Alexandre Dulaunoy
0bf27c1b69
chg: [btc_scam_check] fix spacing for making flake 8 happy
2019-02-11 14:23:18 +01:00
chrisr3d
74594f29aa
Merge branch 'master' of github.com:MISP/misp-modules into new_module
2019-02-11 09:28:49 +01:00
Alexandre Dulaunoy
f0ccfd2027
chg: [backscatter.io] blind fix regarding undefined value
2019-02-10 16:56:01 +01:00
Alexandre Dulaunoy
7b1a837b10
chg: [backscatter.io] remove blank line at the end of the file
2019-02-10 16:40:06 +01:00
Alexandre Dulaunoy
acc35e3a02
chg: [backscatter.io] Exception handler fixed for recent version of Python
2019-02-10 16:33:09 +01:00
9b
c8b410161a
Use the write var on return
2019-02-08 12:29:43 -05:00
9b
e4c1468968
Stubbed module
2019-02-08 12:27:20 -05:00
chrisr3d
08fe0cbe09
fix: Description fixed
2019-02-05 14:54:22 +01:00
chrisr3d
d1000d82c4
add: New module to check if a bitcoin address has been abused
...
- Also related update of documentation
2019-02-05 14:46:42 +01:00
Raphaël Vinot
454c9e0f43
fix: Pep8 related fixes.
2019-02-04 11:05:51 +01:00
Raphaël Vinot
3d47eb7420
fix: make flake8 happy
2019-01-25 10:45:07 +01:00
Sascha Rommelfangen
c52b95cdbe
sometimes server doesn't return expected values. fixed.
2019-01-24 09:51:46 +01:00
Raphaël Vinot
aa0581d3ca
Merge pull request #266 from MISP/pipenv
...
chg: Use pipenv, update bgpranking/ipasn modules, fix imports for sigma
2019-01-21 14:18:26 +01:00
Raphaël Vinot
0189a117a3
fix: Change in the imports in other sigma module
2019-01-21 14:14:19 +01:00
Raphaël Vinot
b791b177c3
fix: Change in the imports
2019-01-21 14:06:38 +01:00
Raphaël Vinot
d5ec09fe4a
fix: Change module name
2019-01-21 13:57:45 +01:00
Raphaël Vinot
55f05e0524
chg: Use pipenv, update bgpranking/ipasn modules
2019-01-21 13:31:52 +01:00
Ruiwen Chua
77c37b7cd6
fix: allow redis details to be retrieved from environment variables
2019-01-03 15:10:39 +08:00
milkmix
02cdc11445
added 2 blank lines to comply w/ pep8
2018-12-26 08:33:21 +01:00
milkmix
615a56f9bb
removed unused re module
2018-12-24 17:32:47 +01:00
milkmix
b64c3e4bf4
added domain attributes support
2018-12-24 17:07:45 +01:00
milkmix
537f9132f5
support for md5 and sha1 hashes
2018-12-24 16:40:31 +01:00
milkmix
5ab8b605bb
first export feature: sha1 attributes nxql query
2018-12-24 14:39:25 +01:00
Raphaël Vinot
8fc5b1fd1f
fix: Make pep8 happy
2018-12-11 15:29:09 +01:00
Raphaël Vinot
d0aec62f1a
new: Intel471 module
2018-12-11 13:30:52 +01:00
Sascha Rommelfangen
d5eb34270a
Merge branch 'master' of https://github.com/MISP/misp-modules
2018-11-26 15:56:33 +01:00
Sascha Rommelfangen
96570caece
cosmetic output change
2018-11-26 15:56:11 +01:00
chrisr3d
e30a5d2502
fix: Removed not valid input type
2018-11-22 12:30:12 +01:00
chrisr3d
7cfc7a730b
fix: Cleaned up not used variables
2018-11-22 12:27:45 +01:00
chrisr3d
627420ca43
fix: Updated rbl module result format
...
