||||
"name": "sourcecache", |
||||
"type": "expansion", |
||||
"mispattributes": { |
||||
"input": [ |
||||
"link" |
||||
], |
||||
"output": [ |
||||
"link" |
||||
] |
||||
}, |
||||
"meta": { |
||||
"description": "Module to cache web pages of analysis reports, OSINT sources. The module returns a link of the cached page.", |
||||
"author": "Alexandre Dulaunoy", |
||||
"version": "0.1" |
||||
} |
||||
}, |
||||
{ |
||||
"name": "dns", |
||||
"type": "expansion", |
||||
"mispattributes": { |
||||
"input": [ |
||||
"hostname", |
||||
"domain" |
||||
], |
||||
"output": [ |
||||
"ip-src", |
||||
"ip-dst" |
||||
] |
||||
}, |
||||
"meta": { |
||||
"description": "Simple DNS expansion service to resolve IP address from MISP attributes", |
||||
"author": "Alexandre Dulaunoy", |
||||
"version": "0.1" |
||||
} |
||||
} |
||||
] |
||||
|
||||
~~~ |
||||
|
||||
The MISP module service returns the available modules in a JSON array containing each module name along with their supported input attributes. |
||||
|
||||
Based on this information, a query can be built in a JSON format and saved as body.json: |
||||
|
||||
~~~json |
||||
{ |
||||
"hostname": "www.foo.be", |
||||
"module": "dns" |
||||
} |
||||
~~~ |
||||
|
||||
Then you can POST this JSON format query towards the MISP object server: |
||||
|
||||
~~~bash |
||||
curl -s http://127.0.0.1:6666/query -H "Content-Type: application/json" --data @body.json -X POST |
||||
~~~ |
||||
|
||||
The module should output the following JSON: |
||||
|
||||
~~~json |
||||
{ |
||||
"results": [ |
||||
{ |
||||
"types": [ |
||||
"ip-src", |
||||
"ip-dst" |
||||
], |
||||
"values": [ |
||||
"188.65.217.78" |
||||
] |
||||
} |
||||
] |
||||
} |
||||
~~~ |
||||
|
||||
It is also possible to restrict the category options of the resolved attributes by passing a list of categories along (optional): |
||||
|
||||
~~~json |
||||
{ |
||||
"results": [ |
||||
{ |
||||
"types": [ |
||||
"ip-src", |
||||
"ip-dst" |
||||
], |
||||
"values": [ |
||||
"188.65.217.78" |
||||
], |
||||
"categories": [ |
||||
"Network activity", |
||||
"Payload delivery" |
||||
] |
||||
} |
||||
] |
||||
} |
||||
~~~ |
||||
|
||||
For both the type and the category lists, the first item in the list will be the default setting on the interface. |
||||
|
||||
### Enable your module in the web interface |
||||
|
||||
For a module to be activated in the MISP web interface it must be enabled in the "Plugin Settings. |
||||
|
||||
Go to "Administration > Server Settings" in the top menu |
||||
- Go to "Plugin Settings" in the top "tab menu bar" |
||||
- Click on the name of the type of module you have created to expand the list of plugins to show your module. |
||||
- Find the name of your plugin's "enabled" value in the Setting Column. |
||||
"Plugin.[MODULE NAME]_enabled" |
||||
- Double click on its "Value" column |
||||
|
||||
~~~ |
||||
Priority Setting Value Description Error Message |
||||
Recommended Plugin.Import_ocr_enabled false Enable or disable the ocr module. Value not set. |
||||
~~~ |
||||
|
||||
- Use the drop-down to set the enabled value to 'true' |
||||
|
||||
~~~ |
||||
Priority Setting Value Description Error Message |
||||
Recommended Plugin.Import_ocr_enabled true Enable or disable the ocr module. Value not set. |
||||
~~~ |
||||
|
||||
### Set any other required settings for your module |
||||
|
||||
In this same menu set any other plugin settings that are required for testing. |
||||
|
||||
|
||||
|
||||
## Documentation |
||||
|
||||
In order to provide documentation about some modules that require specific input / output / configuration, the [doc](https://github.com/MISP/misp-modules/tree/master/doc) directory contains detailed information about the general purpose, requirements, features, input and output of each of these modules: |
||||
|
||||
- ***description** - quick description of the general purpose of the module, as the one given by the moduleinfo |
||||
- **requirements** - special libraries needed to make the module work |
||||
- **features** - description of the way to use the module, with the required MISP features to make the module give the intended result |
||||
- **references** - link(s) giving additional information about the format concerned in the module |
||||
- **input** - description of the format of data used in input |
||||
- **output** - description of the format given as the result of the module execution |
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## Tips for developers creating modules |
||||
|
||||
Download a pre-built virtual image from the [MISP training materials](https://www.circl.lu/services/misp-training-materials/). |
||||
|
||||
- Create a Host-Only adapter in VirtualBox |
||||
- Set your Misp OVA to that Host-Only adapter |
||||
- Start the virtual machine |
||||
- Get the IP address of the virutal machine |
||||
- SSH into the machine (Login info on training page) |
||||
- Go into the misp-modules directory |
||||
|
||||
~~~bash |
||||
cd /usr/local/src/misp-modules |
||||
~~~ |
||||
|
||||
Set the git repo to your fork and checkout your development branch. If you SSH'ed in as the misp user you will have to use sudo. |
||||
|
||||
~~~bash |
||||
sudo git remote set-url origin https://github.com/YourRepo/misp-modules.git |
||||
sudo git pull |
||||
sudo git checkout MyModBranch |
||||
~~~ |
||||
|
||||
Remove the contents of the build directory and re-install misp-modules. |
||||
|
||||
~~~python |
||||
sudo rm -fr build/* |
||||
sudo pip3 install --upgrade . |
||||
~~~ |
||||
|
||||
SSH in with a different terminal and run `misp-modules` with debugging enabled. |
||||
|
||||
~~~python |
||||
sudo killall misp-modules |
||||
misp-modules -d |
||||
~~~ |
||||
|
||||
|
||||
In your original terminal you can now run your tests manually and see any errors that arrive |
||||
|
||||
~~~bash |
||||
cd tests/ |
||||
curl -s http://127.0.0.1:6666/query -H "Content-Type: application/json" --data @MY_TEST_FILE.json -X POST |
||||
cd ../ |
||||
~~~ |
||||
|
After Width: | Height: | Size: 1.1 KiB |
|
After Width: | Height: | Size: 10 KiB |
@ -0,0 +1,97 @@ |
||||
# Home |
||||
|
||||
[](https://travis-ci.org/MISP/misp-modules) |
||||
[](https://coveralls.io/github/MISP/misp-modules?branch=master) |
||||
[](https://codecov.io/gh/MISP/misp-modules) |
||||
[](https://app.fossa.io/projects/git%2Bgithub.com%2F8ear%2Fmisp-modules?ref=badge_shield) |
||||
|
||||
MISP modules are autonomous modules that can be used for expansion and other services in [MISP](https://github.com/MISP/MISP). |
||||
|
||||
The modules are written in Python 3 following a simple API interface. The objective is to ease the extensions of MISP functionalities |
||||
without modifying core components. The API is available via a simple REST API which is independent from MISP installation or configuration. |
||||
|
||||
MISP modules support is included in MISP starting from version `2.4.28`. |
||||
|
||||
For more information: [Extending MISP with Python modules](https://www.circl.lu/assets/files/misp-training/switch2016/2-misp-modules.pdf) slides from MISP training. |
||||
|
||||
|
||||
## Existing MISP modules |
||||
|
||||
### Expansion modules |
||||
|
||||
* [BGP Ranking](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/bgpranking.py) - a hover and expansion module to expand an AS number with the ASN description, its history, and position in BGP Ranking. |
||||
* [BTC transactions](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/btc_steroids.py) - An expansion hover module to get a blockchain balance and the transactions from a BTC address in MISP. |
||||
* [CIRCL Passive DNS](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/circl_passivedns.py) - a hover and expansion module to expand hostname and IP addresses with passive DNS information. |
||||
* [CIRCL Passive SSL](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/circl_passivessl.py) - a hover and expansion module to expand IP addresses with the X.509 certificate seen. |
||||
* [countrycode](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/countrycode.py) - a hover module to tell you what country a URL belongs to. |
||||
* [CrowdStrike Falcon](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/crowdstrike_falcon.py) - an expansion module to expand using CrowdStrike Falcon Intel Indicator API. |
||||
* [CVE](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/cve.py) - a hover module to give more information about a vulnerability (CVE). |
||||
* [DBL Spamhaus](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/dbl_spamhaus.py) - a hover module to check Spamhaus DBL for a domain name. |
||||
* [DNS](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/dns.py) - a simple module to resolve MISP attributes like hostname and domain to expand IP addresses attributes. |
||||
* [DomainTools](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/domaintools.py) - a hover and expansion module to get information from [DomainTools](http://www.domaintools.com/) whois. |
||||
* [EUPI](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/eupi.py) - a hover and expansion module to get information about an URL from the [Phishing Initiative project](https://phishing-initiative.eu/?lang=en). |
||||
* [Farsight DNSDB Passive DNS](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/farsight_passivedns.py) - a hover and expansion module to expand hostname and IP addresses with passive DNS information. |
||||
* [GeoIP](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/geoip_country.py) - a hover and expansion module to get GeoIP information from geolite/maxmind. |
||||
* [hashdd](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/hashdd.py) - a hover module to check file hashes against [hashdd.com](http://www.hashdd.com) including NSLR dataset. |
||||
* [intel471](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/intel471.py) - an expansion module to get info from [Intel471](https://intel471.com). |
||||
* [IPASN](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/ipasn.py) - a hover and expansion to get the BGP ASN of an IP address. |
||||
* [iprep](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/iprep.py) - an expansion module to get IP reputation from packetmail.net. |
||||
* [macaddress.io](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/macaddress_io.py) - a hover module to retrieve vendor details and other information regarding a given MAC address or an OUI from [MAC address Vendor Lookup](https:/macaddress.io). See [integration tutorial here](https:/macaddress.io/integrations/MISP-module). |
||||
* [onyphe](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/onyphe.py) - a modules to process queries on Onyphe. |
||||
* [onyphe_full](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/onyphe_full.py) - a modules to process full queries on Onyphe. |
||||
* [OTX](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/otx.py) - an expansion module for [OTX](https://otx.alienvault.com/). |
||||
* [passivetotal](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/passivetotal.py) - a [passivetotal](https://www.passivetotal.org/) module that queries a number of different PassiveTotal datasets. |
||||
* [rbl](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/rbl.py) - a module to get RBL (Real-Time Blackhost List) values from an attribute. |
