chrisr3d
422f654988
fix: Making pep8 happy with indentation
2020-03-18 10:24:06 +01:00
Jakub Onderka
fe34023866
csvimport: Return error if input is not valid UTF-8
2020-03-12 11:02:43 +01:00
Hendrik
8f9940200b
Lastline verify_ssl option
...
Helps people with on-prem boxes
2020-01-27 07:46:48 +01:00
chrisr3d
b2c8f79220
fix: Making pep8 happy
2020-01-24 15:17:35 +01:00
Georg Schölly
04685ea63e
joe: (1) allow users to disable PE object import (2) set 'to_ids' to False
2020-01-24 14:51:38 +01:00
Stefano Ortolani
66bf650b79
change: migrate to analysis API when submitting tasks to Lastline
2020-01-21 11:32:05 +00:00
chrisr3d
cf5ad29f27
chg: Checking attributes category
...
- We check the category before adding the
attribute to the event
- Checking if the category is correct and if not,
doing a case insensitive check
- If the category is not correct after the 2 first
tests, we simply delete it from the attribute
and pymisp will give the attribute a default
category value based on the atttribute type, at
the creation of the attribute
2020-01-07 17:03:10 +01:00
Raphaël Vinot
b70c32af7b
fix: Somewhat broken emails needed some love
2019-12-05 19:11:07 +01:00
Raphaël Vinot
6f95445143
chg: Update email import module, support objects
2019-12-04 15:25:01 +01:00
Stefano Ortolani
f749578525
add: Modules to query/import/submit data from/to Lastline
2019-12-02 19:09:40 +00:00
chrisr3d
91d6f1baa0
fix: Fixed csv file parsing
2019-11-07 11:50:16 +01:00
chrisr3d
fe1987101d
fix: Making pep8 happy
2019-10-03 17:10:47 +02:00
chrisr3d
c5c5c16ff1
fix: Avoiding errors with uncommon lines
...
- Excluding first from data parsed all lines that
are comments or empty
- Skipping lines with failing indexes
2019-10-03 16:03:30 +02:00
chrisr3d
3d7de2dc22
fix: Fixed unassigned variable name
2019-10-03 16:02:25 +02:00
chrisr3d
ffe43acd89
fix: Removed no longer used variables
2019-09-20 09:22:20 +02:00
chrisr3d
cfc6438c47
fix: csv import rework & improvement
...
- More efficient parsing
- Support of multiple csv formats
- Possibility to customise headers
- More improvement to come for external csv file
2019-09-19 23:19:57 +02:00
Pierre-Jean Grenier
b2ab727f9b
fix: prevent symlink attacks
2019-08-22 11:23:37 +02:00
Pierre-Jean Grenier
413cc2469f
chg: [cuckooimport] Handle archives downloaded from both the WebUI and the API
2019-08-21 16:35:11 +02:00
Alexandre Dulaunoy
c019e4d997
Merge pull request #322 from zaphodef/cuckooimport
...
Rewrite cuckooimport
2019-08-13 14:32:48 +02:00
Pierre-Jean Grenier
6ba6f8bb1f
new: Rewrite cuckooimport
2019-08-09 15:44:47 +02:00
chrisr3d
0b603fc5d3
fix: Fixed unnecessary dictionary field call
...
- No longer necessary to go under 'Event' field
since PyMISP does not contain it since the
latest update
2019-08-05 11:33:04 +02:00
chrisr3d
aa3e873845
fix: Making pep8 happy + added joe_import module in the init list
2019-06-04 11:33:42 +10:00
chrisr3d
0d40830a7f
fix: Some quick fixes
...
- Fixed strptime matching because months are
expressed in abbreviated format
- Made data loaded while the parsing function is
called, in case it has to be called multiple
times at some point
2019-06-03 18:35:58 +10:00
chrisr3d
74b73f9332
chg: Moved JoeParser class to make it reachable from expansion & import modules
2019-05-29 11:26:14 +10:00
Georg Schölly
9377a892f4
support url analyses
2019-05-28 16:19:35 +02:00
Georg Schölly
380b8d46ba
improve forwards-compatibility
2019-05-28 16:14:59 +02:00
chrisr3d
8ac651562e
fix: Making pep8 & travis happy
2019-05-23 16:13:49 +02:00
chrisr3d
be05de62c0
add: Parsing MITRE ATT&CK tactic matrix related to the Joe report
2019-05-23 15:59:52 +02:00
chrisr3d
e608107a09
add: Parsing domains, urls & ips contacted by processes
2019-05-22 17:12:49 +02:00
chrisr3d
cfec9a6b1c
fix: Added references between processes and the files they drop
2019-05-22 15:27:04 +02:00
chrisr3d
191034d311
add: Starting parsing dropped files
2019-05-21 23:37:53 +02:00
chrisr3d
417c306ace
fix: Avoiding network connection object duplicates
2019-05-20 15:59:18 +02:00
chrisr3d
72e5f0099d
fix: Avoid creating a signer info object when the pe is not signed
2019-05-20 10:52:34 +02:00
chrisr3d
54f5fa6fa9
fix: Avoiding dictionary indexes issues
...
- Using tuples as a dictionary indexes is better
than using generators...
2019-05-20 09:19:38 +02:00
chrisr3d
0d5f867825
add: Starting parsing network behavior fields
2019-05-17 22:18:11 +02:00
chrisr3d
f9515c14d0
fix: Avoiding attribute & reference duplicates
2019-05-16 16:14:25 +02:00
chrisr3d
2246fc0d02
add: Parsing registry activities under processes
2019-05-16 16:11:43 +02:00
chrisr3d
067b229224
fix: Handling case of multiple processes in behavior field
...
- Also starting parsing file activities
2019-05-15 22:06:55 +02:00
chrisr3d
d195b554a5
fix: Testing if some fields exist before trying to import them
...
- Testing for pe itself, pe versions and pe signature
2019-05-15 22:05:03 +02:00
chrisr3d
fc8a56d1d9
fix: Removed test print
2019-05-15 15:49:29 +02:00
chrisr3d
df7047dff0
fix: Fixed output format to match with the recent changes on modules
2019-05-14 10:50:11 +02:00
chrisr3d
29e681ef81
add: Parsing processes called by the file analyzed in the joe sandbox report
2019-05-13 17:30:01 +02:00
chrisr3d
d39fb7da18
add: Parsing some object references at the end of the process
2019-05-13 17:29:07 +02:00
chrisr3d
728386d8a0
add: [new_module] Module to import data from Joe sandbox reports
...
- Parsing file, pe and pe-section objects from the
report file info field
- Deeper file info parsing to come
- Other fields parsing to come as well
2019-05-08 16:52:49 +02:00
chrisr3d
77db21cf18
fix: Making pep8 happy
2019-05-07 09:37:21 +02:00
chrisr3d
f1b5f05bb3
fix: Checking not MISP header fields
...
- Rejecting fields not recognizable by MISP
2019-05-07 09:35:56 +02:00
chrisr3d
6608671a01
Merge branch 'master' of github.com:MISP/misp-modules into new_module
2019-05-07 08:38:16 +02:00
chrisr3d
28eb92da53
fix: Using pymisp classes & methods to parse the module results
2019-05-06 22:16:14 +02:00
chrisr3d
ae5bd8d06a
fix: Clearer user config messages displayed in the import view
2019-05-06 22:15:14 +02:00
Koen Van Impe
1cd60790fd
Bugfix for "sources" ; do not include as IDS for "access" registry keys
...
- Bugfix to query "operations" in files, mutex, registry
- Do not set IDS flag for registry 'access' operations
2019-05-06 16:36:26 +02:00