mirror of https://github.com/MISP/misp-modules
fix: Typo for separator between each explained module
parent
7704591a5a
commit
fc70136312
|
@ -21,6 +21,6 @@ for _path, title in zip(module_types, titles):
|
||||||
if value:
|
if value:
|
||||||
value = ', '.join(value) if isinstance(value, list) else '{}'.format(value.replace('\n', '\n>'))
|
value = ', '.join(value) if isinstance(value, list) else '{}'.format(value.replace('\n', '\n>'))
|
||||||
markdown.append('- **{}**:\n>{}\n'.format(field, value))
|
markdown.append('- **{}**:\n>{}\n'.format(field, value))
|
||||||
# markdown.append('\n')
|
markdown.append('\n-----\n')
|
||||||
with open('markdown.md', 'w') as w:
|
with open('markdown.md', 'w') as w:
|
||||||
w.write(''.join(markdown))
|
w.write(''.join(markdown))
|
||||||
|
|
|
@ -6,130 +6,190 @@
|
||||||
|
|
||||||
Module to query a local copy of Maxminds Geolite database.
|
Module to query a local copy of Maxminds Geolite database.
|
||||||
|
|
||||||
|
-----
|
||||||
|
|
||||||
### iprep
|
### iprep
|
||||||
|
|
||||||
Module to query IPRep data for IP addresses.
|
Module to query IPRep data for IP addresses.
|
||||||
|
|
||||||
|
-----
|
||||||
|
|
||||||
### crowdstrike_falcon
|
### crowdstrike_falcon
|
||||||
|
|
||||||
Module to query Crowdstrike Falcon.
|
Module to query Crowdstrike Falcon.
|
||||||
|
|
||||||
|
-----
|
||||||
|
|
||||||
### dns
|
### dns
|
||||||
|
|
||||||
A simple DNS expansion service to resolve IP address from MISP attributes.
|
A simple DNS expansion service to resolve IP address from MISP attributes.
|
||||||
|
|
||||||
|
-----
|
||||||
|
|
||||||
### vulndb
|
### vulndb
|
||||||
|
|
||||||
Module to query VulnDB (RiskBasedSecurity.com).
|
Module to query VulnDB (RiskBasedSecurity.com).
|
||||||
|
|
||||||
|
-----
|
||||||
|
|
||||||
### wiki
|
### wiki
|
||||||
|
|
||||||
An expansion hover module to extract information from Wikidata to have additional information about particular term for analysis.
|
An expansion hover module to extract information from Wikidata to have additional information about particular term for analysis.
|
||||||
|
|
||||||
|
-----
|
||||||
|
|
||||||
### rbl
|
### rbl
|
||||||
|
|
||||||
Module to check an IPv4 address against known RBLs.
|
Module to check an IPv4 address against known RBLs.
|
||||||
- **requirements**:
|
- **requirements**:
|
||||||
>dnspython3
|
>dnspython3
|
||||||
|
|
||||||
|
-----
|
||||||
|
|
||||||
### asn_history
|
### asn_history
|
||||||
|
|
||||||
Query an ASN description history service (https://github.com/CIRCL/ASN-Description-History.git).
|
Query an ASN description history service (https://github.com/CIRCL/ASN-Description-History.git).
|
||||||
- **requirements**:
|
- **requirements**:
|
||||||
>asnhistory
|
>asnhistory
|
||||||
|
|
||||||
|
-----
|
||||||
|
|
||||||
### circl_passivedns
|
### circl_passivedns
|
||||||
|
|
||||||
Module to access CIRCL Passive DNS.
|
Module to access CIRCL Passive DNS.
|
||||||
|
|
||||||
|
-----
|
||||||
|
|
||||||
### farsight_passivedns
|
### farsight_passivedns
|
||||||
|
|
||||||
Module to access Farsight DNSDB Passive DNS.
|
Module to access Farsight DNSDB Passive DNS.
|
||||||
|
|
||||||
|
-----
|
||||||
|
|
||||||
### whois
|
### whois
|
||||||
|
|
||||||
Module to query a local instance of uwhois (https://github.com/rafiot/uwhoisd).
|
Module to query a local instance of uwhois (https://github.com/rafiot/uwhoisd).
|
||||||
- **requirements**:
|
- **requirements**:
|
||||||
>uwhois
|
>uwhois
|
||||||
|
|
||||||
|
-----
|
||||||
|
|
||||||
### threatcrowd
|
### threatcrowd
|
||||||
|
|
||||||
Module to get information from ThreatCrowd.