||||
* [reversedns](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/reversedns.py) - Simple Reverse DNS expansion service to resolve reverse DNS from MISP attributes. |
||||
* [securitytrails](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/securitytrails.py) - an expansion module for [securitytrails](https://securitytrails.com/). |
||||
* [shodan](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/shodan.py) - a minimal [shodan](https://www.shodan.io/) expansion module. |
||||
* [Sigma queries](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/sigma_queries.py) - Experimental expansion module querying a sigma rule to convert it into all the available SIEM signatures. |
||||
* [Sigma syntax validator](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/sigma_syntax_validator.py) - Sigma syntax validator. |
||||
* [sourcecache](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/sourcecache.py) - a module to cache a specific link from a MISP instance. |
||||
* [STIX2 pattern syntax validator](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/stix2_pattern_syntax_validator.py) - a module to check a STIX2 pattern syntax. |
||||
* [ThreatCrowd](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/threatcrowd.py) - an expansion module for [ThreatCrowd](https://www.threatcrowd.org/). |
||||
* [threatminer](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/threatminer.py) - an expansion module to expand from [ThreatMiner](https://www.threatminer.org/). |
||||
* [urlscan](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/urlscan.py) - an expansion module to query [urlscan.io](https://urlscan.io). |
||||
* [virustotal](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/virustotal.py) - an expansion module to pull known resolutions and malware samples related with an IP/Domain from virusTotal (this modules require a VirusTotal private API key) |
||||
* [VMray](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/vmray_submit.py) - a module to submit a sample to VMray. |
||||
* [VulnDB](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/vulndb.py) - a module to query [VulnDB](https://www.riskbasedsecurity.com/). |
||||
* [Vulners](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/vulners.py) - an expansion module to expand information about CVEs using Vulners API. |
||||
* [whois](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion) - a module to query a local instance of [uwhois](https://github.com/rafiot/uwhoisd). |
||||
* [wikidata](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/wiki.py) - a [wikidata](https://www.wikidata.org) expansion module. |
||||
* [xforce](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/xforceexchange.py) - an IBM X-Force Exchange expansion module. |
||||
* [YARA query](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/yara_query.py) - a module to create YARA rules from single hash attributes. |
||||
* [YARA syntax validator](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/yara_syntax_validator.py) - YARA syntax validator. |
||||
|
||||
### Export modules |
||||
|
||||
* [CEF](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/export_mod/cef_export.py) module to export Common Event Format (CEF). |
||||
* [GoAML export](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/export_mod/goamlexport.py) module to export in [GoAML format](http://goaml.unodc.org/goaml/en/index.html). |
||||
* [Lite Export](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/export_mod/liteexport.py) module to export a lite event. |
||||
* [Simple PDF export](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/export_mod/pdfexport.py) module to export in PDF (required: asciidoctor-pdf). |
||||
* [Nexthink query format](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/export_mod/nexthinkexport.py) module to export in Nexthink query format. |
||||
* [osquery](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/export_mod/osqueryexport.py) module to export in [osquery](https://osquery.io/) query format. |
||||
* [ThreatConnect](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/export_mod/threat_connect_export.py) module to export in ThreatConnect CSV format. |
||||
* [ThreatStream](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/export_mod/threatStream_misp_export.py) module to export in ThreatStream format. |
||||
|
||||
### Import modules |
||||
|
||||
* [CSV import](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/import_mod/csvimport.py) Customizable CSV import module. |
||||
* [Cuckoo JSON](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/import_mod/cuckooimport.py) Cuckoo JSON import. |
||||
* [Email Import](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/import_mod/email_import.py) Email import module for MISP to import basic metadata. |
||||
* [GoAML import](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/import_mod/) Module to import [GoAML](http://goaml.unodc.org/goaml/en/index.html) XML format. |
||||
* [OCR](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/import_mod/ocr.py) Optical Character Recognition (OCR) module for MISP to import attributes from images, scan or faxes. |
||||
* [OpenIOC](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/import_mod/openiocimport.py) OpenIOC import based on PyMISP library. |
||||
* [ThreatAnalyzer](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/import_mod/threatanalyzer_import.py) - An import module to process ThreatAnalyzer archive.zip/analysis.json sandbox exports. |
||||
* [VMRay](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/import_mod/vmray_import.py) - An import module to process VMRay export. |
