chrisr3d
9c8ee1f3d7
new: Expansion module to query urlhaus API
...
- Using the next version of modules, taking a
MISP attribute as input and able to return
attributes and objects
- Work still in process in the core part
2019-03-13 09:57:28 +01:00
Alexandre Dulaunoy
0bf27c1b69
chg: [btc_scam_check] fix spacing for making flake 8 happy
2019-02-11 14:23:18 +01:00
chrisr3d
74594f29aa
Merge branch 'master' of github.com:MISP/misp-modules into new_module
2019-02-11 09:28:49 +01:00
Alexandre Dulaunoy
f0ccfd2027
chg: [backscatter.io] blind fix regarding undefined value
2019-02-10 16:56:01 +01:00
Alexandre Dulaunoy
7b1a837b10
chg: [backscatter.io] remove blank line at the end of the file
2019-02-10 16:40:06 +01:00
Alexandre Dulaunoy
acc35e3a02
chg: [backscatter.io] Exception handler fixed for recent version of Python
2019-02-10 16:33:09 +01:00
9b
c8b410161a
Use the write var on return
2019-02-08 12:29:43 -05:00
9b
e4c1468968
Stubbed module
2019-02-08 12:27:20 -05:00
chrisr3d
08fe0cbe09
fix: Description fixed
2019-02-05 14:54:22 +01:00
chrisr3d
d1000d82c4
add: New module to check if a bitcoin address has been abused
...
- Also related update of documentation
2019-02-05 14:46:42 +01:00
Raphaël Vinot
454c9e0f43
fix: Pep8 related fixes.
2019-02-04 11:05:51 +01:00
Raphaël Vinot
3d47eb7420
fix: make flake8 happy
2019-01-25 10:45:07 +01:00
Sascha Rommelfangen
c52b95cdbe
sometimes server doesn't return expected values. fixed.
2019-01-24 09:51:46 +01:00
Raphaël Vinot
0189a117a3
fix: Change in the imports in other sigma module
2019-01-21 14:14:19 +01:00
Raphaël Vinot
b791b177c3
fix: Change in the imports
2019-01-21 14:06:38 +01:00
Raphaël Vinot
d5ec09fe4a
fix: Change module name
2019-01-21 13:57:45 +01:00
Raphaël Vinot
55f05e0524
chg: Use pipenv, update bgpranking/ipasn modules
2019-01-21 13:31:52 +01:00
Raphaël Vinot
8fc5b1fd1f
fix: Make pep8 happy
2018-12-11 15:29:09 +01:00
Raphaël Vinot
d0aec62f1a
new: Intel471 module
2018-12-11 13:30:52 +01:00
Sascha Rommelfangen
d5eb34270a
Merge branch 'master' of https://github.com/MISP/misp-modules
2018-11-26 15:56:33 +01:00
Sascha Rommelfangen
96570caece
cosmetic output change
2018-11-26 15:56:11 +01:00
chrisr3d
e30a5d2502
fix: Removed not valid input type
2018-11-22 12:30:12 +01:00
chrisr3d
7cfc7a730b
fix: Cleaned up not used variables
2018-11-22 12:27:45 +01:00
chrisr3d
627420ca43
fix: Updated rbl module result format
...
- More readable as str than dumped json
2018-11-22 12:27:16 +01:00
chrisr3d
547985b8ce
fix: Added Macaddress.io module in the init list
2018-11-22 12:26:27 +01:00
chrisr3d
be3063f3c6
fix: Typo on input type
2018-11-22 12:24:47 +01:00
chrisr3d
22173c249e
add: Update to support sha1 & sha256 attributes
2018-11-22 12:23:40 +01:00
chrisr3d
b778dd5e67
fix: Fixed type of the result in case of exception
...
- Set as str since some exception types are not
jsonable
2018-11-21 16:06:22 +01:00
chrisr3d
1b44668094
fix: Added hostname attribute support as it is intended
2018-11-21 16:05:38 +01:00
chrisr3d
651f69126d
Merge branch 'master' of github.com:MISP/misp-modules into chrisr3d_patch
2018-11-13 16:05:24 +01:00
chrisr3d
299e97d1ce
add: Added imphash to input attribute types
2018-11-13 15:40:47 +01:00
Sascha Rommelfangen
3e25428978
debug removed
2018-11-13 15:34:33 +01:00
Sascha Rommelfangen
8285ff324f
API changes reflected
2018-11-13 15:30:06 +01:00
chrisr3d
58b3a069bf
fix: Updated yara import error message
...
