MISP
/
misp-modules
mirror of https://github.com/MISP/misp-modules
2
0
Fork 0
Code Issues Releases Wiki Activity
2,222 Commits
6 Branches
54 Tags
18 MiB
Commit Graph

1192 Commits (858b4ed1c68cb9e6eaf460912d3ba691eb27ac8b)

Author SHA1 Message Date
Jeroen Pinoy ed2d14c956
Add hashlookup to expansion init.py 2022-02-03 10:44:13 +01:00
Raphaël Vinot 2874c41f7f
fix: required parameters for Recorded Future object 2022-01-14 10:23:08 +01:00
Michael Chisholm 24070bfab7 Add workaround for PyMISP bug regarding conversion of objects 
to JSON-serializable values.
 2022-01-11 21:54:09 -05:00
Michael Chisholm 923fd05eb3 Contribute a TAXII 2.1 import style misp-module. 2022-01-11 21:54:09 -05:00
Silvian I 23ff0348ed [crowdstrike_falcon] fix imports warning 2022-01-11 15:25:39 +01:00
Silvian I 13cb1f472d [crowdstrike_falcon] Upgrade crowdstrike_falcon enrich module to new api version & add attribute creation on enrichment functionality 2022-01-11 13:59:59 +01:00
Silvian I 950a76a3ad Upgrade censys_enrich module to new api version - fix test error 2022-01-07 19:26:02 +01:00
Silvian I ef543a3fa8 Upgrade censys_enrich module to new api version - fix test error 2022-01-07 19:05:05 +01:00
Silvian I b9d9df4dd0 Upgrade censys_enrich module to new api version 2022-01-07 14:46:10 +01:00
Derek LaHousse 6c4e788110 It seems alright to leave the field empty, just have to check that it is empty 2021-12-30 09:25:44 -05:00
Koen Van Impe b9fb2f3ca7 Update mwdb.py 2021-12-26 23:59:16 +01:00
Koen Van Impe c42723d42d Module to push malware samples to a MWDB instance 
- Upload of attachment or malware sample to MWDB
- Tags of events and/or attributes are added to MWDB.
- Comment of the MISP attribute is added to MWDB.
- A link back to the MISP event is added to MWDB via the MWDB attribute.
- A link to the MWDB attribute is added as an enriched attribute to the MISP event.
 2021-12-26 23:34:00 +01:00
Jakub Onderka 907ac1e935 fix: [ods_enrich] Try to fix reading bytesio 2021-12-24 16:48:24 +01:00
Jakub Onderka 3fe7072bfb fix: [ods_enrich] Better exception logging 2021-12-24 16:48:24 +01:00
Jakub Onderka 1f75b8f865 fix: [internal] Better exception logging 2021-12-24 16:48:24 +01:00
Alexandre Dulaunoy 268bb312c9
fix: [hashlookup] typo fixed 2021-12-18 17:11:06 +01:00
Alexandre Dulaunoy 2d98885231
chg: [hashlookup] support for sha256 and bug fix for non-exising MD5 2021-12-18 09:22:32 +01:00
Calvin Krzywiec dc0660acd0
feature: add qintel qsentry expansion module 2021-11-22 15:46:46 -05:00
Jean-Louis Huynen 84ecc19206
Merge branch 'MISP:main' into main 2021-10-26 15:12:12 +02:00
Jean-Louis Huynen 7967542be6 add: [passive-ssh] initial commit 2021-10-26 15:11:20 +02:00
rderkach 4fd3323220 Update Recorded future expansion module with the new data 
In this release, we added new data that we have called Links.
It represents better and more filtered related data.
Also did some code formatting.