||||
|
||||
|
||||
## How to contribute your own module? |
||||
|
||||
Fork the project, add your module, test it and make a pull-request. Modules can be also private as you can add a module in your own MISP installation. |
||||
For further information please see [Contribute](contribute/). |
||||
|
||||
|
||||
## Licenses |
||||
[](https://app.fossa.io/projects/git%2Bgithub.com%2Fmisp%2Fmisp-modules?ref=badge_large) |
||||
|
||||
For further Information see also the [license file](license/). |
||||
@ -0,0 +1,92 @@ |
||||
## How to install and start MISP modules in a Python virtualenv? |
||||
|
||||
~~~~bash |
||||
sudo apt-get install python3-dev python3-pip libpq5 libjpeg-dev tesseract-ocr imagemagick |
||||
sudo -u www-data virtualenv -p python3 /var/www/MISP/venv |
||||
cd /usr/local/src/ |
||||
sudo git clone https://github.com/MISP/misp-modules.git |
||||
cd misp-modules |
||||
sudo -u www-data /var/www/MISP/venv/bin/pip install -I -r REQUIREMENTS |
||||
sudo -u www-data /var/www/MISP/venv/bin/pip install . |
||||
sudo apt install ruby-pygments.rb -y |
||||
sudo gem install asciidoctor-pdf --pre |
||||
sudo sed -i -e '$i \sudo -u www-data /var/www/MISP/venv/bin/misp-modules -l 127.0.0.1 -s > /tmp/misp-modules_rc.local.log &\n' /etc/rc.local |
||||
/var/www/MISP/venv/bin/misp-modules -l 127.0.0.1 -s & #to start the modules |
||||
~~~~ |
||||
|
||||
## How to install and start MISP modules? |
||||
|
||||
~~~~bash |
||||
sudo apt-get install python3-dev python3-pip libpq5 libjpeg-dev tesseract-ocr imagemagick |
||||
cd /usr/local/src/ |
||||
sudo git clone https://github.com/MISP/misp-modules.git |
||||
cd misp-modules |
||||
sudo pip3 install -I -r REQUIREMENTS |
||||
sudo pip3 install -I . |
||||
sudo apt install ruby-pygments.rb -y |
||||
sudo gem install asciidoctor-pdf --pre |
||||
sudo sed -i -e '$i \sudo -u www-data /var/www/MISP/venv/bin/misp-modules -l 127.0.0.1 -s > /tmp/misp-modules_rc.local.log &\n' /etc/rc.local |
||||
/var/www/MISP/venv/bin/misp-modules -l 127.0.0.1 -s & #to start the modules |
||||
~~~~ |
||||
|
||||
## How to use an MISP modules Docker container |
||||
|
||||
### Docker run |
||||
|
||||
~~~~bash |
||||
# Start Redis |
||||
docker run --rm -d --container_name misp-redis redis:alpine |
||||
docker run \ |
||||
--rm -d --container_name misp-modules \ |
||||
-e REDIS_BACKEND=misp-redis \ |
||||
-e REDIS_PORT="6379" \ |
||||
-e REDIS_PW="" \ |
||||
-e REDIS_DATABASE="245" \ |
||||
-e MISP_MODULES_DEBUG: "false" \ |
||||
dcso/misp-dockerized-redis |
||||
~~~~ |
||||
|
||||
### Docker-compose |
||||
|
||||
~~~~yml |
||||
services: |
||||
misp-modules: |
||||
# https://hub.docker.com/r/dcso/misp-dockerized-misp-modules |
||||
image: dcso/misp-dockerized-misp-modules:3 |
||||
environment: |
||||
# Redis |
||||
REDIS_BACKEND: misp-redis |
||||
REDIS_PORT: "6379" |
||||
REDIS_DATABASE: "245" |
||||
# System PROXY (OPTIONAL) |
||||
http_proxy: |
||||
https_proxy: |
||||
no_proxy: 0.0.0.0 |
||||
# Timezone (OPTIONAL) |
||||
TZ: Europe/Berlin |
||||
# MISP-Modules (OPTIONAL) |
||||
MISP_MODULES_DEBUG: "false" |
||||
# Logging options (OPTIONAL) |
||||
LOG_SYSLOG_ENABLED: "no" |
||||
misp-redis: |
||||
# https://hub.docker.com/_/redis or alternative https://hub.docker.com/r/dcso/misp-dockerized-redis/ |
||||
image: redis:alpine |
||||
~~~~ |
||||
|
||||
## Install misp-module on an offline instance. |
||||
First, you need to grab all necessary packages for example like this : |
||||
|
||||
Use pip wheel to create an archive |
||||
~~~ |
||||
mkdir misp-modules-offline |
||||
pip3 wheel -r REQUIREMENTS shodan --wheel-dir=./misp-modules-offline |
||||
tar -cjvf misp-module-bundeled.tar.bz2 ./misp-modules-offline/* |
||||
~~~ |
||||
On offline machine : |
||||
~~~ |
||||
mkdir misp-modules-bundle |
||||
tar xvf misp-module-bundeled.tar.bz2 -C misp-modules-bundle |
||||
cd misp-modules-bundle |
||||
ls -1|while read line; do sudo pip3 install --force-reinstall --ignore-installed --upgrade --no-index --no-deps ${line};done |
||||
~~~ |
||||
Next you can follow standard install procedure. |
||||
@ -0,0 +1,661 @@ |
||||
GNU AFFERO GENERAL PUBLIC LICENSE |
||||
Version 3, 19 November 2007 |
||||
|
||||
Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/> |
||||
Everyone is permitted to copy and distribute verbatim copies |
||||
of this license document, but changing it is not allowed. |
||||
|
||||
Preamble |
||||
|
||||
The GNU Affero General Public License is a free, copyleft license for |
||||
software and other kinds of works, specifically designed to ensure |
||||
cooperation with the community in the case of network server software. |
||||
|
||||
The licenses for most software and other practical works are designed |
||||
to take away your freedom to share and change the works. By contrast, |
||||
our General Public Licenses are intended to guarantee your freedom to |
||||
share and change all versions of a program--to make sure it remains free |
||||
software for all its users. |
||||
|
||||
When we speak of free software, we are referring to freedom, not |
||||
price. Our General Public Licenses are designed to make sure that you |
||||
have the freedom to distribute copies of free software (and charge for |
||||
them if you wish), that you receive source code or can get it if you |
||||
want it, that you can change the software or use pieces of it in new |
||||
free programs, and that you know you can do these things. |
||||
|
||||
Developers that use our General Public Licenses protect your rights |
||||
with two steps: (1) assert copyright on the software, and (2) offer |
