MISP
/
misp-modules
mirror of https://github.com/MISP/misp-modules
2
0
Fork 0
Code Issues Releases Wiki Activity
1,209 Commits
6 Branches
54 Tags
18 MiB
Commit Graph

150 Commits (a591138020b4a878ea92c2a19d2a349843f4295f)

Author SHA1 Message Date
chrisr3d fe1987101d
fix: Making pep8 happy 2019-10-03 17:10:47 +02:00
chrisr3d c5c5c16ff1
fix: Avoiding errors with uncommon lines 
- Excluding first from data parsed all lines that
  are comments or empty
- Skipping lines with failing indexes
 2019-10-03 16:03:30 +02:00
chrisr3d 3d7de2dc22
fix: Fixed unassigned variable name 2019-10-03 16:02:25 +02:00
chrisr3d ffe43acd89
fix: Removed no longer used variables 2019-09-20 09:22:20 +02:00
chrisr3d cfc6438c47
fix: csv import rework & improvement 
- More efficient parsing
- Support of multiple csv formats
- Possibility to customise headers
- More improvement to come for external csv file
 2019-09-19 23:19:57 +02:00
Pierre-Jean Grenier b2ab727f9b fix: prevent symlink attacks 2019-08-22 11:23:37 +02:00
Pierre-Jean Grenier 413cc2469f chg: [cuckooimport] Handle archives downloaded from both the WebUI and the API 2019-08-21 16:35:11 +02:00
Alexandre Dulaunoy c019e4d997
Merge pull request #322 from zaphodef/cuckooimport 
Rewrite cuckooimport
 2019-08-13 14:32:48 +02:00
Pierre-Jean Grenier 6ba6f8bb1f new: Rewrite cuckooimport 2019-08-09 15:44:47 +02:00
chrisr3d 0b603fc5d3
fix: Fixed unnecessary dictionary field call 
- No longer necessary to go under 'Event' field
  since PyMISP does not contain it since the
  latest update
 2019-08-05 11:33:04 +02:00
chrisr3d aa3e873845
fix: Making pep8 happy + added joe_import module in the init list 2019-06-04 11:33:42 +10:00
chrisr3d 0d40830a7f
fix: Some quick fixes 
- Fixed strptime matching because months are
  expressed in abbreviated format
- Made data loaded while the parsing function is
  called, in case it has to be called multiple
  times at some point
 2019-06-03 18:35:58 +10:00
chrisr3d 74b73f9332
chg: Moved JoeParser class to make it reachable from expansion & import modules 2019-05-29 11:26:14 +10:00
Georg Schölly 9377a892f4 support url analyses 2019-05-28 16:19:35 +02:00
Georg Schölly 380b8d46ba improve forwards-compatibility 2019-05-28 16:14:59 +02:00
chrisr3d 8ac651562e
fix: Making pep8 & travis happy 2019-05-23 16:13:49 +02:00
chrisr3d be05de62c0
add: Parsing MITRE ATT&CK tactic matrix related to the Joe report 2019-05-23 15:59:52 +02:00
chrisr3d e608107a09
add: Parsing domains, urls & ips contacted by processes 2019-05-22 17:12:49 +02:00
chrisr3d cfec9a6b1c
fix: Added references between processes and the files they drop 2019-05-22 15:27:04 +02:00
chrisr3d 191034d311
add: Starting parsing dropped files 2019-05-21 23:37:53 +02:00
chrisr3d 417c306ace
fix: Avoiding network connection object duplicates 2019-05-20 15:59:18 +02:00
chrisr3d 72e5f0099d
fix: Avoid creating a signer info object when the pe is not signed 2019-05-20 10:52:34 +02:00
chrisr3d 54f5fa6fa9
fix: Avoiding dictionary indexes issues 
- Using tuples as a dictionary indexes is better
  than using generators...