|
Module to get information from ThreatCrowd.
|
||||||
|
|
||||||
|
-----
|
||||||
|
|
||||||
### domaintools
|
### domaintools
|
||||||
|
|
||||||
DomainTools MISP expansion module.
|
DomainTools MISP expansion module.
|
||||||
|
|
||||||
|
-----
|
||||||
|
|
||||||
### eupi
|
### eupi
|
||||||
|
|
||||||
A module to query the Phishing Initiative service (https://phishing-initiative.lu).
|
A module to query the Phishing Initiative service (https://phishing-initiative.lu).
|
||||||
|
|
||||||
|
-----
|
||||||
|
|
||||||
### shodan
|
### shodan
|
||||||
|
|
||||||
Module to query on Shodan.
|
Module to query on Shodan.
|
||||||
|
|
||||||
|
-----
|
||||||
|
|
||||||
### xforceexchange
|
### xforceexchange
|
||||||
|
|
||||||
An expansion module for IBM X-Force Exchange.
|
An expansion module for IBM X-Force Exchange.
|
||||||
|
|
||||||
|
-----
|
||||||
|
|
||||||
### circl_passivessl
|
### circl_passivessl
|
||||||
|
|
||||||
Modules to access CIRCL Passive SSL.
|
Modules to access CIRCL Passive SSL.
|
||||||
|
|
||||||
|
-----
|
||||||
|
|
||||||
### virustotal
|
### virustotal
|
||||||
|
|
||||||
Module to get information from virustotal.
|
Module to get information from virustotal.
|
||||||
|
|
||||||
|
-----
|
||||||
|
|
||||||
### otx
|
### otx
|
||||||
|
|
||||||
Module to get information from AlienVault OTX.
|
Module to get information from AlienVault OTX.
|
||||||
|
|
||||||
|
-----
|
||||||
|
|
||||||
### cve
|
### cve
|
||||||
|
|
||||||
An expansion hover module to expand information about CVE id.
|
An expansion hover module to expand information about CVE id.
|
||||||
|
|
||||||
|
-----
|
||||||
|
|
||||||
### reversedns
|
### reversedns
|
||||||
|
|
||||||
Simple Reverse DNS expansion service to resolve reverse DNS from MISP attributes.
|
Simple Reverse DNS expansion service to resolve reverse DNS from MISP attributes.
|
||||||
|
|
||||||
|
-----
|
||||||
|
|
||||||
### threatminer
|
### threatminer
|
||||||
|
|
||||||
Module to get information from ThreatMiner.
|
Module to get information from ThreatMiner.
|
||||||
|
|
||||||
|
-----
|
||||||
|
|
||||||
### sourcecache
|
### sourcecache
|
||||||
|
|
||||||
Module to cache web pages of analysis reports, OSINT sources. The module returns a link of the cached page.
|
Module to cache web pages of analysis reports, OSINT sources. The module returns a link of the cached page.
|
||||||
|
|
||||||
|
-----
|
||||||
|
|
||||||
### ipasn
|
### ipasn
|
||||||
|
|
||||||
Module to query an IP ASN history service (https://github.com/CIRCL/IP-ASN-history.git).
|
Module to query an IP ASN history service (https://github.com/CIRCL/IP-ASN-history.git).
|
||||||
|
|
||||||
|
-----
|
||||||
|
|
||||||
### intelmq_eventdb
|
### intelmq_eventdb
|
||||||
|
|
||||||
Module to access intelmqs eventdb.
|
Module to access intelmqs eventdb.
|
||||||
|
|
||||||
|
-----
|
||||||
|
|
||||||
### vmray_submit
|
### vmray_submit
|
||||||
|
|
||||||
Module to submit a sample to VMRay.
|
Module to submit a sample to VMRay.
|
||||||
|
|
||||||
|
-----
|
||||||
|
|
||||||
### countrycode
|
### countrycode
|
||||||
|
|
||||||
Module to expand country codes.
|
Module to expand country codes.
