MISP
/
misp-modules
mirror of https://github.com/MISP/misp-modules
2
0
Fork 0
Code Issues Releases Wiki Activity

chg:[doc] update mmdb_lookup documentation

pull/556/head
Jeroen Pinoy 2022-02-23 00:54:13 +01:00
parent 0775769714
commit c5a9a97354
No known key found for this signature in database
GPG Key ID: DF33A50B8E4EE081
2 changed files with 12 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
documentation/website/expansion/mmdb_lookup.json Normal file
View File

@ -0,0 +1,11 @@
{
"description": "A hover and expansion module to enrich an ip with geolocation and ASN information from an mmdb server instance, such as CIRCL's ip.circl.lu.",
"logo": "circl.png",
"input": "An IP address attribute (for example ip-src or ip-src|port).",
"output": "Geolocation and asn objects.",
"references": [
"https://data.public.lu/fr/datasets/geo-open-ip-address-geolocation-per-country-in-mmdb-format/",
"https://github.com/adulau/mmdb-server"
],
"features": "The module takes an IP address related attribute as input.\n It queries the public CIRCL.lu mmdb-server instance, available at ip.circl.lu, by default. The module can be configured with a custom mmdb server url if required.\n It is also possible to filter results on 1 db_source by configuring db_source_filter."
}

2
misp_modules/modules/expansion/mmdb_lookup.py
View File

@ -6,7 +6,7 @@ from pymisp import MISPEvent, MISPObject
misperrors = {'error': 'Error'}
mispattributes = {'input': ['ip-src', 'ip-src|port', 'ip-dst', 'ip-dst|port'], 'format': 'misp_standard'}
moduleinfo = {'version': '1', 'author': 'Jeroen Pinoy',
'description': "An expansion module to enrich an ip with geolocation information from an mmdb server "
'description': "An expansion module to enrich an ip with geolocation and asn information from an mmdb server "
"such as ip.circl.lu.",
'module-type': ['expansion', 'hover']}
moduleconfig = ["custom_API", "db_source_filter"]