- Better to 'pip install -I -r REQUIREMENTS' to
have the correct yara-python version working
for all the modules, than having another one
failing with yara hash & pe modules
2018-11-12 16:22:14 +01:00
chrisr3d
ad1ccdb9d0
Merge branch 'master' of github.com:MISP/misp-modules into chrisr3d_patch
2018-11-12 12:48:58 +01:00
Alexandre Dulaunoy
5d1583d88b
chg: [onyphe] fix #252
2018-11-11 15:49:14 +01:00
Sascha Rommelfangen
463d7ae874
bug fix regarding leftovers between runs
2018-11-07 14:57:19 +01:00
Steve Clement
91f922b5c4
chg: [btc] Removed simple PoC for btc expansion.
2018-11-07 22:53:21 +09:00
Sascha Rommelfangen
00b1b3214b
added btc_steroids to the list
2018-11-07 14:28:28 +01:00
Sascha Rommelfangen
b01cb28323
initial version of a Bitcoin module
2018-11-07 14:14:39 +01:00
Steve Clement
7bafa939b0
new: [btc] Very simple BTC expansion
...
chg: [req] yara-python is preferred
2018-11-06 00:48:36 +09:00
chrisr3d
d1308f9924
chg: Validating yara rules after their creation
2018-11-02 21:35:02 +01:00
chrisr3d
1c10fd5e50
fix: Making yara query an expansion module for single attributes atm
2018-10-31 10:21:21 +01:00
chrisr3d
1d530a7fa6
new: First version of a yara rule creation expansion module
2018-10-18 14:44:57 +02:00
chrisr3d
e2cebd6c3e
fix: Catching errors while parsing additional info in requests
2018-09-25 17:10:19 +02:00
Codelinefi-admin
c19989e217
Fixed a bug with wrong dates conversion
2018-09-19 21:50:56 +03:00
isox
f1325f4316
Fixed getting of the Vulners AI score.
2018-09-18 18:36:12 +03:00
Igor Ivanov
3e9589d0f4
code cleanup and formatting
2018-09-18 14:38:49 +02:00
Igor Ivanov
8d7d377464
added exploit information
2018-09-18 12:11:47 +02:00
Igor Ivanov
5dc05bfafc
initial Vulners module PoC
2018-09-18 11:18:55 +02:00
Codelinefi-admin
db7dbd6ed5
macaddress.io hover module added
2018-09-13 17:02:49 +03:00
chrisr3d
5c718c5379
fix: Making python 3.5 happy with the exception type ImportError
2018-09-08 02:53:15 +02:00
chrisr3d
cfbd63f14e
fix: Fixed exception type for python 3.5
2018-09-07 18:06:01 +02:00
chrisr3d
a18db2ed1d
fix: Fixed exception type
2018-09-07 17:56:25 +02:00
chrisr3d
48fcf9a85e
fix: Fixed syntax error
2018-09-07 17:49:28 +02:00
chrisr3d
26647a164b
fix: Fixed indentation error
2018-09-07 17:43:46 +02:00
chrisr3d
5c69f1d867
Merge branch 'master' of github.com:MISP/misp-modules
2018-09-07 16:59:21 +02:00
Sascha Rommelfangen
ef781f59f8
fixed typo
...
via #220
2018-09-06 14:05:55 +02:00
chrisr3d
ba728f7120
fix: Fixed 1 variable misuse + cleaned up variable names
...
- Fixed use of 'domain' variable instead of 'email'
- Cleaned up variable names to avoid redefinition
of built-in variables
2018-09-03 14:43:51 +02:00
chrisr3d
cdf2f434ce
fix: Avoiding adding attributes that are already in the event
2018-09-03 14:30:33 +02:00
chrisr3d
33181bc52b
fix: Fixed quick variable issue
2018-09-03 14:29:42 +02:00
chrisr3d
0ab38feade
fix: Cleaned up test function not used anymore
2018-09-03 13:17:48 +02:00
chrisr3d
936e30b15b
fix: Multiple attributes parsing support
...
- Fixing one of my previous changes not processing
multiple attributes parsing
2018-09-03 12:03:42 +02:00
chrisr3d
2af947a2de
fix: Removed print
2018-09-03 10:23:05 +02:00
chrisr3d
bc2a73c5cf
Merge branch 'master' of github.com:MISP/misp-modules
2018-09-02 20:21:01 +02:00
chrisr3d
179430d69d
fix: Some cleanup and output types fixed
...
- hashes types specified in output
2018-08-31 21:38:53 +02:00
SuRb0
b0be965e57
Update urlscan.py
...
Added hash to the search so you can take advantage of the new file down load function on urlscan.io. You can use this to pivot on file hashes and find out domains that hosting the same malicious file.