 2019-05-20 09:19:38 +02:00
chrisr3d 0d5f867825
add: Starting parsing network behavior fields 2019-05-17 22:18:11 +02:00
chrisr3d f9515c14d0
fix: Avoiding attribute & reference duplicates 2019-05-16 16:14:25 +02:00
chrisr3d 2246fc0d02
add: Parsing registry activities under processes 2019-05-16 16:11:43 +02:00
chrisr3d 067b229224
fix: Handling case of multiple processes in behavior field 
- Also starting parsing file activities
 2019-05-15 22:06:55 +02:00
chrisr3d d195b554a5
fix: Testing if some fields exist before trying to import them 
- Testing for pe itself, pe versions and pe signature
 2019-05-15 22:05:03 +02:00
chrisr3d fc8a56d1d9
fix: Removed test print 2019-05-15 15:49:29 +02:00
chrisr3d df7047dff0
fix: Fixed output format to match with the recent changes on modules 2019-05-14 10:50:11 +02:00
chrisr3d 29e681ef81
add: Parsing processes called by the file analyzed in the joe sandbox report 2019-05-13 17:30:01 +02:00
chrisr3d d39fb7da18
add: Parsing some object references at the end of the process 2019-05-13 17:29:07 +02:00
chrisr3d 728386d8a0
add: [new_module] Module to import data from Joe sandbox reports 
- Parsing file, pe and pe-section objects from the
  report file info field
- Deeper file info parsing to come
- Other fields parsing to come as well
 2019-05-08 16:52:49 +02:00
chrisr3d 77db21cf18
fix: Making pep8 happy 2019-05-07 09:37:21 +02:00
chrisr3d f1b5f05bb3
fix: Checking not MISP header fields 
- Rejecting fields not recognizable by MISP
 2019-05-07 09:35:56 +02:00
chrisr3d 6608671a01 Merge branch 'master' of github.com:MISP/misp-modules into new_module 2019-05-07 08:38:16 +02:00
chrisr3d 28eb92da53
fix: Using pymisp classes & methods to parse the module results 2019-05-06 22:16:14 +02:00
chrisr3d ae5bd8d06a
fix: Clearer user config messages displayed in the import view 2019-05-06 22:15:14 +02:00
Koen Van Impe 1cd60790fd Bugfix for "sources" ; do not include as IDS for "access" registry keys 
- Bugfix to query "operations" in files, mutex, registry
- Do not set IDS flag for registry 'access' operations
 2019-05-06 16:36:26 +02:00
chrisr3d 6f4b88606b
fix: Make pep8 happy 2019-05-02 14:07:36 +02:00
chrisr3d a5ff849950 Merge branch 'master' of github.com:MISP/misp-modules into new_module 2019-05-02 13:23:24 +02:00
Steve Clement 559ed786ba
chg: [pep8] try/except # noqa 
Not sure how to make flake happy on this one.
 2019-05-02 11:44:32 +09:00
Steve Clement 9af06fd24c
fix: [pep8] More fixes 2019-05-02 11:23:49 +09:00
Steve Clement 81ffabd621
fix: [pep8] More pep8 happiness 2019-05-02 11:06:32 +09:00
Koen Van Impe c8a4d8d76f New VMRay modules 
New JSON output format of VMRay
Prepare for automation (via PyMISP) with workflow taxonomy tags
 2019-05-01 22:44:24 +02:00
root c886247a64
fix: Fixed standard MISP csv format header 
- The csv header we can find in data produced from
  MISP restSearch csv format is the one to use to
  recognize a csv file produced by MISP
 2019-05-01 22:32:06 +02:00
root f900cb7c68
fix: Fixed introspection fields for csvimport & goamlimport 
- Added format field for goaml so the module is
  known as returning MISP attributes & objects
- Fixed introspection to make the format, user
  config and input source fields visible from
  MISP (format also added at the same time)
 2019-05-01 22:28:19 +02:00
root db74c5f49a
fix: Fixed libraries import that changed with the latest merge 2019-05-01 22:26:53 +02:00
chrisr3d 55e494c9ed Merge branch 'features_csvimport' of github.com:MISP/misp-modules into features_csvimport 2019-04-30 17:16:31 +02:00
Raphaël Vinot 454c9e0f43 fix: Pep8 related fixes. 2019-02-04 11:05:51 +01:00