Merge branch 'main' of github.com:MISP/misp-training

0-intro-shorter/content.tex

@@ -24,7 +24,7 @@
 
 \begin{frame}
 \frametitle{about CIRCL}
-The Computer Incident Response Center Luxembourg (CIRCL) is a government-driven initiative designed to provide a systematic response facility to computer security threats and incidents. CIRCL is the CERT for the private sector, communes and non-governmental entities in Luxembourg and is operated by securitymadein.lu g.i.e.
+The Computer Incident Response Center Luxembourg (CIRCL) is a government-driven initiative designed to provide a systematic response facility to computer security threats and incidents. CIRCL is the CERT for the private sector, communes and non-governmental entities in Luxembourg and is operated by LHC g.i.e.
 \end{frame}
 
 \begin{frame}

3.1-misp-modules/content.tex

@@ -124,7 +124,7 @@
 \begin{frame}[fragile]
         \frametitle{Finding available MISP modules}
         \begin{itemize}
-                \item curl -s http://127.0.0.1:6666/modules
+                \item curl -s http://127.0.0.1:6666/modules | jq .
         \end{itemize}
         \begin{adjustbox}{width=\textwidth,height=6cm,keepaspectratio}
         \begin{lstlisting}[language=json,firstnumber=1]
@@ -305,10 +305,12 @@
       \begin{lstlisting}[language=python]
         import json
         import dns.resolver
-        misperrors = {'error' : 'Error'}
+        misperrors = {'error': 'Error'}
-        mispattributes = {'input': ['hostname', 'domain'], 'output': ['ip-src', 'ip-dst']}
+        mispattributes = {'input': ['hostname', 'domain', 'domain|ip'], 'output': ['ip-src','ip-dst']}
-        moduleinfo = {'version': '0.1', 'author': 'Alexandre Dulaunoy',
+        moduleinfo = {'version': '0.3', 'author': 'Alexandre Dulaunoy','description': 'Simple DNS expansion service to resolve IP address from MISP attributes',
-                      'description': 'Simple DNS expansion service to resolve IP address from MISP attributes', 'module-type': ['expansion','hover']}
+                    'module-type': ['expansion', 'hover']}
+        moduleconfig = ['nameserver']
+
         def handler(q=False):
             if q is False:
                 return False
@@ -317,32 +319,38 @@
                 toquery = request['hostname']
             elif request.get('domain'):
                 toquery = request['domain']
+            elif request.get('domain|ip'):
+                toquery = request['domain|ip'].split('|')[0]
             else:
                 return False
             r = dns.resolver.Resolver()
             r.timeout = 2
             r.lifetime = 2
-            r.nameservers = ['8.8.8.8']
+
+            if request.get('config'):
+                if request['config'].get('nameserver'):
+                    nameservers = []
+                    nameservers.append(request['config'].get('nameserver'))
+                    r.nameservers = nameservers
+            else:
+                r.nameservers = ['8.8.8.8']
+
             try:
-                answer = r.query(toquery, 'A')
+                answer = r.resolve(toquery, 'A')
             except dns.resolver.NXDOMAIN:
                 misperrors['error'] = "NXDOMAIN"
                 return misperrors
-            except dns.exception.Timeout:
+            except ...
-                misperrors['error'] = "Timeout"
+
-                return misperrors
+            return {'results': [{'types': mispattributes['output'], 'values':[str(answer[0])]}]}
-            except:
-                misperrors['error'] = "DNS resolving error"
-                return misperrors
-            r = {'results': [{'types': mispattributes['output'], 'values':[str(answer[0])]}]}
-            return r
 
         def introspection():
             return mispattributes
 
         def version():
+            moduleinfo['config'] = moduleconfig
             return moduleinfo
-              \end{lstlisting}
+        \end{lstlisting}
         \end{adjustbox}
 \end{frame}
 