- More readable as str than dumped json
2018-11-22 12:27:16 +01:00
chrisr3d
547985b8ce
fix: Added Macaddress.io module in the init list
2018-11-22 12:26:27 +01:00
chrisr3d
be3063f3c6
fix: Typo on input type
2018-11-22 12:24:47 +01:00
chrisr3d
22173c249e
add: Update to support sha1 & sha256 attributes
2018-11-22 12:23:40 +01:00
chrisr3d
b778dd5e67
fix: Fixed type of the result in case of exception
...
- Set as str since some exception types are not
jsonable
2018-11-21 16:06:22 +01:00
chrisr3d
1b44668094
fix: Added hostname attribute support as it is intended
2018-11-21 16:05:38 +01:00
Christophe Vandeplas
8817de4765
fix: threatanalyzer_import - bugfix for TA6.1 behavior
2018-11-16 13:29:47 +01:00
chrisr3d
651f69126d
Merge branch 'master' of github.com:MISP/misp-modules into chrisr3d_patch
2018-11-13 16:05:24 +01:00
chrisr3d
299e97d1ce
add: Added imphash to input attribute types
2018-11-13 15:40:47 +01:00
Sascha Rommelfangen
3e25428978
debug removed
2018-11-13 15:34:33 +01:00
Sascha Rommelfangen
8285ff324f
API changes reflected
2018-11-13 15:30:06 +01:00
chrisr3d
58b3a069bf
fix: Updated yara import error message
...
- Better to 'pip install -I -r REQUIREMENTS' to
have the correct yara-python version working
for all the modules, than having another one
failing with yara hash & pe modules
2018-11-12 16:22:14 +01:00
chrisr3d
ad1ccdb9d0
Merge branch 'master' of github.com:MISP/misp-modules into chrisr3d_patch
2018-11-12 12:48:58 +01:00
Alexandre Dulaunoy
5d1583d88b
chg: [onyphe] fix #252
2018-11-11 15:49:14 +01:00
Sascha Rommelfangen
463d7ae874
bug fix regarding leftovers between runs
2018-11-07 14:57:19 +01:00
Steve Clement
91f922b5c4
chg: [btc] Removed simple PoC for btc expansion.
2018-11-07 22:53:21 +09:00
Sascha Rommelfangen
00b1b3214b
added btc_steroids to the list
2018-11-07 14:28:28 +01:00
Sascha Rommelfangen
b01cb28323
initial version of a Bitcoin module
2018-11-07 14:14:39 +01:00
Steve Clement
7bafa939b0
new: [btc] Very simple BTC expansion
...
chg: [req] yara-python is preferred
2018-11-06 00:48:36 +09:00
chrisr3d
d1308f9924
chg: Validating yara rules after their creation
2018-11-02 21:35:02 +01:00
Steve Clement
bb5f6fffae
chg: [init] Added try/catch in case misp-modules is already running on a port, or port is in use...
2018-11-02 10:42:40 +09:00
chrisr3d
62aa268d01
Merge branch 'master' of github.com:MISP/misp-modules
2018-10-31 10:22:12 +01:00
chrisr3d
1c10fd5e50
fix: Making yara query an expansion module for single attributes atm
2018-10-31 10:21:21 +01:00
milkmix
e8761c1664
super simple support for mutexes through winbaseobj in osquery 3.3
2018-10-25 21:28:46 +02:00
chrisr3d
1d530a7fa6
new: First version of a yara rule creation expansion module
2018-10-18 14:44:57 +02:00
Julien Bachmann
04ba4b34e3
Merge branch 'master' into export_osquery
2018-10-03 16:59:51 +01:00
milkmix
78b4aade08
corrected typos and unused imports
2018-10-03 17:55:08 +02:00
chrisr3d
e2cebd6c3e
fix: Catching errors while parsing additional info in requests
2018-09-25 17:10:19 +02:00
Codelinefi-admin
c19989e217
Fixed a bug with wrong dates conversion
2018-09-19 21:50:56 +03:00
isox
f1325f4316
Fixed getting of the Vulners AI score.