|
||||||
|
|
||||||
|
-----
|
||||||
|
|
||||||
### passivetotal
|
### passivetotal
|
||||||
|
|
||||||
The PassiveTotal MISP expansion module brings the datasets derived from Internet scanning directly into your MISP instance. This module supports passive DNS, historic SSL, WHOIS, and host attributes. In order to use the module, you must have a valid PassiveTotal account username and API key. Registration is free and can be done by visiting https://www.passivetotal.org/register
|
The PassiveTotal MISP expansion module brings the datasets derived from Internet scanning directly into your MISP instance. This module supports passive DNS, historic SSL, WHOIS, and host attributes. In order to use the module, you must have a valid PassiveTotal account username and API key. Registration is free and can be done by visiting https://www.passivetotal.org/register
|
||||||
|
|
||||||
|
-----
|
||||||
|
|
||||||
### yara_syntax_validator
|
### yara_syntax_validator
|
||||||
|
|
||||||
An expansion hover module to perform a syntax check on if yara rules are valid or not.
|
An expansion hover module to perform a syntax check on if yara rules are valid or not.
|
||||||
|
|
||||||
|
-----
|
||||||
|
|
||||||
## Export Modules
|
## Export Modules
|
||||||
|
|
||||||
### testexport
|
### testexport
|
||||||
|
|
||||||
Skeleton export module.
|
Skeleton export module.
|
||||||
|
|
||||||
|
-----
|
||||||
|
|
||||||
### goamlexport
|
### goamlexport
|
||||||
|
|
||||||
This module is used to export MISP events containing transaction objects into GoAML format.
|
This module is used to export MISP events containing transaction objects into GoAML format.
|
||||||
|
@ -161,6 +221,8 @@ This module is used to export MISP events containing transaction objects into Go
|
||||||
- **output**:
|
- **output**:
|
||||||
>GoAML format file, describing financial transactions, with their origin and target (bank accounts, persons or entities).
|
>GoAML format file, describing financial transactions, with their origin and target (bank accounts, persons or entities).
|
||||||
|
|
||||||
|
-----
|
||||||
|
|
||||||
### threatStream_misp_export
|
### threatStream_misp_export
|
||||||
|
|
||||||
Module to export a structured CSV file for uploading to threatStream.
|
Module to export a structured CSV file for uploading to threatStream.
|
||||||
|
@ -175,6 +237,8 @@ Module to export a structured CSV file for uploading to threatStream.
|
||||||
- **output**:
|
- **output**:
|
||||||
>ThreatStream CSV format file
|
>ThreatStream CSV format file
|
||||||
|
|
||||||
|
-----
|
||||||
|
|
||||||
### threat_connect_export
|
### threat_connect_export
|
||||||
|
|
||||||
Module to export a structured CSV file for uploading to ThreatConnect.
|
Module to export a structured CSV file for uploading to ThreatConnect.
|
||||||
|
@ -190,6 +254,8 @@ Module to export a structured CSV file for uploading to ThreatConnect.
|
||||||
- **output**:
|
- **output**:
|
||||||
>ThreatConnect CSV format file
|
>ThreatConnect CSV format file
|
||||||
|
|
||||||
|
-----
|
||||||
|
|
||||||
### pdfexport
|
### pdfexport
|
||||||
|
|
||||||
Simple export of a MISP event to PDF.
|
Simple export of a MISP event to PDF.
|
||||||
|
@ -204,6 +270,8 @@ Simple export of a MISP event to PDF.
|
||||||
- **output**:
|
- **output**:
|
||||||
>MISP Event in a PDF file.
|
>MISP Event in a PDF file.
|
||||||
|
|
||||||
|
-----
|
||||||
|
|
||||||
### cef_export
|
### cef_export
|
||||||
|
|
||||||
Module to export a MISP event in CEF format.
|
Module to export a MISP event in CEF format.
|
||||||
|
@ -217,6 +285,8 @@ Module to export a MISP event in CEF format.
|
||||||
- **output**:
|
- **output**:
|
||||||
>Common Event Format file
|
>Common Event Format file
|
||||||
|
|
||||||
|
-----
|
||||||
|
|
||||||
### liteexport
|
### liteexport
|
||||||
|
|
||||||
Lite export of a MISP event.
|
Lite export of a MISP event.
|
||||||
|
@ -227,6 +297,8 @@ Lite export of a MISP event.
|
||||||
- **output**:
|
- **output**:
|
||||||
>Lite MISP Event
|
>Lite MISP Event
|
||||||
|
|
||||||
|
-----
|
||||||
|
|
||||||
## Import Modules
|
## Import Modules
|
||||||
|
|
||||||
### vmray_import
|
### vmray_import
|
||||||
|
@ -244,6 +316,8 @@ Module to import VMRay (VTI) results.
