MISP
/
misp-modules
mirror of https://github.com/MISP/misp-modules
2
0
Fork 0
Code Issues Releases Wiki Activity

fix: [crowdsec] set default version and expansion added

pull/613/head
Alexandre Dulaunoy 2023-05-11 15:18:26 +02:00
parent c1168ac627
commit fe778dd576
No known key found for this signature in database
GPG Key ID: 09E2CD4944E6CBCD
1 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
misp_modules/modules/expansion/crowdsec.py
View File

@ -4,12 +4,12 @@ from pymisp import MISPEvent, MISPObject
import pycountry import pycountry
import requests import requests
mispattributes = {"input": ["ip-dst", "ip-src"], "output": ["text"]} mispattributes = {"input": ["ip-dst", "ip-src"], "output": ["text"], 'format': 'misp_standard'}
moduleinfo = { moduleinfo = {
"version": "1.0", "version": "1.0",
"author": "Shivam Sandbhor <shivam@crowdsec.net>", "author": "Shivam Sandbhor <shivam@crowdsec.net>",
"description": "Module to access CrowdSec CTI API.", "description": "Module to access CrowdSec CTI API.",
"module-type": ["hover"], "module-type": ["hover", "expansion"],
} }
moduleconfig = ["api_key", "api_version"] moduleconfig = ["api_key", "api_version"]
@ -26,7 +26,8 @@ def handler(q=False):
return {"error": "Missing CrowdSec API key"} return {"error": "Missing CrowdSec API key"}
if not request["config"].get("api_version"): if not request["config"].get("api_version"):
return {"error": "Missing CrowdSec API version parameter"} else:
request["config"] = "v2"
if request["config"]["api_version"] == "v2": if request["config"]["api_version"] == "v2":
return _handler_v2(request) return _handler_v2(request)
@ -43,7 +44,7 @@ def _handler_v2(request_data):
f"https://cti.api.crowdsec.net/v2/smoke/{ip}", f"https://cti.api.crowdsec.net/v2/smoke/{ip}",
headers={ headers={
"x-api-key": request_data["config"]["api_key"], "x-api-key": request_data["config"]["api_key"],
"User-Agent": "crowdsec-misp/v1.0.0", "User-Agent": "crowdsec-misp/v1.0.0",
}, },
) )
crowdsec_cti.raise_for_status() crowdsec_cti.raise_for_status()