 2021-10-25 18:01:05 +03:00
chrisr3d be5635b0a4
fix: [yara_query] Fixed module input parsing 
- The module used to work properly when called
  from a single attribute enrichment, but was
  broken when called from the hover enrichment
  feature, because of the additional `persistent`
  field used to define which type of hover
  enrichment is queried
 2021-10-15 17:18:29 +02:00
Alexandre Dulaunoy 4162ccb528
chg: [hashlookup] KnownMalicious field added 2021-09-24 15:35:14 +02:00
Alexandre Dulaunoy b6e0c4ce53
chg: [hashlookup] add new fields such as source, SSDEEP and TLSH 2021-09-24 15:29:23 +02:00
Alexandre Dulaunoy 9783113a1e
fix: [hashlookup] FileName and size are not required fields and can be missing in a hashlookup record 2021-09-24 15:09:07 +02:00
Andras Iklody 4115b7607e
fix: added note about the Domaintools module being deprecated 
- as requested by Domaintools, including a link to their own, up to date module
 2021-09-09 13:57:29 +02:00
chrisr3d 82e0628fe7
chg: [hashlookup] Using the actual attribute types for FileName & FileSize 
- Following the recent changes on the obejct template
  to use `filename` as attribute type for the FileName
  object relation instead of `text`
  d2b93f5aa6
 2021-08-26 15:19:36 +02:00
chrisr3d 1d7f0ee1f0
fix: [hashlookup] Fixed the errors handling 
- Since the modules system is waiting for a dict,
  we return `misperrors` instead of the actual
  value of the 'error' key, and the module will
  no longer fail when there is no result to parse
 2021-08-26 15:02:32 +02:00
Alexandre Dulaunoy 73e78463d0
new: [hashlookup] new hashlookup module added 
https://www.circl.lu/services/hashlookup/
 2021-08-25 18:42:16 +02:00
Alexandre Dulaunoy 7b675f7857
Merge branch 'main' of github.com:MISP/misp-modules into main 2021-08-25 18:41:31 +02:00
Alexandre Dulaunoy f40fc7ebc4
new: [hashlookup] new hashlookup module added 2021-08-25 18:38:09 +02:00
Martin Ohl d2ed09d081
Create mcafee_insights_enrich.py 
Module to expand IOC information with McAfee MVISION Insights
 2021-08-13 14:55:08 +02:00
Jason Zhang f5fdf343b8 Sanity checks 2021-08-12 11:08:09 +01:00
Brad Chiappetta b3daa138f1 add cve support and enhance ip lookups 2021-08-09 15:37:37 -04:00
Jason Zhang 83fd44ed13 add vmware_nsx module 2021-07-29 12:13:31 +01:00
Alexandre Dulaunoy 354427d173
Merge pull request #507 from aaronkaplan/cof2misp 
Cof2misp
 2021-06-17 19:40:08 +02:00
Aaron Kaplan 4078119db0 fix the last issues of #493 
(https://github.com/MISP/misp-modules/issues/493)
 2021-06-17 14:36:27 +00:00
Aaron Kaplan d1aeafb3ae unit test for dnsdbflex in lib/cof.py 2021-06-17 14:33:15 +00:00
Alexandre Dulaunoy 605231e089
chg :[virustotal_public] make flake8 happy 2021-06-11 14:54:07 +02:00
Alexandre Dulaunoy 94795e4993
chg: [virustotal] make flake8 happy 2021-06-11 14:51:30 +02:00
Alex Resnick c4bc2408ad add proxy configs for virus total modules 2021-05-28 14:53:35 -05:00
aaronkaplan 9813f7f7cb
Merge branch 'main' of https://github.com/MISP/misp-modules into cof2misp 2021-05-27 01:58:55 +02:00
aaronkaplan 6824b4e991
push version 2021-05-27 01:58:23 +02:00
aaronkaplan 4816844d16
Add a function to validate dnsdbflex output 
add dnsdbflex parser. It's rather easy

Signed-off-by: aaronkaplan <aaron@lo-res.org>
 2021-05-26 12:38:56 +02:00
aaronkaplan bbe0a1efa8
Merge remote-tracking branch 'origin/cof2misp' into cof2misp 2021-05-26 12:17:18 +02:00
aaronkaplan 5b41c82f78
Add a function to validate dnsdbflex output 
