import json from maclookup import ApiClient, exceptions misperrors = { 'error': 'Error' } mispattributes = { 'input': ['mac-address'], } moduleinfo = { 'version': '1.0', 'author': 'CodeLine OY - macaddress.io', 'description': 'MISP hover module for macaddress.io', 'module-type': ['hover'] } moduleconfig = ['api_key'] def handler(q=False): if q is False: return False request = json.loads(q) if request.get('mac-address'): mac_address = request['mac-address'] else: return False if request.get('config') and request['config'].get('api_key'): api_key = request['config'].get('api_key') else: misperrors['error'] = 'Authorization required' return misperrors api_client = ApiClient(api_key) try: response = api_client.get(mac_address) except exceptions.EmptyResponseException: misperrors['error'] = 'Empty response' return misperrors except exceptions.UnparsableResponseException: misperrors['error'] = 'Unparsable response' return misperrors except exceptions.ServerErrorException: misperrors['error'] = 'Internal server error' return misperrors except exceptions.UnknownOutputFormatException: misperrors['error'] = 'Unknown output' return misperrors except exceptions.AuthorizationRequiredException: misperrors['error'] = 'Authorization required' return misperrors except exceptions.AccessDeniedException: misperrors['error'] = 'Access denied' return misperrors except exceptions.InvalidMacOrOuiException: misperrors['error'] = 'Invalid MAC or OUI' return misperrors except exceptions.NotEnoughCreditsException: misperrors['error'] = 'Not enough credits' return misperrors except Exception: misperrors['error'] = 'Unknown error' return misperrors date_created = \ response.block_details.date_created.strftime('%d %B %Y') if response.block_details.date_created else None date_updated = \ response.block_details.date_updated.strftime('%d %B %Y') if response.block_details.date_updated else None results = { 'results': [{'types': ['text'], 'values': { # Mac address details 'Valid MAC address': "True" if response.mac_address_details.is_valid else "False", 'Transmission type': response.mac_address_details.transmission_type, 'Administration type': response.mac_address_details.administration_type, # Vendor details 'OUI': response.vendor_details.oui, 'Vendor details are hidden': "True" if response.vendor_details.is_private else "False", 'Company name': response.vendor_details.company_name, 'Company\'s address': response.vendor_details.company_address, 'County code': response.vendor_details.country_code, # Block details 'Block found': "True" if response.block_details.block_found else "False", 'The left border of the range': response.block_details.border_left, 'The right border of the range': response.block_details.border_right, 'The total number of MAC addresses in this range': response.block_details.block_size, 'Assignment block size': response.block_details.assignment_block_size, 'Date when the range was allocated': date_created, 'Date when the range was last updated': date_updated }}] } return results def introspection(): return mispattributes def version(): moduleinfo['config'] = moduleconfig return moduleinfo