2018-09-18 18:36:12 +03:00
Igor Ivanov
3e9589d0f4
code cleanup and formatting
2018-09-18 14:38:49 +02:00
Igor Ivanov
8d7d377464
added exploit information
2018-09-18 12:11:47 +02:00
Igor Ivanov
5dc05bfafc
initial Vulners module PoC
2018-09-18 11:18:55 +02:00
Codelinefi-admin
db7dbd6ed5
macaddress.io hover module added
2018-09-13 17:02:49 +03:00
chrisr3d
5c718c5379
fix: Making python 3.5 happy with the exception type ImportError
2018-09-08 02:53:15 +02:00
chrisr3d
cfbd63f14e
fix: Fixed exception type for python 3.5
2018-09-07 18:06:01 +02:00
chrisr3d
a18db2ed1d
fix: Fixed exception type
2018-09-07 17:56:25 +02:00
chrisr3d
48fcf9a85e
fix: Fixed syntax error
2018-09-07 17:49:28 +02:00
chrisr3d
26647a164b
fix: Fixed indentation error
2018-09-07 17:43:46 +02:00
chrisr3d
5c69f1d867
Merge branch 'master' of github.com:MISP/misp-modules
2018-09-07 16:59:21 +02:00
Sascha Rommelfangen
ef781f59f8
fixed typo
...
via #220
2018-09-06 14:05:55 +02:00
chrisr3d
fcc18cbd73
Merge branch 'master' of github.com:MISP/misp-modules into features_csvimport
2018-09-03 15:40:19 +02:00
chrisr3d
ba728f7120
fix: Fixed 1 variable misuse + cleaned up variable names
...
- Fixed use of 'domain' variable instead of 'email'
- Cleaned up variable names to avoid redefinition
of built-in variables
2018-09-03 14:43:51 +02:00
chrisr3d
cdf2f434ce
fix: Avoiding adding attributes that are already in the event
2018-09-03 14:30:33 +02:00
chrisr3d
33181bc52b
fix: Fixed quick variable issue
2018-09-03 14:29:42 +02:00
chrisr3d
0ab38feade
fix: Cleaned up test function not used anymore
2018-09-03 13:17:48 +02:00
chrisr3d
936e30b15b
fix: Multiple attributes parsing support
...
- Fixing one of my previous changes not processing
multiple attributes parsing
2018-09-03 12:03:42 +02:00
chrisr3d
2af947a2de
fix: Removed print
2018-09-03 10:23:05 +02:00
chrisr3d
bc2a73c5cf
Merge branch 'master' of github.com:MISP/misp-modules
2018-09-02 20:21:01 +02:00
chrisr3d
179430d69d
fix: Some cleanup and output types fixed
...
- hashes types specified in output
2018-08-31 21:38:53 +02:00
SuRb0
b0be965e57
Update urlscan.py
...
Added hash to the search so you can take advantage of the new file down load function on urlscan.io. You can use this to pivot on file hashes and find out domains that hosting the same malicious file.
2018-08-30 19:41:34 -05:00
chrisr3d
35f3a5e43f
fix: Quick cleanup
2018-08-30 20:45:29 +02:00
chrisr3d
d15cbe58fe
fix: Quick cleanup
2018-08-30 20:41:49 +02:00
chrisr3d
18bad54603
Merge branch 'master' of github.com:MISP/misp-modules
2018-08-30 09:11:25 +02:00
Christophe Vandeplas
7deeb95820
fix: ta_import - bugfixes
2018-08-21 11:13:08 +02:00
David J
a697f65382
Add error handling for DNS failures, reduce imports, and simplify misp_comments
2018-08-14 10:51:15 -05:00
David J
bdbf538893
Create urlscan.py
2018-08-10 16:00:01 -05:00
chrisr3d
3a57d11745
Merge branch 'chrisr3d_patch' of github.com:chrisr3d/misp-modules
2018-08-08 17:41:07 +02:00
chrisr3d
90baa1dd5a
add: Added DBL spamhaus module documentation and in expansion init file
2018-08-08 17:05:22 +02:00