Signed-off-by: aaronkaplan <aaron@lo-res.org>
 2021-05-26 12:16:11 +02:00
Rambatla Venkat Rao 6a731454f1
Updated Distribution Constant 2021-05-12 21:42:25 +05:30
Rambatla Venkat Rao f6c0f68263
Default distribution setting to DNSDB Objects 2021-05-12 18:38:55 +05:30
Rambatla Venkat Rao 7aa6b39da8
Added a default distribution setting to Objects 2021-05-12 18:30:54 +05:30
Alexandre Dulaunoy 77035a82e0
chg: [cof2misp] bailiwick is optional 2021-05-11 14:46:16 +02:00
Sebdraven 382025453e fix bug on loop 2021-05-07 14:38:42 +02:00
Sebdraven eb48635ce5 remove print and variable unsuable 2021-05-07 14:07:18 +02:00
sebdraven 8491e169e0
Merge pull request #4 from MISP/main 
merge
 2021-05-07 12:34:33 +02:00
Sebdraven d0c2f94354 add summary ip, domain and hostname 2021-05-07 12:27:11 +02:00
chrisr3d dc3b892a42 Merge branch 'main' of github.com:MISP/misp-modules into main 2021-05-04 18:39:26 +02:00
chrisr3d 780590cee3
fix: [farsight_passivedns] Handling exceptions raised from a query error 
- This can happen with for instance a wrong server URL
 2021-05-04 18:36:56 +02:00
Alexandre Dulaunoy bcc05c3337
Merge pull request #497 from aaronkaplan/cof2misp 
Cof2misp
 2021-05-04 18:27:33 +02:00
root 117200f334 oops, there was a minor error. print(..., file=sys.stDerr) . Typo! 2021-05-04 07:48:30 +00:00
aaronkaplan 09f0f3943a
Add license text. No logical changes in this commit 2021-05-04 09:44:47 +02:00
Alexandre Dulaunoy c6d02cc177
chg: [cof2misp] debugging removed 2021-05-03 12:41:01 +02:00
Alexandre Dulaunoy 10b5295cdd
chg: [cof2misp] remove logging in the misp-modules 2021-05-03 12:27:52 +02:00
Alexandre Dulaunoy 8e55101dc8
chg: [cof2misp module] fix the import module/package "__init__.py" missing 2021-05-03 12:04:22 +02:00
chrisr3d 790090eb0b
chg: [farsight_passivedns] Updated the bailiwick attribute type, following the latest changes on the passive-dns object template 2021-05-03 11:25:37 +02:00
aaronkaplan 0c6a12ea60 Make teh special attributes *_ip and _domain not needed. 
See the discussion in https://github.com/MISP/misp-objects/pull/314
 2021-05-02 22:54:41 +00:00
aaronkaplan 5a3465844a Make stub strict parser 2021-05-02 22:23:52 +00:00
aaronkaplan 763e10af5d flake8, you suck 2021-05-02 22:01:09 +00:00
aaronkaplan 36904c688c Merge branch 'cof2misp' of github.com:aaronkaplan/misp-modules into cof2misp 2021-05-02 21:49:40 +00:00
aaronkaplan 85864dad2e make flake8 happier 2021-05-02 21:39:39 +00:00
aaronkaplan d5d207f0cb Merge branch 'cof2misp' of github.com:aaronkaplan/misp-modules into cof2misp 2021-05-02 21:22:22 +00:00
aaronkaplan ff950bc50c Merge branch 'cof2misp' of github.com:aaronkaplan/misp-modules into cof2misp 2021-05-02 21:11:00 +00:00
aaronkaplan f1da1dd6fa Version 0.2 of the cof2misp import module. 2021-05-02 20:51:07 +00:00
aaronkaplan c06b8ff604 Version 0.2 of the cof2misp import module. 2021-05-02 16:45:55 +00:00
Sebdraven 16f9ec9f6d fix bug 2021-04-30 15:46:59 +02:00
Sebdraven 73ea9620bf add reference 2021-04-30 15:39:56 +02:00
Sebdraven 86beb488c1 add test to check 2021-04-30 15:25:27 +02:00
Sebdraven 32aeb52efc fixe typo 2021-04-30 15:22:55 +02:00
Sebdraven 4478440d5b remove pass 2021-04-30 15:16:47 +02:00
Sebdraven 7f1caaba25 add object certificate 2021-04-30 15:16:22 +02:00
Sebdraven 098616846d add hostname 2021-04-23 16:19:47 +02:00
Sebdraven e1c2c779aa Update onyphe.py 
remove typo
 2021-04-23 16:16:43 +02:00
Sebdraven f32717c896 check entry in result dico 2021-04-23 16:15:38 +02:00
