mirror of https://github.com/MISP/misp-modules
Add more relations and attributes to VT modules
parent
8f3cc42082
commit
d08bb5c365
|
@ -64,11 +64,13 @@ class VirusTotalParser:
|
||||||
def create_misp_object(self, report: vt.Object) -> MISPObject:
|
def create_misp_object(self, report: vt.Object) -> MISPObject:
|
||||||
misp_object = None
|
misp_object = None
|
||||||
vt_uuid = self.add_vt_report(report)
|
vt_uuid = self.add_vt_report(report)
|
||||||
|
|
||||||
if report.type == 'file':
|
if report.type == 'file':
|
||||||
misp_object = MISPObject('file')
|
misp_object = MISPObject('file')
|
||||||
for hash_type in ('md5', 'sha1', 'sha256'):
|
for hash_type in ('md5', 'sha1', 'sha256', 'tlsh',
|
||||||
misp_object.add_attribute(**{'type': hash_type,
|
'vhash', 'ssdeep', 'imphash'):
|
||||||
'object_relation': hash_type,
|
misp_object.add_attribute(hash_type,
|
||||||
|
**{'type': hash_type,
|
||||||
'value': report.get(hash_type)})
|
'value': report.get(hash_type)})
|
||||||
elif report.type == 'domain':
|
elif report.type == 'domain':
|
||||||
misp_object = MISPObject('domain-ip')
|
misp_object = MISPObject('domain-ip')
|
||||||
|
@ -135,8 +137,28 @@ class VirusTotalParser:
|
||||||
return domain_object.uuid
|
return domain_object.uuid
|
||||||
|
|
||||||
def parse_hash(self, file_hash: str) -> str:
|
def parse_hash(self, file_hash: str) -> str:
|
||||||
file_report = self.client.get_object(f'files/{file_hash}')
|
file_report = self.client.get_object(f'/files/{file_hash}')
|
||||||
file_object = self.create_misp_object(file_report)
|
file_object = self.create_misp_object(file_report)
|
||||||
|
|
||||||
|
# ITW URLS
|
||||||
|
urls_iterator = self.client.iterator(f'/files/{file_report.id}/itw_urls', limit=self.limit)
|
||||||
|
for url in urls_iterator:
|
||||||
|
url_object = self.create_misp_object(url)
|
||||||
|
url_object.add_reference(file_object.uuid, 'downloaded')
|
||||||
|
self.misp_event.add_object(**url_object)
|
||||||
|
|
||||||
|
# COMMUNICATING, DOWNLOADED AND REFERRER FILES
|
||||||
|
for relationship_name, misp_name in [
|
||||||
|
('contacted_urls', 'communicates-with'),
|
||||||
|
('contacted_domains', 'communicates-with'),
|
||||||
|
('contacted_ips', 'communicates-with')
|
||||||
|
]:
|
||||||
|
files_iterator = self.client.iterator(f'/files/{file_report.id}/{relationship_name}', limit=self.limit)
|
||||||
|
for file in files_iterator:
|
||||||
|
file_object = self.create_misp_object(file)
|
||||||
|
file_object.add_reference(file_object.uuid, misp_name)
|
||||||
|
self.misp_event.add_object(**file_object)
|
||||||
|
|
||||||
self.misp_event.add_object(**file_object)
|
self.misp_event.add_object(**file_object)
|
||||||
return file_object.uuid
|
return file_object.uuid
|
||||||
|
|
||||||
|
@ -172,6 +194,19 @@ class VirusTotalParser:
|
||||||
url_id = vt.url_id(url)
|
url_id = vt.url_id(url)
|
||||||
url_report = self.client.get_object(f'/urls/{url_id}')
|
url_report = self.client.get_object(f'/urls/{url_id}')
|
||||||
url_object = self.create_misp_object(url_report)
|
url_object = self.create_misp_object(url_report)
|
||||||
|
|
||||||
|
# COMMUNICATING, DOWNLOADED AND REFERRER FILES
|
||||||
|
for relationship_name, misp_name in [
|
||||||
|
('communicating_files', 'communicates-with'),
|
||||||
|
('downloaded_files', 'downloaded-from'),
|
||||||
|
('referrer_files', 'referring')
|
||||||
|
]:
|
||||||
|
files_iterator = self.client.iterator(f'/urls/{url_report.id}/{relationship_name}', limit=self.limit)
|
||||||
|
for file in files_iterator:
|
||||||
|
file_object = self.create_misp_object(file)
|
||||||
|
file_object.add_reference(url_object.uuid, misp_name)
|
||||||
|
self.misp_event.add_object(**file_object)
|
||||||
|
|
||||||
self.misp_event.add_object(**url_object)
|
self.misp_event.add_object(**url_object)
|
||||||
return url_object.uuid
|
return url_object.uuid
|
||||||
|
|
||||||
|
|
|
@ -67,7 +67,8 @@ class VirusTotalParser:
|
||||||
vt_uuid = self.add_vt_report(report)
|
vt_uuid = self.add_vt_report(report)
|
||||||
if report.type == 'file':
|
if report.type == 'file':
|
||||||
misp_object = MISPObject('file')
|
misp_object = MISPObject('file')
|
||||||
for hash_type in ('md5', 'sha1', 'sha256'):
|
for hash_type in ('md5', 'sha1', 'sha256', 'tlsh',
|
||||||
|
'vhash', 'ssdeep', 'imphash'):
|
||||||
misp_object.add_attribute(**{'type': hash_type,
|
misp_object.add_attribute(**{'type': hash_type,
|
||||||
'object_relation': hash_type,
|
'object_relation': hash_type,
|
||||||
'value': report.get(hash_type)})
|
'value': report.get(hash_type)})
|
||||||
|
@ -128,8 +129,21 @@ class VirusTotalParser:
|
||||||
return domain_object.uuid
|
return domain_object.uuid
|
||||||
|
|
||||||
def parse_hash(self, file_hash: str) -> str:
|
def parse_hash(self, file_hash: str) -> str:
|
||||||
file_report = self.client.get_object(f'files/{file_hash}')
|
file_report = self.client.get_object(f'/files/{file_hash}')
|
||||||
file_object = self.create_misp_object(file_report)
|
file_object = self.create_misp_object(file_report)
|
||||||
|
|
||||||
|
# COMMUNICATING, DOWNLOADED AND REFERRER FILES
|
||||||
|
for relationship_name, misp_name in [
|
||||||
|
('contacted_urls', 'communicates-with'),
|
||||||
|
('contacted_domains', 'communicates-with'),
|
||||||
|
('contacted_ips', 'communicates-with')
|
||||||
|
]:
|
||||||
|
files_iterator = self.client.iterator(f'/files/{file_report.id}/{relationship_name}', limit=self.limit)
|
||||||
|
for file in files_iterator:
|
||||||
|
file_object = self.create_misp_object(file)
|
||||||
|
file_object.add_reference(file_object.uuid, misp_name)
|
||||||
|
self.misp_event.add_object(**file_object)
|
||||||
|
|
||||||
self.misp_event.add_object(**file_object)
|
self.misp_event.add_object(**file_object)
|
||||||
return file_object.uuid
|
return file_object.uuid
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue