MISP
/
misp-modules
mirror of https://github.com/MISP/misp-modules
2
0
Fork 0
Code Issues Releases Wiki Activity

fix: [ipasn] add support for `ip` type

pull/667/head
Alexandre Dulaunoy 2024-06-06 09:54:20 +02:00
parent 55d63f804a
commit cd435c0565
No known key found for this signature in database
GPG Key ID: 09E2CD4944E6CBCD
1 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
misp_modules/modules/expansion/ipasn.py
View File

@ -6,10 +6,8 @@ from pyipasnhistory import IPASNHistory
from pymisp import MISPAttribute, MISPEvent, MISPObject from pymisp import MISPAttribute, MISPEvent, MISPObject
misperrors = {'error': 'Error'} misperrors = {'error': 'Error'}
mispattributes = {'input': ['ip-src', 'ip-dst'], 'format': 'misp_standard'} mispattributes = {'input': ['ip-src', 'ip-dst', 'ip'], 'format': 'misp_standard'}
moduleinfo = {'version': '0.2', 'author': 'Raphaël Vinot', moduleinfo = {'version': '0.3', 'author': 'Raphaël Vinot', 'description': 'Query an IP ASN history service (https://github.com/D4-project/IPASN-History?tab=readme-ov-file)', 'module-type': ['expansion', 'hover']}
'description': 'Query an IP ASN history service (https://github.com/CIRCL/IP-ASN-history.git)',
'module-type': ['expansion', 'hover']}
def parse_result(attribute, values): def parse_result(attribute, values):
@ -18,7 +16,6 @@ def parse_result(attribute, values):
initial_attribute.from_dict(**attribute) initial_attribute.from_dict(**attribute)
event.add_attribute(**initial_attribute) event.add_attribute(**initial_attribute)
mapping = {'asn': ('AS', 'asn'), 'prefix': ('ip-src', 'subnet-announced')} mapping = {'asn': ('AS', 'asn'), 'prefix': ('ip-src', 'subnet-announced')}
print(values)
for last_seen, response in values['response'].items(): for last_seen, response in values['response'].items():
asn = MISPObject('asn') asn = MISPObject('asn')
asn.add_attribute('last-seen', **{'type': 'datetime', 'value': last_seen}) asn.add_attribute('last-seen', **{'type': 'datetime', 'value': last_seen})
@ -39,6 +36,9 @@ def handler(q=False):
return {'error': f'{standard_error_message}, which should contain at least a type, a value and an uuid.'} return {'error': f'{standard_error_message}, which should contain at least a type, a value and an uuid.'}
if request['attribute']['type'] not in mispattributes['input']: if request['attribute']['type'] not in mispattributes['input']:
return {'error': 'Unsupported attribute type.'} return {'error': 'Unsupported attribute type.'}
if request['attribute']['type'] == 'ip':
request['attribute']['type'] = 'ip-src'
toquery = request['attribute']['value'] toquery = request['attribute']['value']
ipasn = IPASNHistory() ipasn = IPASNHistory()