|
||||||
- **output**:
|
- **output**:
|
||||||
>MISP Event attributes
|
>MISP Event attributes
|
||||||
|
|
||||||
|
-----
|
||||||
|
|
||||||
### threatanalyzer_import
|
### threatanalyzer_import
|
||||||
|
|
||||||
Module to import ThreatAnalyzer archive.zip / analysis.json files.
|
Module to import ThreatAnalyzer archive.zip / analysis.json files.
|
||||||
|
@ -257,6 +331,8 @@ Module to import ThreatAnalyzer archive.zip / analysis.json files.
|
||||||
- **output**:
|
- **output**:
|
||||||
>MISP Event attributes
|
>MISP Event attributes
|
||||||
|
|
||||||
|
-----
|
||||||
|
|
||||||
### ocr
|
### ocr
|
||||||
|
|
||||||
Optical Character Recognition (OCR) module for MISP.
|
Optical Character Recognition (OCR) module for MISP.
|
||||||
|
@ -267,6 +343,8 @@ Optical Character Recognition (OCR) module for MISP.
|
||||||
- **output**:
|
- **output**:
|
||||||
>freetext MISP attribute
|
>freetext MISP attribute
|
||||||
|
|
||||||
|
-----
|
||||||
|
|
||||||
### csvimport
|
### csvimport
|
||||||
|
|
||||||
Module to import MISP attributes from a csv file.
|
Module to import MISP attributes from a csv file.
|
||||||
|
@ -286,6 +364,8 @@ Module to import MISP attributes from a csv file.
|
||||||
- **output**:
|
- **output**:
|
||||||
>MISP Event attributes
|
>MISP Event attributes
|
||||||
|
|
||||||
|
-----
|
||||||
|
|
||||||
### goamlimport
|
### goamlimport
|
||||||
|
|
||||||
Module to import MISP objects about financial transactions from GoAML files.
|
Module to import MISP objects about financial transactions from GoAML files.
|
||||||
|
@ -300,6 +380,8 @@ Module to import MISP objects about financial transactions from GoAML files.
|
||||||
- **output**:
|
- **output**:
|
||||||
>MISP objects (transaction, bank-account, person, legal-entity, geolocation), with references, describing financial transactions and their origin and target.
|
>MISP objects (transaction, bank-account, person, legal-entity, geolocation), with references, describing financial transactions and their origin and target.
|
||||||
|
|
||||||
|
-----
|
||||||
|
|
||||||
### cuckooimport
|
### cuckooimport
|
||||||
|
|
||||||
Module to import Cuckoo JSON.
|
Module to import Cuckoo JSON.
|
||||||
|
@ -312,6 +394,8 @@ Module to import Cuckoo JSON.
|
||||||
- **output**:
|
- **output**:
|
||||||
>MISP Event attributes
|
>MISP Event attributes
|
||||||
|
|
||||||
|
-----
|
||||||
|
|
||||||
### email_import
|
### email_import
|
||||||
|
|
||||||
Module to import emails in MISP.
|
Module to import emails in MISP.
|
||||||
|
@ -323,6 +407,8 @@ Module to import emails in MISP.
|
||||||
- **output**:
|
- **output**:
|
||||||
>MISP Event attributes
|
>MISP Event attributes
|
||||||
|
|
||||||
|
-----
|
||||||
|
|
||||||
### mispjson
|
### mispjson
|
||||||
|
|
||||||
Module to import MISP JSON format for merging MISP events.
|
Module to import MISP JSON format for merging MISP events.
|
||||||
|
@ -333,6 +419,8 @@ Module to import MISP JSON format for merging MISP events.
|
||||||
- **output**:
|
- **output**:
|
||||||
>MISP Event attributes
|
>MISP Event attributes
|
||||||
|
|
||||||
|
-----
|
||||||
|
|
||||||
### openiocimport
|
### openiocimport
|
||||||
|
|
||||||
Module to import OpenIOC packages.
|
Module to import OpenIOC packages.
|
||||||
|
@ -346,3 +434,5 @@ Module to import OpenIOC packages.
|
||||||
>OpenIOC packages
|
>OpenIOC packages
|
||||||
- **output**:
|
- **output**:
|
||||||
>MISP Event attributes
|
>MISP Event attributes
|
||||||
|
|
||||||
|
-----
|
||||||
|
|
Loading…
Reference in New Issue