Sebdraven 436254cd8c add logs 2021-04-23 16:13:32 +02:00
Sebdraven 7813ba4fc3 fix logical test 2021-04-23 16:11:10 +02:00
Sebdraven 9fd23d6fe0 add logs 2021-04-23 16:09:21 +02:00
Sebdraven ff6470d0e2 add logs 2021-04-23 16:07:44 +02:00
Sebdraven 8fbe371eca add logs 2021-04-23 16:06:20 +02:00
Sebdraven 94f6af8882 add summary ip 
object domain
 2021-04-23 16:02:21 +02:00
Sebdraven 9364859ce9 refactoring of the module 2021-04-22 15:05:29 +02:00
Sebdraven b9407ad85a Merge branch 'main' 2021-04-22 11:27:43 +02:00
Sebdraven 7ab2e099f4 fix typo 2021-04-21 18:15:16 +02:00
Sebdraven 9f5a4be9d7 remove variable unused 2021-04-21 17:54:01 +02:00
Sebdraven abac4cfab7 remove import unused and add package in requirements 2021-04-21 17:51:22 +02:00
Sebdraven 1b9d47dd33 Update yeti.py 
pep 8 compliant
 2021-04-21 15:41:20 +02:00
Sebdraven a76978d6c6 Update yeti.py 
remove tags and entity
 2021-04-21 15:40:46 +02:00
Sebdraven a277cbb8bf Update yeti.py 
add input
 2021-04-21 14:45:07 +02:00
sebdraven f6675a71e4
Merge pull request #2 from MISP/master 
Master
 2021-04-21 12:42:33 +02:00
Sebdraven 7e5238e8be Update yeti.py 
add tests
 2021-04-20 14:35:18 +02:00
Sebdraven 8683c9e5ce Update yeti.py 
add ns record dst and src link
 2021-04-20 14:13:16 +02:00
Sebdraven 26bc02617f Update yeti.py 
add test to create result
 2021-04-20 14:08:31 +02:00
Sebdraven 3426ad13c5 Update yeti.py 
fix edges
 2021-04-20 14:05:51 +02:00
Sebdraven fd76e55093 Update yeti.py 
fix typo
 2021-04-20 13:56:45 +02:00
Sebdraven dfa46b551a Update yeti.py 
change params
 2021-04-20 13:55:36 +02:00
Sebdraven baaaa81ec3 Update yeti.py 
add ns_record object
 2021-04-20 13:53:06 +02:00
Sebdraven cec06ed26d Update yeti.py 
change loop
 2021-04-20 13:38:45 +02:00
Sebdraven bb1cd7c4de Update yeti.py 
fix bug
 2021-04-20 12:43:43 +02:00
Sebdraven e037c4c767 Update yeti.py 
remove tests
 2021-04-20 12:42:49 +02:00
Sebdraven e0506ee31e Update yeti.py 
filter by id
 2021-04-20 12:40:01 +02:00
Sebdraven f701256008 Update yeti.py 
add src
 2021-04-20 12:33:46 +02:00
Sebdraven a2741e8eb7 Update yeti.py 
fix keyerror
 2021-04-20 12:30:22 +02:00
Sebdraven 9cb1a83e54 Update yeti.py 
fix bug about id
 2021-04-20 12:24:34 +02:00
Sebdraven 37867f89ee Update yeti.py 
add logs
 2021-04-20 12:21:56 +02:00
Sebdraven 507e56228f Update yeti.py 
add logs
 2021-04-20 12:19:43 +02:00
Sebdraven abba63f32f Update yeti.py 
add test of id
 2021-04-20 12:17:17 +02:00
Sebdraven 1a67f8ed96 Update yeti.py 
add log
 2021-04-20 12:08:59 +02:00
Sebdraven 385af28a0a Update yeti.py 
add descripton
 2021-04-20 12:07:06 +02:00
Sebdraven 8ea3d5c5c7 Update yeti.py 
add file to add in attribute
 2021-04-20 10:41:44 +02:00
Sebdraven 5d80b79bc4 Update yeti.py 
add tags for attribute
 2021-04-19 17:55:29 +02:00
Sebdraven 43672ee9a9 Update yeti.py 
remove tag
 2021-04-19 17:20:13 +02:00
Sebdraven f7ca8bf140 Update yeti.py 
test tags
 2021-04-19 17:19:23 +02:00
Sebdraven ee7c065795 Update yeti.py 
change tags method
 2021-04-19 17:16:59 +02:00
Sebdraven 21b52dda15 Update yeti.py 
add related observable and AS
 2021-04-19 17:10:47 +02:00
Sebdraven 5e6aec4162 Update yeti.py 
remove print debug
 2021-04-19 13:49:02 +02:00
Sebdraven b46a3a8885 Update yeti.py 
fix bugs key error
 2021-04-19 13:47:45 +02:00
Sebdraven 0da40b34ee Update yeti.py 
add param
 2021-04-19 13:45:29 +02:00
Sebdraven 1e98f1d575 Update yeti.py 
try typo
 2021-04-19 12:20:25 +02:00