2018-08-30 19:41:34 -05:00
chrisr3d
35f3a5e43f
fix: Quick cleanup
2018-08-30 20:45:29 +02:00
chrisr3d
18bad54603
Merge branch 'master' of github.com:MISP/misp-modules
2018-08-30 09:11:25 +02:00
David J
a697f65382
Add error handling for DNS failures, reduce imports, and simplify misp_comments
2018-08-14 10:51:15 -05:00
David J
bdbf538893
Create urlscan.py
2018-08-10 16:00:01 -05:00
chrisr3d
3a57d11745
Merge branch 'chrisr3d_patch' of github.com:chrisr3d/misp-modules
2018-08-08 17:41:07 +02:00
chrisr3d
90baa1dd5a
add: Added DBL spamhaus module documentation and in expansion init file
2018-08-08 17:05:22 +02:00
chrisr3d
61232ad93e
new: Expansion hover module to check spamhaus DBL for a domain name
2018-08-08 17:00:10 +02:00
chrisr3d
0666a60b3d
fix: [cleanup] Quick clean up on exception type
2018-08-07 18:15:15 +02:00
chrisr3d
bb6002a3ff
fix: [cleanup] Quick clean up on yaml load function
2018-08-07 18:14:29 +02:00
chrisr3d
57af98720d
fix: [cleanup] Quick clean up on exception type
2018-08-07 18:13:25 +02:00
sebdraven
d7fac002af
Merge branch 'master' into dnstrails
2018-07-18 11:07:44 +02:00
Sebdraven
804e59ed8d
change type of status
2018-07-18 10:58:51 +02:00
Sebdraven
c8e20d9087
remove print
2018-07-18 10:51:47 +02:00
Sebdraven
f2df6dc538
last commit for release
2018-07-18 10:47:42 +02:00
Sebdraven
88859a0ba7
add logs
2018-07-17 18:43:52 +02:00
Sebdraven
8cbeda40a5
add searching_stats
2018-07-17 18:42:01 +02:00
Sebdraven
9d603344c2
add searching_stats
2018-07-17 18:32:50 +02:00
Sebdraven
c785cae89b
correct key
2018-07-17 17:22:48 +02:00
Sebdraven
2706c4a82a
correct key
2018-07-17 17:21:38 +02:00
Sebdraven
431c1511a3
correct param
2018-07-17 17:20:30 +02:00
Sebdraven
999ae1f6f0
add searching domains
2018-07-17 17:09:01 +02:00
Sebdraven
a41cf59e0c
add searching domains
2018-07-17 15:05:15 +02:00
Sebdraven
966f9603a9
add return
2018-07-12 15:02:46 +02:00
Sebdraven
7f52a15d16
add logs
2018-07-12 14:59:50 +02:00
Sebdraven
3eda712193
add whois expand to test
2018-07-12 14:58:48 +02:00
Sebdraven
5a422c2e5b
add whois expand to test
2018-07-12 14:57:37 +02:00
Sebdraven
db35c9b091
correct index error
2018-07-12 14:55:56 +02:00
Sebdraven
0341bdc398
error call functions
2018-07-12 14:52:01 +02:00
Sebdraven
2f5381d7b2
add logs
2018-07-12 14:49:51 +02:00
Sebdraven
0b0137829a
add logs
2018-07-12 14:48:15 +02:00
Sebdraven
86d236f859
add status_ok to true
2018-07-12 14:47:34 +02:00
Sebdraven
aa89a7fc4d
add logs
2018-07-12 14:44:19 +02:00
Sebdraven
86d9427816
add logs
2018-07-12 14:42:33 +02:00
Sebdraven
a0cf9de590
add logs
2018-07-12 14:38:38 +02:00
Sebdraven
9de201375b
add logs
2018-07-12 14:37:09 +02:00
Sebdraven
d56bf55038
add logs
2018-07-12 14:33:52 +02:00
Sebdraven
844b25b4cd
correct out of bound returns
2018-07-12 14:32:56 +02:00
Sebdraven
9063da88cd
correct key and return of functions
2018-07-12 14:27:59 +02:00
Sebdraven
731c06a939
add logs
2018-07-12 14:17:16 +02:00
Sebdraven
fb595c08aa
add logs
2018-07-12 14:16:19 +02:00
Sebdraven
41587bd568
correct typo
2018-07-12 14:14:43 +02:00
Sebdraven
4b0daee6f1
test whois history
2018-07-12 14:04:37 +02:00
Sebdraven
576b3c9b9b
history whois dns
2018-07-12 13:40:51 +02:00
chrisr3d
32419c398e
Merge branch 'master' of github.com:MISP/misp-modules
2018-07-12 00:05:01 +02:00
