mirror of https://github.com/MISP/misp-modules
98 lines
2.6 KiB
Python
Executable File
98 lines
2.6 KiB
Python
Executable File
import json
|
|
import base64
|
|
|
|
misperrors = {'error': 'Error'}
|
|
|
|
moduleinfo = {
|
|
'version': '1',
|
|
'author': 'TM',
|
|
'description': 'Lite export of a MISP event.',
|
|
'module-type': ['export'],
|
|
'name': 'Lite Export',
|
|
'logo': '',
|
|
'requirements': [],
|
|
'features': 'This module is simply producing a json MISP event format file, but exporting only Attributes from the Event. Thus, MISP Events exported with this module should have attributes that are not internal references, otherwise the resulting event would be empty.',
|
|
'references': [],
|
|
'input': 'MISP Event attributes',
|
|
'output': 'Lite MISP Event',
|
|
}
|
|
|
|
moduleconfig = ["indent_json_export"]
|
|
|
|
mispattributes = {}
|
|
outputFileExtension = "json"
|
|
responseType = "application/json"
|
|
|
|
|
|
def handler(q=False):
|
|
if q is False:
|
|
return False
|
|
|
|
request = json.loads(q)
|
|
|
|
config = {}
|
|
if "config" in request:
|
|
config = request["config"]
|
|
else:
|
|
config = {"indent_json_export": None}
|
|
|
|
if config['indent_json_export'] is not None:
|
|
try:
|
|
config['indent_json_export'] = int(config['indent_json_export'])
|
|
except Exception:
|
|
config['indent_json_export'] = None
|
|
|
|
if 'data' not in request:
|
|
return False
|
|
|
|
# ~ Misp json structur
|
|
liteEvent = {'Event': {}}
|
|
|
|
for evt in request['data']:
|
|
rawEvent = evt['Event']
|
|
liteEvent['Event']['info'] = rawEvent['info']
|
|
liteEvent['Event']['Attribute'] = []
|
|
|
|
attrs = evt['Attribute']
|
|
for attr in attrs:
|
|
if 'Internal reference' not in attr['category']:
|
|
liteAttr = {}
|
|
liteAttr['category'] = attr['category']
|
|
liteAttr['type'] = attr['type']
|
|
liteAttr['value'] = attr['value']
|
|
liteEvent['Event']['Attribute'].append(liteAttr)
|
|
|
|
return {'response': [],
|
|
'data': str(base64.b64encode(bytes(
|
|
json.dumps(liteEvent, indent=config['indent_json_export']), 'utf-8')), 'utf-8')}
|
|
|
|
|
|
def introspection():
|
|
modulesetup = {}
|
|
try:
|
|
responseType
|
|
modulesetup['responseType'] = responseType
|
|
except NameError:
|
|
pass
|
|
try:
|
|
userConfig
|
|
modulesetup['userConfig'] = userConfig
|
|
except NameError:
|
|
pass
|
|
try:
|
|
outputFileExtension
|
|
modulesetup['outputFileExtension'] = outputFileExtension
|
|
except NameError:
|
|
pass
|
|
try:
|
|
inputSource
|
|
modulesetup['inputSource'] = inputSource
|
|
except NameError:
|
|
pass
|
|
return modulesetup
|
|
|
|
|
|
def version():
|
|
moduleinfo['config'] = moduleconfig
|
|
return moduleinfo
|