||||
you this License which gives you legal permission to copy, distribute |
||||
and/or modify the software. |
||||
|
||||
A secondary benefit of defending all users' freedom is that |
||||
improvements made in alternate versions of the program, if they |
||||
receive widespread use, become available for other developers to |
||||
incorporate. Many developers of free software are heartened and |
||||
encouraged by the resulting cooperation. However, in the case of |
||||
software used on network servers, this result may fail to come about. |
||||
The GNU General Public License permits making a modified version and |
||||
letting the public access it on a server without ever releasing its |
||||
source code to the public. |
||||
|
||||
The GNU Affero General Public License is designed specifically to |
||||
ensure that, in such cases, the modified source code becomes available |
||||
to the community. It requires the operator of a network server to |
||||
provide the source code of the modified version running there to the |
||||
users of that server. Therefore, public use of a modified version, on |
||||
a publicly accessible server, gives the public access to the source |
||||
code of the modified version. |
||||
|
||||
An older license, called the Affero General Public License and |
||||
published by Affero, was designed to accomplish similar goals. This is |
||||
a different license, not a version of the Affero GPL, but Affero has |
||||
released a new version of the Affero GPL which permits relicensing under |
||||
this license. |
||||
|
||||
The precise terms and conditions for copying, distribution and |
||||
modification follow. |
||||
|
||||
TERMS AND CONDITIONS |
||||
|
||||
0. Definitions. |
||||
|
||||
"This License" refers to version 3 of the GNU Affero General Public License. |
||||
|
||||
"Copyright" also means copyright-like laws that apply to other kinds of |
||||
works, such as semiconductor masks. |
||||
|
||||
"The Program" refers to any copyrightable work licensed under this |
||||
License. Each licensee is addressed as "you". "Licensees" and |
||||
"recipients" may be individuals or organizations. |
||||
|
||||
To "modify" a work means to copy from or adapt all or part of the work |
||||
in a fashion requiring copyright permission, other than the making of an |
||||
exact copy. The resulting work is called a "modified version" of the |
||||
earlier work or a work "based on" the earlier work. |
||||
|
||||
A "covered work" means either the unmodified Program or a work based |
||||
on the Program. |
||||
|
||||
To "propagate" a work means to do anything with it that, without |
||||
permission, would make you directly or secondarily liable for |
||||
infringement under applicable copyright law, except executing it on a |
||||
computer or modifying a private copy. Propagation includes copying, |
||||
distribution (with or without modification), making available to the |
||||
public, and in some countries other activities as well. |
||||
|
||||
To "convey" a work means any kind of propagation that enables other |
||||
parties to make or receive copies. Mere interaction with a user through |
||||
a computer network, with no transfer of a copy, is not conveying. |
||||
|
||||
An interactive user interface displays "Appropriate Legal Notices" |
||||
to the extent that it includes a convenient and prominently visible |
||||
feature that (1) displays an appropriate copyright notice, and (2) |
||||
tells the user that there is no warranty for the work (except to the |
||||
extent that warranties are provided), that licensees may convey the |
||||
work under this License, and how to view a copy of this License. If |
||||
the interface presents a list of user commands or options, such as a |
||||
menu, a prominent item in the list meets this criterion. |
||||
|
||||
1. Source Code. |
||||
|
||||
The "source code" for a work means the preferred form of the work |
||||
for making modifications to it. "Object code" means any non-source |
||||
form of a work. |
||||
|
||||
A "Standard Interface" means an interface that either is an official |
||||
standard defined by a recognized standards body, or, in the case of |
||||
interfaces specified for a particular programming language, one that |
||||
is widely used among developers working in that language. |
||||
|
||||
The "System Libraries" of an executable work include anything, other |
||||
than the work as a whole, that (a) is included in the normal form of |
||||
packaging a Major Component, but which is not part of that Major |
||||
Component, and (b) serves only to enable use of the work with that |
||||
Major Component, or to implement a Standard Interface for which an |
||||
implementation is available to the public in source code form. A |
||||
"Major Component", in this context, means a major essential component |
||||
(kernel, window system, and so on) of the specific operating system |
||||
(if any) on which the executable work runs, or a compiler used to |
||||
produce the work, or an object code interpreter used to run it. |
||||
|
||||
The "Corresponding Source" for a work in object code form means all |
||||
the source code needed to generate, install, and (for an executable |
||||
work) run the object code and to modify the work, including scripts to |
||||
control those activities. However, it does not include the work's |
||||
System Libraries, or general-purpose tools or generally available free |
||||
programs which are used unmodified in performing those activities but |
||||
which are not part of the work. For example, Corresponding Source |
||||
includes interface definition files associated with source files for |