chrisr3d
a62078aad1
add: Experimental expansion module to display the SIEM signatures from a sigma rule
2018-07-11 23:43:42 +02:00
Sebdraven
51067039da
correct typo
2018-07-11 13:03:47 +02:00
Sebdraven
3a2aab6d71
rename misp modules
2018-07-11 12:41:54 +02:00
Sebdraven
a8ae6e06e9
add a test to check if the list is not empty
2018-07-11 12:09:34 +02:00
Sebdraven
f0a4c71908
add a test to check if the list is not empty
2018-07-11 12:08:01 +02:00
Sebdraven
dbeec4682e
add logs
2018-07-11 12:02:31 +02:00
Sebdraven
fb262b451f
debug whois
2018-07-11 12:00:59 +02:00
Sebdraven
80e71f582c
debug ipv4 or ipv6
2018-07-11 11:58:42 +02:00
Sebdraven
386d38c88f
add debug
2018-07-11 11:55:59 +02:00
Sebdraven
45decc728d
debug
2018-07-11 11:55:31 +02:00
Sebdraven
45c473aef5
change status
2018-07-11 11:52:10 +02:00
Sebdraven
64e7f9c8b6
change history dns
2018-07-11 11:47:10 +02:00
Sebdraven
560dacbf7e
add logs to debug
2018-07-11 11:40:22 +02:00
Sebdraven
74c611d2fb
correct call function
2018-07-11 11:37:07 +02:00
Sebdraven
f47a64b364
add history mx and soa
2018-07-11 11:24:49 +02:00
Sebdraven
43a49dafc6
add history dns and handler exception
2018-07-11 09:48:14 +02:00
Sebdraven
54d996cb00
add history dns
2018-07-11 09:39:09 +02:00
Sebdraven
dcdb6e5895
switch type ip
2018-07-11 09:02:47 +02:00
Sebdraven
42c362d2fd
refactoring expand_whois
2018-07-11 09:00:23 +02:00
Sebdraven
41635d43c7
correct typo
2018-07-11 08:49:59 +02:00
Sebdraven
3a96e189ed
add ipv6 and ipv4
2018-07-11 08:43:23 +02:00
Sebdraven
f2333a4978
change type
2018-07-10 16:55:13 +02:00
Sebdraven
9e6162a434
change type
2018-07-10 16:53:06 +02:00
Sebdraven
26950ea7de
change loop
2018-07-10 16:51:31 +02:00
Sebdraven
e9747a3379
add time sleep in each request
2018-07-10 16:41:44 +02:00
Sebdraven
602da3d1a3
control return of records
2018-07-10 16:35:01 +02:00
Sebdraven
495c720d0f
add history ipv4
2018-07-10 16:31:39 +02:00
Sebdraven
21794249d0
add logs
2018-07-10 15:17:37 +02:00
Sebdraven
b677cd5fc7
change categories
2018-07-10 15:16:02 +02:00
Sebdraven
1d100833a4
concat results
2018-07-10 15:12:27 +02:00
Sebdraven
1223d93d52
change name keys
2018-07-10 15:07:54 +02:00
Sebdraven
714c15f079
change return value
2018-07-10 15:05:10 +02:00
Sebdraven
e1a1648f14
add logs
2018-07-10 15:01:04 +02:00
Sebdraven
f710162bed
change errors
2018-07-10 14:59:39 +02:00
Sebdraven
2a8fb76e84
add logs
2018-07-10 14:56:20 +02:00
Steve Clement
562a6b1308
- Removed test modules from view
...
- Moved skeleton expansion module to it's proper place
2018-07-03 08:27:54 +02:00
chrisr3d
90e42c0305
fix: Put the stix2-pattern library import in a try statement
...
--> Error more easily caught
2018-07-02 12:14:21 +02:00
chrisr3d
08d8459e1a
add: STIX2 pattern syntax validator
2018-07-02 11:38:33 +02:00
Sebdraven
34da5cdb76
add expand whois
2018-06-29 17:57:11 +02:00
Sebdraven
f1c6095914
typo
2018-06-29 17:26:56 +02:00
Sebdraven
78d6de9b7a
add categories and comments
2018-06-29 17:25:37 +02:00
Sebdraven
0965def6bf
add expand subdomains
2018-06-29 17:22:19 +02:00
Sebdraven
64847a8a04
add expand subdomains
2018-06-29 17:19:21 +02:00
Sebdraven
2d1adf4aa9
change categories
2018-06-29 16:30:47 +02:00
Sebdraven
0275e3ecd8
changes keys
2018-06-29 16:20:35 +02:00
Sebdraven
f3962d2d05
add status !