chrisr3d
61232ad93e
new: Expansion hover module to check spamhaus DBL for a domain name
2018-08-08 17:00:10 +02:00
chrisr3d
9acf66053e
Merge branch 'master' of github.com:MISP/misp-modules
2018-08-08 16:51:42 +02:00
chrisr3d
0666a60b3d
fix: [cleanup] Quick clean up on exception type
2018-08-07 18:15:15 +02:00
chrisr3d
bb6002a3ff
fix: [cleanup] Quick clean up on yaml load function
2018-08-07 18:14:29 +02:00
chrisr3d
57af98720d
fix: [cleanup] Quick clean up on exception type
2018-08-07 18:13:25 +02:00
Christophe Vandeplas
8d4e2025f7
ta_import - bugfixes for TA 6.1
2018-08-03 13:58:53 +02:00
chrisr3d
8b4d24ba63
fix: Fixed fields parsing to support files from csv export with additional context
2018-08-02 15:42:59 +02:00
chrisr3d
0045645c96
Merge branch 'master' of github.com:MISP/misp-modules into features_csvimport
2018-08-01 18:02:15 +02:00
chrisr3d
7980aa045a
fix: Handling the case of Context included in the csv file exported from MISP
2018-08-01 17:59:00 +02:00
chrisr3d
63c3252062
fix: Put the report location parsing in a try/catch statement as it is an optional field
2018-07-30 14:22:40 +02:00
chrisr3d
92fbcaeff6
fix: Fixed changes omissions in handler function
2018-07-28 00:07:02 +02:00
chrisr3d
63ba7580d3
chg: Updated csvimport to support files from csv export + import MISP objects
2018-07-27 23:13:47 +02:00
Christophe Vandeplas
2f27ff1244
ta_import - support for TheatAnalyzer 6.1
2018-07-27 14:44:06 +02:00
sebdraven
d7fac002af
Merge branch 'master' into dnstrails
2018-07-18 11:07:44 +02:00
Sebdraven
804e59ed8d
change type of status
2018-07-18 10:58:51 +02:00
Sebdraven
c8e20d9087
remove print
2018-07-18 10:51:47 +02:00
Sebdraven
f2df6dc538
last commit for release
2018-07-18 10:47:42 +02:00
Sebdraven
88859a0ba7
add logs
2018-07-17 18:43:52 +02:00
Sebdraven
8cbeda40a5
add searching_stats
2018-07-17 18:42:01 +02:00
Sebdraven
9d603344c2
add searching_stats
2018-07-17 18:32:50 +02:00
Sebdraven
c785cae89b
correct key
2018-07-17 17:22:48 +02:00
Sebdraven
2706c4a82a
correct key
2018-07-17 17:21:38 +02:00
Sebdraven
431c1511a3
correct param
2018-07-17 17:20:30 +02:00
Sebdraven
999ae1f6f0
add searching domains
2018-07-17 17:09:01 +02:00
Sebdraven
a41cf59e0c
add searching domains
2018-07-17 15:05:15 +02:00
Sebdraven
966f9603a9
add return
2018-07-12 15:02:46 +02:00
Sebdraven
7f52a15d16
add logs
2018-07-12 14:59:50 +02:00
Sebdraven
3eda712193
add whois expand to test
2018-07-12 14:58:48 +02:00
Sebdraven
5a422c2e5b
add whois expand to test
2018-07-12 14:57:37 +02:00
Sebdraven
db35c9b091
correct index error
2018-07-12 14:55:56 +02:00
Sebdraven
0341bdc398
error call functions
2018-07-12 14:52:01 +02:00
Sebdraven
2f5381d7b2
add logs
2018-07-12 14:49:51 +02:00
Sebdraven
0b0137829a
add logs
2018-07-12 14:48:15 +02:00
Sebdraven
86d236f859
add status_ok to true
2018-07-12 14:47:34 +02:00
Sebdraven
aa89a7fc4d
add logs
2018-07-12 14:44:19 +02:00
Sebdraven
86d9427816
add logs
2018-07-12 14:42:33 +02:00
Sebdraven
a0cf9de590
add logs
2018-07-12 14:38:38 +02:00
Sebdraven
9de201375b
add logs
2018-07-12 14:37:09 +02:00
Sebdraven
d56bf55038
add logs
2018-07-12 14:33:52 +02:00
Sebdraven
844b25b4cd
correct out of bound returns
2018-07-12 14:32:56 +02:00
Sebdraven
9063da88cd
correct key and return of functions
2018-07-12 14:27:59 +02:00
Sebdraven
731c06a939
add logs
2018-07-12 14:17:16 +02:00
Sebdraven
fb595c08aa
add logs
2018-07-12 14:16:19 +02:00
Sebdraven
41587bd568
correct typo
2018-07-12 14:14:43 +02:00
Sebdraven
4b0daee6f1
test whois history
2018-07-12 14:04:37 +02:00
Sebdraven
576b3c9b9b
history whois dns
2018-07-12 13:40:51 +02:00
chrisr3d
32419c398e
Merge branch 'master' of github.com:MISP/misp-modules
2018-07-12 00:05:01 +02:00
chrisr3d
a62078aad1
add: Experimental expansion module to display the SIEM signatures from a sigma rule
2018-07-11 23:43:42 +02:00
Sebdraven
51067039da
correct typo
2018-07-11 13:03:47 +02:00
Sebdraven
3a2aab6d71
rename misp modules
2018-07-11 12:41:54 +02:00
Sebdraven
a8ae6e06e9
add a test to check if the list is not empty
2018-07-11 12:09:34 +02:00
Sebdraven
f0a4c71908
add a test to check if the list is not empty
2018-07-11 12:08:01 +02:00
Sebdraven
dbeec4682e
add logs
2018-07-11 12:02:31 +02:00
Sebdraven
fb262b451f
debug whois
2018-07-11 12:00:59 +02:00
Sebdraven
80e71f582c
debug ipv4 or ipv6
2018-07-11 11:58:42 +02:00
Sebdraven
386d38c88f
add debug
2018-07-11 11:55:59 +02:00
Sebdraven
45decc728d
debug
2018-07-11 11:55:31 +02:00
Sebdraven
45c473aef5
change status
2018-07-11 11:52:10 +02:00
Sebdraven
64e7f9c8b6
change history dns
2018-07-11 11:47:10 +02:00
Sebdraven
560dacbf7e
add logs to debug
2018-07-11 11:40:22 +02:00
Sebdraven
74c611d2fb
correct call function
2018-07-11 11:37:07 +02:00
Sebdraven
f47a64b364
add history mx and soa
2018-07-11 11:24:49 +02:00
Sebdraven
43a49dafc6
add history dns and handler exception
2018-07-11 09:48:14 +02:00
Sebdraven
54d996cb00
add history dns
2018-07-11 09:39:09 +02:00
Sebdraven
dcdb6e5895
switch type ip
2018-07-11 09:02:47 +02:00
Sebdraven
42c362d2fd
refactoring expand_whois
2018-07-11 09:00:23 +02:00
Sebdraven
41635d43c7
correct typo
2018-07-11 08:49:59 +02:00
Sebdraven
3a96e189ed
add ipv6 and ipv4
2018-07-11 08:43:23 +02:00
Sebdraven
f2333a4978
change type
2018-07-10 16:55:13 +02:00
Sebdraven
9e6162a434
change type
2018-07-10 16:53:06 +02:00
Sebdraven
26950ea7de
change loop
2018-07-10 16:51:31 +02:00
Sebdraven
e9747a3379
add time sleep in each request
2018-07-10 16:41:44 +02:00
Sebdraven
602da3d1a3
control return of records
2018-07-10 16:35:01 +02:00
Sebdraven
495c720d0f
add history ipv4
2018-07-10 16:31:39 +02:00
Sebdraven
21794249d0
add logs
2018-07-10 15:17:37 +02:00
Sebdraven
b677cd5fc7
change categories
2018-07-10 15:16:02 +02:00
Sebdraven
1d100833a4
concat results
2018-07-10 15:12:27 +02:00
Sebdraven
1223d93d52
change name keys
2018-07-10 15:07:54 +02:00
Sebdraven
714c15f079
change return value
2018-07-10 15:05:10 +02:00
Sebdraven
e1a1648f14
add logs
2018-07-10 15:01:04 +02:00
Sebdraven
f710162bed
change errors
2018-07-10 14:59:39 +02:00
Sebdraven
2a8fb76e84
add logs
2018-07-10 14:56:20 +02:00
Steve Clement
562a6b1308
- Removed test modules from view
...