||||
the work, and the source code for shared libraries and dynamically |
||||
linked subprograms that the work is specifically designed to require, |
||||
such as by intimate data communication or control flow between those |
||||
subprograms and other parts of the work. |
||||
|
||||
The Corresponding Source need not include anything that users |
||||
can regenerate automatically from other parts of the Corresponding |
||||
Source. |
||||
|
||||
The Corresponding Source for a work in source code form is that |
||||
same work. |
||||
|
||||
2. Basic Permissions. |
||||
|
||||
All rights granted under this License are granted for the term of |
||||
copyright on the Program, and are irrevocable provided the stated |
||||
conditions are met. This License explicitly affirms your unlimited |
||||
permission to run the unmodified Program. The output from running a |
||||
covered work is covered by this License only if the output, given its |
||||
content, constitutes a covered work. This License acknowledges your |
||||
rights of fair use or other equivalent, as provided by copyright law. |
||||
|
||||
You may make, run and propagate covered works that you do not |
||||
convey, without conditions so long as your license otherwise remains |
||||
in force. You may convey covered works to others for the sole purpose |
||||
of having them make modifications exclusively for you, or provide you |
||||
with facilities for running those works, provided that you comply with |
||||
the terms of this License in conveying all material for which you do |
||||
not control copyright. Those thus making or running the covered works |
||||
for you must do so exclusively on your behalf, under your direction |
||||
and control, on terms that prohibit them from making any copies of |
||||
your copyrighted material outside their relationship with you. |
||||
|
||||
Conveying under any other circumstances is permitted solely under |
||||
the conditions stated below. Sublicensing is not allowed; section 10 |
||||
makes it unnecessary. |
||||
|
||||
3. Protecting Users' Legal Rights From Anti-Circumvention Law. |
||||
|
||||
No covered work shall be deemed part of an effective technological |
||||
measure under any applicable law fulfilling obligations under article |
||||
11 of the WIPO copyright treaty adopted on 20 December 1996, or |
||||
similar laws prohibiting or restricting circumvention of such |
||||
measures. |
||||
|
||||
When you convey a covered work, you waive any legal power to forbid |
||||
circumvention of technological measures to the extent such circumvention |
||||
is effected by exercising rights under this License with respect to |
||||
the covered work, and you disclaim any intention to limit operation or |
||||
modification of the work as a means of enforcing, against the work's |
||||
users, your or third parties' legal rights to forbid circumvention of |
||||
technological measures. |
||||
|
||||
4. Conveying Verbatim Copies. |
||||
|
||||
You may convey verbatim copies of the Program's source code as you |
||||
receive it, in any medium, provided that you conspicuously and |
||||
appropriately publish on each copy an appropriate copyright notice; |
||||
keep intact all notices stating that this License and any |
||||
non-permissive terms added in accord with section 7 apply to the code; |
||||
keep intact all notices of the absence of any warranty; and give all |
||||
recipients a copy of this License along with the Program. |
||||
|
||||
You may charge any price or no price for each copy that you convey, |
||||
and you may offer support or warranty protection for a fee. |
||||
|
||||
5. Conveying Modified Source Versions. |
||||
|
||||
You may convey a work based on the Program, or the modifications to |
||||
produce it from the Program, in the form of source code under the |
||||
terms of section 4, provided that you also meet all of these conditions: |
||||
|
||||
a) The work must carry prominent notices stating that you modified |
||||
it, and giving a relevant date. |
||||
|
||||
b) The work must carry prominent notices stating that it is |
||||
released under this License and any conditions added under section |
||||
7. This requirement modifies the requirement in section 4 to |
||||
"keep intact all notices". |
||||
|
||||
c) You must license the entire work, as a whole, under this |
||||
License to anyone who comes into possession of a copy. This |
||||
License will therefore apply, along with any applicable section 7 |
||||
additional terms, to the whole of the work, and all its parts, |
||||
regardless of how they are packaged. This License gives no |
||||
permission to license the work in any other way, but it does not |
||||
invalidate such permission if you have separately received it. |
||||
|
||||
d) If the work has interactive user interfaces, each must display |
||||
Appropriate Legal Notices; however, if the Program has interactive |
||||
interfaces that do not display Appropriate Legal Notices, your |
||||
work need not make them do so. |
||||
|
||||
A compilation of a covered work with other separate and independent |
||||
works, which are not by their nature extensions of the covered work, |
||||
and which are not combined with it such as to form a larger program, |
||||
in or on a volume of a storage or distribution medium, is called an |
||||
"aggregate" if the compilation and its resulting copyright are not |
||||
used to limit the access or legal rights of the compilation's users |
||||
beyond what the individual works permit. Inclusion of a covered work |
||||
in an aggregate does not cause this License to apply to the other |
