mirror of https://github.com/MISP/misp-modules
76 lines
3.1 KiB
Python
76 lines
3.1 KiB
Python
"""vt_graph_parser.importers.pymisp_response.
|
|
|
|
This modules provides a graph importer method for MISP event by using the
|
|
response payload giving by MISP API directly.
|
|
"""
|
|
|
|
|
|
import json
|
|
from lib.vt_graph_parser import errors
|
|
from lib.vt_graph_parser.helpers.parsers import parse_pymisp_response
|
|
from lib.vt_graph_parser.importers.base import import_misp_graph
|
|
|
|
|
|
def from_pymisp_response(
|
|
payload, vt_api_key, fetch_information=True,
|
|
private=False, fetch_vt_enterprise=False, user_editors=None,
|
|
user_viewers=None, group_editors=None, group_viewers=None,
|
|
use_vt_to_connect_the_graph=False, max_api_quotas=1000,
|
|
max_search_depth=3, expand_node_one_level=False):
|
|
"""Import VirusTotal Graph from MISP JSON file.
|
|
|
|
Args:
|
|
payload (dict): dictionary which contains the request payload.
|
|
vt_api_key (str): VT API Key.
|
|
fetch_information (bool, optional): whether the script will fetch
|
|
information for added nodes in VT. Defaults to True.
|
|
name (str, optional): graph title. Defaults to "".
|
|
private (bool, optional): True for private graphs. You need to have
|
|
Private Graph premium features enabled in your subscription. Defaults
|
|
to False.
|
|
fetch_vt_enterprise (bool, optional): if True, the graph will search any
|
|
available information using VirusTotal Intelligence for the node if there
|
|
is no normal information for it. Defaults to False.
|
|
user_editors ([str], optional): usernames that can edit the graph.
|
|
Defaults to None.
|
|
user_viewers ([str], optional): usernames that can view the graph.
|
|
Defaults to None.
|
|
group_editors ([str], optional): groups that can edit the graph.
|
|
Defaults to None.
|
|
group_viewers ([str], optional): groups that can view the graph.
|
|
Defaults to None.
|
|
use_vt_to_connect_the_graph (bool, optional): if True, graph nodes will
|
|
be linked using VirusTotal API. Otherwise, the links will be generated
|
|
using production rules based on MISP attributes order. Defaults to
|
|
False.
|
|
max_api_quotas (int, optional): maximum number of api quotas that could
|
|
be consumed to resolve graph using VirusTotal API. Defaults to 20000.
|
|
max_search_depth (int, optional): max search depth to explore
|
|
relationship between nodes when use_vt_to_connect_the_graph is True.
|
|
Defaults to 3.
|
|
expand_one_level (bool, optional): expand entire graph one level.
|
|
Defaults to False.
|
|
|
|
If use_vt_to_connect_the_graph is True, it will take some time to compute
|
|
graph.
|
|
|
|
Raises:
|
|
LoaderError: if JSON file is invalid.
|
|
|
|
Returns:
|
|
[vt_graph_api.graph.VTGraph: the imported graph].
|
|
"""
|
|
graphs = []
|
|
for event_payload in payload['data']:
|
|
misp_attrs, graph_id = parse_pymisp_response(event_payload)
|
|
name = "Graph created from MISP event"
|
|
graph = import_misp_graph(
|
|
misp_attrs, graph_id, vt_api_key, fetch_information, name,
|
|
private, fetch_vt_enterprise, user_editors, user_viewers, group_editors,
|
|
group_viewers, use_vt_to_connect_the_graph, max_api_quotas,
|
|
max_search_depth)
|
|
if expand_node_one_level:
|
|
graph.expand_n_level(1)
|
|
graphs.append(graph)
|
|
return graphs
|