- Moved skeleton expansion module to it's proper place
2018-07-03 08:27:54 +02:00
chrisr3d
90e42c0305
fix: Put the stix2-pattern library import in a try statement
...
--> Error more easily caught
2018-07-02 12:14:21 +02:00
chrisr3d
08d8459e1a
add: STIX2 pattern syntax validator
2018-07-02 11:38:33 +02:00
Steve Clement
549f32547d
- Reverted to <3.6 compatibility
2018-07-01 22:09:02 +08:00
Steve Clement
9f0313a97e
- Fixed log output
2018-06-30 12:01:21 +08:00
Steve Clement
184065cf74
- Forgot to import sys
2018-06-30 11:58:44 +08:00
Steve Clement
ffce2aa5cc
- Added logger functionality for debug sessions
2018-06-30 11:52:12 +08:00
Steve Clement
2f5dd9928e
- content was already a wand.obj
2018-06-30 11:38:26 +08:00
Steve Clement
90f2fe9d19
Merge remote-tracking branch 'upstream/master'
2018-06-30 01:05:01 +08:00
Steve Clement
f97359de6a
Merge branch 'master' of github.com:SteveClement/misp-modules
2018-06-30 01:04:30 +08:00
Steve Clement
ef3837077e
- Some more comments
...
- Removed libmagic, wand can handle it better
2018-06-30 00:58:25 +08:00
Sebdraven
34da5cdb76
add expand whois
2018-06-29 17:57:11 +02:00
Sebdraven
f1c6095914
typo
2018-06-29 17:26:56 +02:00
Sebdraven
78d6de9b7a
add categories and comments
2018-06-29 17:25:37 +02:00
Sebdraven
0965def6bf
add expand subdomains
2018-06-29 17:22:19 +02:00
Sebdraven
64847a8a04
add expand subdomains
2018-06-29 17:19:21 +02:00
Sebdraven
2d1adf4aa9
change categories
2018-06-29 16:30:47 +02:00
Sebdraven
0275e3ecd8
changes keys
2018-06-29 16:20:35 +02:00
Sebdraven
f3962d2d05
add status !
2018-06-29 16:17:32 +02:00
Sebdraven
09c52788b8
add methods
2018-06-29 16:11:24 +02:00
Sebdraven
cfe971a271
add expand domains
2018-06-29 15:50:26 +02:00
Sebdraven
60f772b905
add new module dnstrails
2018-06-29 11:27:36 +02:00
Christophe Vandeplas
ff793bc221
threatanalyzer_import - order of category tuned
2018-06-29 11:17:03 +02:00
Alexandre Dulaunoy
d8eeb73a4a
Merge branch 'master' into master
2018-06-29 06:49:40 +02:00
Steve Clement
c7c93b53e8
- Set tornado timeout to 300 seconds.
2018-06-29 12:02:08 +08:00
Steve Clement
fbb3617f25
- Quick comment ToDo: Avoid using Magic in future releases
2018-06-29 12:01:17 +08:00
Steve Clement
60a3fbe282
- added wand requirement
...
- fixed missing return png byte-stream
- move module import to handler to catch and report errorz
2018-06-28 23:20:38 +08:00
Steve Clement
7885017981
- fixed typo move image back in scope
2018-06-28 16:59:03 +08:00
chrisr3d
7dd8e988c0
Updated the list of modules (removed stiximport)
2018-06-28 10:51:40 +02:00
chrisr3d
b1c90b411e
add: Sigma syntax validator expansion module
...
--> Checks sigma rules syntax
- Updated the expansion modules list as well
- Updated the requirements list
2018-06-28 10:41:32 +02:00