||||
parts of the aggregate. |
||||
|
||||
6. Conveying Non-Source Forms. |
||||
|
||||
You may convey a covered work in object code form under the terms |
||||
of sections 4 and 5, provided that you also convey the |
||||
machine-readable Corresponding Source under the terms of this License, |
||||
in one of these ways: |
||||
|
||||
a) Convey the object code in, or embodied in, a physical product |
||||
(including a physical distribution medium), accompanied by the |
||||
Corresponding Source fixed on a durable physical medium |
||||
customarily used for software interchange. |
||||
|
||||
b) Convey the object code in, or embodied in, a physical product |
||||
(including a physical distribution medium), accompanied by a |
||||
written offer, valid for at least three years and valid for as |
||||
long as you offer spare parts or customer support for that product |
||||
model, to give anyone who possesses the object code either (1) a |
||||
copy of the Corresponding Source for all the software in the |
||||
product that is covered by this License, on a durable physical |
||||
medium customarily used for software interchange, for a price no |
||||
more than your reasonable cost of physically performing this |
||||
conveying of source, or (2) access to copy the |
||||
Corresponding Source from a network server at no charge. |
||||
|
||||
c) Convey individual copies of the object code with a copy of the |
||||
written offer to provide the Corresponding Source. This |
||||
alternative is allowed only occasionally and noncommercially, and |
||||
only if you received the object code with such an offer, in accord |
||||
with subsection 6b. |
||||
|
||||
d) Convey the object code by offering access from a designated |
||||
place (gratis or for a charge), and offer equivalent access to the |
||||
Corresponding Source in the same way through the same place at no |
||||
further charge. You need not require recipients to copy the |
||||
Corresponding Source along with the object code. If the place to |
||||
copy the object code is a network server, the Corresponding Source |
||||
may be on a different server (operated by you or a third party) |
||||
that supports equivalent copying facilities, provided you maintain |
||||
clear directions next to the object code saying where to find the |
||||
Corresponding Source. Regardless of what server hosts the |
||||
Corresponding Source, you remain obligated to ensure that it is |
||||
available for as long as needed to satisfy these requirements. |
||||
|
||||
e) Convey the object code using peer-to-peer transmission, provided |
||||
you inform other peers where the object code and Corresponding |
||||
Source of the work are being offered to the general public at no |
||||
charge under subsection 6d. |
||||
|
||||
A separable portion of the object code, whose source code is excluded |
||||
from the Corresponding Source as a System Library, need not be |
||||
included in conveying the object code work. |
||||
|
||||
A "User Product" is either (1) a "consumer product", which means any |
||||
tangible personal property which is normally used for personal, family, |
||||
or household purposes, or (2) anything designed or sold for incorporation |
||||
into a dwelling. In determining whether a product is a consumer product, |
||||
doubtful cases shall be resolved in favor of coverage. For a particular |
||||
product received by a particular user, "normally used" refers to a |
||||
typical or common use of that class of product, regardless of the status |
||||
of the particular user or of the way in which the particular user |
||||
actually uses, or expects or is expected to use, the product. A product |
||||
is a consumer product regardless of whether the product has substantial |
||||
commercial, industrial or non-consumer uses, unless such uses represent |
||||
the only significant mode of use of the product. |
||||
|
||||
"Installation Information" for a User Product means any methods, |
||||
procedures, authorization keys, or other information required to install |
||||
and execute modified versions of a covered work in that User Product from |
||||
a modified version of its Corresponding Source. The information must |
||||
suffice to ensure that the continued functioning of the modified object |
||||
code is in no case prevented or interfered with solely because |
||||
modification has been made. |
||||
|
||||
If you convey an object code work under this section in, or with, or |
||||
specifically for use in, a User Product, and the conveying occurs as |
||||
part of a transaction in which the right of possession and use of the |
||||
User Product is transferred to the recipient in perpetuity or for a |
||||
fixed term (regardless of how the transaction is characterized), the |
||||
Corresponding Source conveyed under this section must be accompanied |
||||
by the Installation Information. But this requirement does not apply |
||||
if neither you nor any third party retains the ability to install |
||||
modified object code on the User Product (for example, the work has |
||||
been installed in ROM). |
||||
|
||||
The requirement to provide Installation Information does not include a |
||||
requirement to continue to provide support service, warranty, or updates |
||||
for a work that has been modified or installed by the recipient, or for |
||||
the User Product in which it has been modified or installed. Access to a |
||||
network may be denied when the modification itself materially and |
||||
adversely affects the operation of the network or violates the rules and |
||||
protocols for communication across the network. |