Sebdraven 53cc15adcd Update yeti.py 
remove print
 2021-04-19 12:12:32 +02:00
Sebdraven ef6596637d Update yeti.py 
remove tests
 2021-04-19 11:49:24 +02:00
Sebdraven e3fc3a3f38 Update yeti.py 
test
 2021-04-19 11:47:06 +02:00
Sebdraven 8a24ed7fd6 Update yeti.py 
add logs
 2021-04-19 11:27:33 +02:00
Sebdraven 559533ea78 Update yeti.py 
try test
 2021-04-19 11:25:50 +02:00
Sebdraven a29779eff6 Update yeti.py 
add check
 2021-04-19 11:24:01 +02:00
Sebdraven 4634567b23 Update yeti.py 
correct bug
 2021-04-19 11:09:38 +02:00
Sebdraven be212097a7 Update yeti.py 
add log
 2021-04-19 11:08:21 +02:00
Sebdraven af01db860a Update yeti.py 
add log
 2021-04-19 11:05:16 +02:00
Sebdraven 07f54c1b86 Update yeti.py 
correct typo
 2021-04-19 11:03:39 +02:00
Sebdraven 69a5584dfe Update yeti.py 
add relation
 2021-04-19 11:00:55 +02:00
Sebdraven 6cd99c03e4 Update yeti.py 
refactoring and add Url neighboors
 2021-04-19 10:46:07 +02:00
chrisr3d dbff9b3aa8
chg: [rbl] Added a timeout parameter to change the resolver timeout & lifetime if needed 2021-04-16 22:00:27 +02:00
chrisr3d 576dcca671
chg: [rbl] Small changes on the rbl list and the results handling 2021-04-16 16:45:38 +02:00
chrisr3d 300cdc7a4c
fix: [ocr_enrich] Making Pep8 happy 2021-04-15 16:41:15 +02:00
chrisr3d 611bb6fa9e
fix: [ocr_enrich] Fixed tesseract input format 
- It looks like the `image_to_string` method now
  assumes RGB format and the `imdecode` method
  seems to give BGR format, so we convert the
  image array before
 2021-04-15 16:12:00 +02:00
chrisr3d 729feaa3f2
fix: [hibp] Fixed config handling to avoir KeyError exceptions 2021-04-14 16:52:55 +02:00
Alexandre Dulaunoy 577d0de500
chg: [farsight] make PEP happy 2021-04-14 14:45:55 +02:00
Alexandre Dulaunoy 2bc5021ace
Merge pull request #435 from JakubOnderka/remove-duplicate-decoding 
fix: [main] Remove duplicate JSON decoding
 2021-04-08 20:41:46 +02:00
Alexandre Dulaunoy 0752628de5
fix: [cve_advanced] Some CVEs are not in CWE format but in NVD-CWE-Other 2021-04-08 19:14:13 +02:00
chrisr3d a2282c4721
add: [farsight_passivedns] Adding first_seen & last_seen (when available) in passivedns objects 
- The object_relation `time_first` is added as the
  `first_seen` value of the object
- Same with `time_last` -> `last_seen`
 2021-03-31 13:42:07 +02:00
chrisr3d 505bbbc20a
fix: [farsight_passivedns] Excluding last_seen value for now, in order to get the available results 
- With last_seen set we can easily get results
  included in a certain time frame (between first
  seen and last seen), but we do not get the
  latest results. In order to get those ones, we
  skip filtering on the time_last_before value
 2021-03-30 17:34:01 +02:00
chrisr3d 5077050a3e
chg: [farsight_passivedns] Making first_time and last_time results human readable 
- We get the datetime format instead of the raw
  timestamp
 2021-03-30 03:47:34 +02:00
chrisr3d 327a1ac893
fix: [farsight_passivedns] Fixed lookup_rdata_name results desclaration 
- Getting generator as a list as it is already the
  case for all the other results, so it avoids
  issues to read the results by accidently looping
  through the generator before it is actually
  needed, which would lose the content of the
  generator
- Also removed print that was accidently introduced
  with the last commit
 2021-03-30 03:42:54 +02:00
chrisr3d 8935c4adc5 Merge branch 'main' of github.com:MISP/misp-modules into new_features 2021-03-29 20:10:28 +02:00