mirror of https://github.com/MISP/misp-modules
Merge pull request #406 from JakubOnderka/ip-port
new: [passivedns, passivessl] Add support for ip-src|port and ip-dst|portpull/407/head
commit
ddf51d482a
|
@ -2,7 +2,7 @@ import json
|
||||||
import pypdns
|
import pypdns
|
||||||
from pymisp import MISPAttribute, MISPEvent, MISPObject
|
from pymisp import MISPAttribute, MISPEvent, MISPObject
|
||||||
|
|
||||||
mispattributes = {'input': ['hostname', 'domain', 'ip-src', 'ip-dst'], 'format': 'misp_standard'}
|
mispattributes = {'input': ['hostname', 'domain', 'ip-src', 'ip-dst', 'ip-src|port', 'ip-dst|port'], 'format': 'misp_standard'}
|
||||||
moduleinfo = {'version': '0.2', 'author': 'Alexandre Dulaunoy',
|
moduleinfo = {'version': '0.2', 'author': 'Alexandre Dulaunoy',
|
||||||
'description': 'Module to access CIRCL Passive DNS',
|
'description': 'Module to access CIRCL Passive DNS',
|
||||||
'module-type': ['expansion', 'hover']}
|
'module-type': ['expansion', 'hover']}
|
||||||
|
@ -24,9 +24,11 @@ class PassiveDNSParser():
|
||||||
results = {key: event[key] for key in ('Attribute', 'Object')}
|
results = {key: event[key] for key in ('Attribute', 'Object')}
|
||||||
return {'results': results}
|
return {'results': results}
|
||||||
|
|
||||||
def parse(self, value):
|
def parse(self):
|
||||||
|
value = self.attribute.value.split('|')[0] if '|' in self.attribute.type else self.attribute.value
|
||||||
|
|
||||||
try:
|
try:
|
||||||
results = self.pdns.query(self.attribute.value)
|
results = self.pdns.query(value)
|
||||||
except Exception:
|
except Exception:
|
||||||
self.result = {'error': 'There is an authentication error, please make sure you supply correct credentials.'}
|
self.result = {'error': 'There is an authentication error, please make sure you supply correct credentials.'}
|
||||||
return
|
return
|
||||||
|
@ -62,7 +64,7 @@ def handler(q=False):
|
||||||
if not any(input_type == attribute['type'] for input_type in mispattributes['input']):
|
if not any(input_type == attribute['type'] for input_type in mispattributes['input']):
|
||||||
return {'error': 'Unsupported attributes type'}
|
return {'error': 'Unsupported attributes type'}
|
||||||
pdns_parser = PassiveDNSParser(attribute, authentication)
|
pdns_parser = PassiveDNSParser(attribute, authentication)
|
||||||
pdns_parser.parse(attribute['value'])
|
pdns_parser.parse()
|
||||||
return pdns_parser.get_results()
|
return pdns_parser.get_results()
|
||||||
|
|
||||||
|
|
||||||
|
|
|
@ -2,7 +2,7 @@ import json
|
||||||
import pypssl
|
import pypssl
|
||||||
from pymisp import MISPAttribute, MISPEvent, MISPObject
|
from pymisp import MISPAttribute, MISPEvent, MISPObject
|
||||||
|
|
||||||
mispattributes = {'input': ['ip-src', 'ip-dst'], 'format': 'misp_standard'}
|
mispattributes = {'input': ['ip-src', 'ip-dst', 'ip-src|port', 'ip-dst|port'], 'format': 'misp_standard'}
|
||||||
moduleinfo = {'version': '0.2', 'author': 'Raphaël Vinot',
|
moduleinfo = {'version': '0.2', 'author': 'Raphaël Vinot',
|
||||||
'description': 'Module to access CIRCL Passive SSL',
|
'description': 'Module to access CIRCL Passive SSL',
|
||||||
'module-type': ['expansion', 'hover']}
|
'module-type': ['expansion', 'hover']}
|
||||||
|
@ -31,9 +31,11 @@ class PassiveSSLParser():
|
||||||
results = {key: event[key] for key in ('Attribute', 'Object')}
|
results = {key: event[key] for key in ('Attribute', 'Object')}
|
||||||
return {'results': results}
|
return {'results': results}
|
||||||
|
|
||||||
def parse(self, value):
|
def parse(self):
|
||||||
|
value = self.attribute.value.split('|')[0] if '|' in self.attribute.type else self.attribute.value
|
||||||
|
|
||||||
try:
|
try:
|
||||||
results = self.pssl.query(self.attribute.value)
|
results = self.pssl.query(value)
|
||||||
except Exception:
|
except Exception:
|
||||||
self.result = {'error': 'There is an authentication error, please make sure you supply correct credentials.'}
|
self.result = {'error': 'There is an authentication error, please make sure you supply correct credentials.'}
|
||||||
return
|
return
|
||||||
|
@ -83,7 +85,7 @@ def handler(q=False):
|
||||||
if not any(input_type == attribute['type'] for input_type in mispattributes['input']):
|
if not any(input_type == attribute['type'] for input_type in mispattributes['input']):
|
||||||
return {'error': 'Unsupported attributes type'}
|
return {'error': 'Unsupported attributes type'}
|
||||||
pssl_parser = PassiveSSLParser(attribute, authentication)
|
pssl_parser = PassiveSSLParser(attribute, authentication)
|
||||||
pssl_parser.parse(attribute['value'])
|
pssl_parser.parse()
|
||||||
return pssl_parser.get_results()
|
return pssl_parser.get_results()
|
||||||
|
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue