2.1 KiB
MISP modules
MISP modules are autonomous modules that can be used for expansion and other services in MISP.
The modules are written in Python 3 following a simple API interface. The objective is to ease the extensions of MISP functionalities without modifying core components. The API is available via a simple REST API which is independent from MISP installation or configuration.
MISP modules support is included in MISP starting from version 2.4.X.
Existing MISP modules
- DNS - a simple module to resolve MISP attributes like hostname and domain to expand IP addresses attributes.
How to add your own MISP modules?
Create your module in modules/expansion/. The module should have at minimum two functions:
- introspection function that returns an array of the supported attributes by your expansion module.
- handler function which accepts a JSON document to expand the values and return a dictionary of the expanded values.
Don't forget to return an error key and value if an error is raised to propagate it to the MISP user-interface.
Testing your modules?
MISP uses the modules function to discover the available MISP modules and their supported MISP attributes:
% curl -s http://127.0.0.1:6666/modules | jq .
[
{
"mispattributes": {
"output": [
"ip-src",
"ip-dst"
],
"input": [
"hostname",
"domain"
]
},
"type": "expansion",
"name": "dns",
"version": "0.1"
}
]
The MISP module service returns the available modules in a JSON array containing each module name along with their supported input attributes.
Based on this information, a query can be built in a JSON format and saved as body.json:
{
"results": [
{
"types": [
"ip-src",
"ip-dst"
],
"values": [
"188.65.217.78"
]
}
]
}
Then you can POST this JSON format query towards the MISP object server:
curl -s http://127.0.0.1:6666/query -H "Content-Type: application/json" --data @body.json -X POST