||||
|
||||
Corresponding Source conveyed, and Installation Information provided, |
||||
in accord with this section must be in a format that is publicly |
||||
documented (and with an implementation available to the public in |
||||
source code form), and must require no special password or key for |
||||
unpacking, reading or copying. |
||||
|
||||
7. Additional Terms. |
||||
|
||||
"Additional permissions" are terms that supplement the terms of this |
||||
License by making exceptions from one or more of its conditions. |
||||
Additional permissions that are applicable to the entire Program shall |
||||
be treated as though they were included in this License, to the extent |
||||
that they are valid under applicable law. If additional permissions |
||||
apply only to part of the Program, that part may be used separately |
||||
under those permissions, but the entire Program remains governed by |
||||
this License without regard to the additional permissions. |
||||
|
||||
When you convey a copy of a covered work, you may at your option |
||||
remove any additional permissions from that copy, or from any part of |
||||
it. (Additional permissions may be written to require their own |
||||
removal in certain cases when you modify the work.) You may place |
||||
additional permissions on material, added by you to a covered work, |
||||
for which you have or can give appropriate copyright permission. |
||||
|
||||
Notwithstanding any other provision of this License, for material you |
||||
add to a covered work, you may (if authorized by the copyright holders of |
||||
that material) supplement the terms of this License with terms: |
||||
|
||||
a) Disclaiming warranty or limiting liability differently from the |
||||
terms of sections 15 and 16 of this License; or |
||||
|
||||
b) Requiring preservation of specified reasonable legal notices or |
||||
author attributions in that material or in the Appropriate Legal |
||||
Notices displayed by works containing it; or |
||||
|
||||
c) Prohibiting misrepresentation of the origin of that material, or |
||||
requiring that modified versions of such material be marked in |
||||
reasonable ways as different from the original version; or |
||||
|
||||
d) Limiting the use for publicity purposes of names of licensors or |
||||
authors of the material; or |
||||
|
||||
e) Declining to grant rights under trademark law for use of some |
||||
trade names, trademarks, or service marks; or |
||||
|
||||
f) Requiring indemnification of licensors and authors of that |
||||
material by anyone who conveys the material (or modified versions of |
||||
it) with contractual assumptions of liability to the recipient, for |
||||
any liability that these contractual assumptions directly impose on |
||||
those licensors and authors. |
||||
|
||||
All other non-permissive additional terms are considered "further |
||||
restrictions" within the meaning of section 10. If the Program as you |
||||
received it, or any part of it, contains a notice stating that it is |
||||
governed by this License along with a term that is a further |
||||
restriction, you may remove that term. If a license document contains |
||||
a further restriction but permits relicensing or conveying under this |
||||
License, you may add to a covered work material governed by the terms |
||||
of that license document, provided that the further restriction does |
||||
not survive such relicensing or conveying. |
||||
|
||||
If you add terms to a covered work in accord with this section, you |
||||
must place, in the relevant source files, a statement of the |
||||
additional terms that apply to those files, or a notice indicating |
||||
where to find the applicable terms. |
||||
|
||||
Additional terms, permissive or non-permissive, may be stated in the |
||||
form of a separately written license, or stated as exceptions; |
||||
the above requirements apply either way. |
||||
|
||||
8. Termination. |
||||
|
||||
You may not propagate or modify a covered work except as expressly |
||||
provided under this License. Any attempt otherwise to propagate or |
||||
modify it is void, and will automatically terminate your rights under |
||||
this License (including any patent licenses granted under the third |
||||
paragraph of section 11). |
||||
|
||||
However, if you cease all violation of this License, then your |
||||
license from a particular copyright holder is reinstated (a) |
||||
provisionally, unless and until the copyright holder explicitly and |
||||
finally terminates your license, and (b) permanently, if the copyright |
||||
holder fails to notify you of the violation by some reasonable means |
||||
prior to 60 days after the cessation. |
||||
|
||||
Moreover, your license from a particular copyright holder is |
||||
reinstated permanently if the copyright holder notifies you of the |
||||
violation by some reasonable means, this is the first time you have |
||||
received notice of violation of this License (for any work) from that |
||||
copyright holder, and you cure the violation prior to 30 days after |
||||
your receipt of the notice. |
||||
|
||||
Termination of your rights under this section does not terminate the |
||||
licenses of parties who have received copies or rights from you under |
||||
this License. If your rights have been terminated and not permanently |
||||
reinstated, you do not qualify to receive new licenses for the same |
||||
material under section 10. |
||||
|
||||
9. Acceptance Not Required for Having Copies. |
||||
|
||||
You are not required to accept this License in order to receive or |
||||
run a copy of the Pro | ||||