2018-06-29 16:17:32 +02:00
Sebdraven
09c52788b8
add methods
2018-06-29 16:11:24 +02:00
Sebdraven
cfe971a271
add expand domains
2018-06-29 15:50:26 +02:00
Sebdraven
60f772b905
add new module dnstrails
2018-06-29 11:27:36 +02:00
chrisr3d
b1c90b411e
add: Sigma syntax validator expansion module
...
--> Checks sigma rules syntax
- Updated the expansion modules list as well
- Updated the requirements list
2018-06-28 10:41:32 +02:00
chrisr3d
7c691af807
Updated the list of expansion modules
2018-06-28 10:39:40 +02:00
Sebdraven
785aac3e6b
add return handle domains
2018-06-22 16:18:23 +02:00
Sebdraven
87b07b89b5
add search
2018-06-22 16:15:34 +02:00
Sebdraven
396b71ef3b
add domain to expand
2018-06-22 16:06:34 +02:00
Sebdraven
de6a81d488
correct bugs
2018-06-22 16:04:14 +02:00
Sebdraven
83999d6402
add domain expansion
2018-06-22 15:57:52 +02:00
Sebdraven
96c829470d
add comment
2018-06-22 15:14:44 +02:00
Sebdraven
8d03354399
correct bugs
2018-06-22 15:12:10 +02:00
Sebdraven
e9c18b3d5f
correct comments
2018-06-22 13:03:09 +02:00
Sebdraven
e230c88c15
add threat list expansion
2018-06-22 11:59:09 +02:00
Sebdraven
1d1fd36569
change method to concat methods
2018-06-20 18:05:28 +02:00
Sebdraven
e712a31760
set status after requests
2018-06-20 18:04:12 +02:00
Sebdraven
a9b7a10c41
set status after requests
2018-06-20 18:03:34 +02:00
Sebdraven
4166475f9e
add logs
2018-06-20 18:02:12 +02:00
Sebdraven
fe00f099f6
add logs
2018-06-20 17:59:49 +02:00
Sebdraven
153d8bd340
add logs
2018-06-20 17:56:19 +02:00
Sebdraven
9195887f98
pep 8
2018-06-20 17:51:46 +02:00
Sebdraven
2afd2b8aaf
correct bug
2018-06-20 17:50:28 +02:00
Sebdraven
04e932cce0
add datascan expansion
2018-06-20 17:47:11 +02:00
Sebdraven
b56f8cfa36
add reverse infos
2018-06-20 16:30:56 +02:00
Sebdraven
d4be9d9fda
add reverse infos
2018-06-20 16:29:04 +02:00
Sebdraven
4a8a79c560
add reverse infos
2018-06-20 16:26:09 +02:00
Sebdraven
0d120af647
add reverse infos
2018-06-20 16:24:17 +02:00
Sebdraven
a24b529868
add forward infos
2018-06-20 15:33:21 +02:00
Sebdraven
d0f42c1772
add comment of attributes
2018-06-20 15:07:55 +02:00
Sebdraven
915747073a
add comment of attributes
2018-06-20 15:05:00 +02:00
Sebdraven
7eba7c0386
error loops
2018-06-20 14:53:08 +02:00
Sebdraven
d1e72676f1
error method
2018-06-20 14:50:48 +02:00
Sebdraven
3a4294391f
error type
2018-06-20 14:48:18 +02:00
Sebdraven
9427c76603
error keys
2018-06-20 14:45:06 +02:00
Sebdraven
e1bc67afad
add expansion synscan
2018-06-20 14:41:57 +02:00
Sebdraven
5426ec5380
change key access domains
2018-06-20 12:40:52 +02:00
Sebdraven
7a3c4b1084
change add in results
2018-06-20 12:38:41 +02:00
Sebdraven
e8aefde2ee
add logs
2018-06-20 12:36:32 +02:00
Sebdraven
7195f33f5d
correct error keys
2018-06-20 12:34:07 +02:00
Sebdraven
c14d05adef
test patries expansion
2018-06-20 12:32:54 +02:00
Sebdraven
8ae7210aef
add onyphe full module
2018-06-20 11:07:33 +02:00
Sebdraven
023c35f5d8
add onyphe full module and code the stub
2018-06-14 16:47:11 +02:00
Sebdraven
14695bbeb9
correct codecov
2018-06-11 13:34:45 +02:00