Modules for expansion services, import and export in MISP http://misp.github.io/misp-modules
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 
 
 

61 lines
1.9 KiB

# -*- coding: utf-8 -*-
import jbxapi
import json
from joe_parser import JoeParser
misperrors = {'error': 'Error'}
mispattributes = {'input': ['link'], 'format': 'misp_standard'}
moduleinfo = {'version': '0.1', 'author': 'Christian Studer',
'description': 'Query Joe Sandbox API with a report URL to get the parsed data.',
'module-type': ['expansion']}
moduleconfig = ['apiurl', 'apikey', 'accept-tac']
class _ParseError(Exception):
pass
def _parse_bool(value, name="bool"):
if value is None or value == "":
return None
if value in ("true", "True"):
return True
if value in ("false", "False"):
return False
raise _ParseError("Cannot parse {}. Must be 'true' or 'false'".format(name))
def handler(q=False):
if q is False:
return False
request = json.loads(q)
apiurl = request['config'].get('apiurl') or 'https://jbxcloud.joesecurity.org/api'
apikey = request['config'].get('apikey')
if not apikey:
return {'error': 'No API key provided'}
try:
accept_tac = _parse_bool(request['config'].get('accept-tac'), 'accept-tac')
except _ParseError as e:
return {'error': str(e)}
attribute = request['attribute']
joe = jbxapi.JoeSandbox(apiurl=apiurl, apikey=apikey, user_agent='MISP joesandbox_analysis', accept_tac=accept_tac)
joe_info = joe.submission_info(attribute['value'].split('/')[-1])
joe_parser = JoeParser()
most_relevant = joe_info['most_relevant_analysis']['webid']
for analyse in joe_info['analyses']:
if analyse['webid'] == most_relevant:
joe_data = json.loads(joe.analysis_download(most_relevant, 'jsonfixed')[1])
joe_parser.parse_data(joe_data['analysis'])
break
joe_parser.finalize_results()
return {'results': joe_parser.results}
def introspection():
return mispattributes
def version():
moduleinfo['config'] = moduleconfig
return moduleinfo