mirror of https://github.com/MISP/misp-modules
108 lines
4.3 KiB
Python
Executable File
108 lines
4.3 KiB
Python
Executable File
#!/usr/bin/env python3
|
|
# -*- coding: utf-8 -*-
|
|
|
|
import json
|
|
|
|
from pymisp import MISPEvent
|
|
from pymisp.tools import reportlab_generator
|
|
|
|
misperrors = {'error': 'Error'}
|
|
|
|
moduleinfo = {
|
|
'version': '2',
|
|
'author': 'Vincent Falconieri (prev. Raphaël Vinot)',
|
|
'description': 'Simple export of a MISP event to PDF.',
|
|
'module-type': ['export'],
|
|
'name': 'Event to PDF Export',
|
|
'require_standard_format': True,
|
|
'logo': '',
|
|
'requirements': ['PyMISP', 'reportlab'],
|
|
'features': "The module takes care of the PDF file building, and work with any MISP Event. Except the requirement of reportlab, used to create the file, there is no special feature concerning the Event. Some parameters can be given through the config dict. 'MISP_base_url_for_dynamic_link' is your MISP URL, to attach an hyperlink to your event on your MISP instance from the PDF. Keep it clear to avoid hyperlinks in the generated pdf.\n 'MISP_name_for_metadata' is your CERT or MISP instance name. Used as text in the PDF' metadata\n 'Activate_textual_description' is a boolean (True or void) to activate the textual description/header abstract of an event\n 'Activate_galaxy_description' is a boolean (True or void) to activate the description of event related galaxies.\n 'Activate_related_events' is a boolean (True or void) to activate the description of related event. Be aware this might leak information on confidential events linked to the current event !\n 'Activate_internationalization_fonts' is a boolean (True or void) to activate Noto fonts instead of default fonts (Helvetica). This allows the support of CJK alphabet. Be sure to have followed the procedure to download Noto fonts (~70Mo) in the right place (/tools/pdf_fonts/Noto_TTF), to allow PyMisp to find and use them during PDF generation.\n 'Custom_fonts_path' is a text (path or void) to the TTF file of your choice, to create the PDF with it. Be aware the PDF won't support bold/italic/special style anymore with this option ",
|
|
'references': ['https://acrobat.adobe.com/us/en/acrobat/about-adobe-pdf.html'],
|
|
'input': 'MISP Event',
|
|
'output': 'MISP Event in a PDF file.',
|
|
}
|
|
|
|
# config fields that your code expects from the site admin
|
|
moduleconfig = ["MISP_base_url_for_dynamic_link", "MISP_name_for_metadata", "Activate_textual_description", "Activate_galaxy_description", "Activate_related_events", "Activate_internationalization_fonts", "Custom_fonts_path"]
|
|
mispattributes = {}
|
|
|
|
outputFileExtension = "pdf"
|
|
responseType = "application/pdf"
|
|
|
|
types_to_attach = ['ip-dst', 'url', 'domain']
|
|
objects_to_attach = ['domain-ip']
|
|
|
|
|
|
class ReportGenerator():
|
|
def __init__(self):
|
|
self.report = ''
|
|
|
|
def from_remote(self, event_id):
|
|
from pymisp import PyMISP
|
|
from keys import misp_url, misp_key, misp_verifycert
|
|
misp = PyMISP(misp_url, misp_key, misp_verifycert)
|
|
result = misp.get(event_id)
|
|
self.misp_event = MISPEvent()
|
|
self.misp_event.load(result)
|
|
|
|
def from_event(self, event):
|
|
self.misp_event = MISPEvent()
|
|
self.misp_event.load(event)
|
|
|
|
|
|
def handler(q=False):
|
|
if q is False:
|
|
return False
|
|
|
|
request = json.loads(q)
|
|
|
|
if 'data' not in request:
|
|
return False
|
|
|
|
config = {}
|
|
|
|
# Construct config object for reportlab_generator
|
|
for config_item in moduleconfig:
|
|
if (request.get('config')) and (request['config'].get(config_item) is not None):
|
|
config[config_item] = request['config'].get(config_item)
|
|
|
|
for evt in request['data']:
|
|
misp_event = MISPEvent()
|
|
misp_event.load(evt)
|
|
|
|
pdf = reportlab_generator.get_base64_from_value(reportlab_generator.convert_event_in_pdf_buffer(misp_event, config))
|
|
|
|
return {'response': [], 'data': str(pdf, 'utf-8')}
|
|
|
|
|
|
def introspection():
|
|
modulesetup = {}
|
|
try:
|
|
responseType
|
|
modulesetup['responseType'] = responseType
|
|
except NameError:
|
|
pass
|
|
|
|
try:
|
|
userConfig
|
|
modulesetup['userConfig'] = userConfig
|
|
except NameError:
|
|
pass
|
|
try:
|
|
outputFileExtension
|
|
modulesetup['outputFileExtension'] = outputFileExtension
|
|
except NameError:
|
|
pass
|
|
try:
|
|
inputSource
|
|
modulesetup['inputSource'] = inputSource
|
|
except NameError:
|
|
pass
|
|
return modulesetup
|
|
|
|
|
|
def version():
|
|
moduleinfo['config'] = moduleconfig
|
|
return moduleinfo
|