@@ -370,21 +378,28 @@
 \end{frame}
 
 \begin{frame}[fragile]
-      \frametitle{Code samples (Configuration)}
+    \frametitle{Code samples (Configuration)}
-      \begin{adjustbox}{width=\textwidth,height=5cm,keepaspectratio}
+    \begin{adjustbox}{width=\textwidth,height=5cm,keepaspectratio}
-          \begin{lstlisting}[language=python]
+        \begin{lstlisting}[language=python]
-              # Configuration at the top
+            # Configuration at the top
-              moduleconfig = ['username', 'password']
+            moduleconfig = ['username', 'password']
-              # Code block in the handler
+
-                  if request.get('config'):
+            # Code block in the handler
-                      if (request['config'].get('username') is None) or (request['config'].get('password') is None):
+            if not request.get('config'):
-                          misperrors['error'] = 'CIRCL Passive SSL authentication is missing'
+                return {'error': 'CIRCL Passive SSL authentication is missing.'}
-                          return misperrors
+
+            if not request['config'].get('username') or not request['config'].get('password'):
+                return {'error': 'CIRCL Passive SSL authentication is incomplete, please provide your username and password.'}
+            authentication = (request['config']['username'], request['config']['password'])
+
+            if not request.get('attribute') or not check_input_attribute(request['attribute']):
+                return {'error': f'{standard_error_message}, which should contain at least a type, a value and an uuid.'}
+            attribute = request['attribute']
 -
-                  x = pypssl.PyPSSL(basic_auth=(request['config']['username'], request['config']['password']))
+            pssl_parser = PassiveSSLParser(attribute, authentication)
 
           \end{lstlisting}
-        \end{adjustbox}
+    \end{adjustbox}
 \end{frame}
 
 \begin{frame}[fragile]
@@ -398,12 +413,12 @@
                 \item DNS resolver
                 \item DomainTools
                 \item eupi (checking url in phishing database)
-                \item IntelMQ (experimental)
                 \item ipasn
                 \item PassiveTotal - http://blog.passivetotal.org/misp-sharing-done-differently
                 \item sourcecache
                 \item Virustotal
                 \item Whois
+                \item ...
         \end{itemize}
 \end{frame}
 
@@ -660,10 +675,53 @@
 \end{frame}
 
 \begin{frame}[fragile]
-        \frametitle{New expansion \& import modules view (MISP 2.4.110}
+        \frametitle{New expansion \& import modules view (MISP 2.4.110)}
     \includegraphics[scale=0.2]{new_format_view.png}
 \end{frame}
 
+
+\begin{frame}[fragile]
+    \frametitle{New - Standalone Functionality}
+    \begin{itemize}
+        \item Flexibility, no need to install MISP
+        \item User friendly interface
+        \item Easiest way to test new modules
+    \end{itemize}
+\end{frame}
+
+\begin{frame}[fragile]
+    \frametitle{Web interface - Query}
+    \begin{itemize}
+        \item Add multiple entries
+        \item Choose different modules
+    \end{itemize}
+    \includegraphics[scale=0.23]{screenshots/misp_module_index.png}
+\end{frame}
+
+\begin{frame}[fragile]
+    \frametitle{Web interface - Results}
+    \begin{itemize}
+        \item Multiple tabs for visualization in different formats
+    \end{itemize}
+    \includegraphics[scale=0.23]{screenshots/misp_module_results.png}
+\end{frame}
+
+\begin{frame}[fragile]
+    \frametitle{Web interface - History}
+    \begin{itemize}
+        \item Save your researches and pivot from them
+    \end{itemize}
+    \includegraphics[scale=0.23]{screenshots/misp_module_history.png}
+\end{frame}
+
+\begin{frame}[fragile]
+    \begin{itemize}
+        \item Export results to other tools. (Still in dev)
+    \end{itemize}
+    \frametitle{Web interface - External tools (Dev)}
+    \includegraphics[scale=0.23]{screenshots/misp_module_external_tools.png}
+\end{frame}
+
 \begin{frame}[fragile]
     \frametitle{Future of the modules system}
     \begin{itemize}

b.6-automation/content.tex

@@ -23,7 +23,7 @@
 
 \begin{frame}
     \frametitle{Automation in MISP: What already exists?}
-    \includegraphics[valign=m,width=16px]{pictures/python-logo.png}\hspace*{0.5em} \textbf{MISP API / PyMISP}
+    \includegraphics[valign=m,width=1em]{pictures/python-logo.png}\hspace*{0.5em} \textbf{MISP API / PyMISP}
     \hspace*{0.25em}
     \begin{itemize}
         \item Needs CRON Jobs in place
@@ -31,7 +31,7 @@
         \item Not realtime
     \end{itemize}
     \vspace*{1em}
-    \includegraphics[valign=m,width=16px]{pictures/zeromq.png}\hspace*{0.5em} \textbf{PubSub channels}
+    \includegraphics[valign=m,width=1em]{pictures/zeromq.png}\hspace*{0.5em} \textbf{PubSub channels}
     \hspace*{0.25em}
     \begin{itemize}
         \item After the actions happen: No feedback to MISP
@@ -97,7 +97,7 @@
 
 \begin{frame}
     \frametitle{Automation in MISP: What already exists?}
-    \includegraphics[valign=m,width=16px]{pictures/python-logo.png}\hspace*{0.5em} \textbf{MISP API / PyMISP}
+    \includegraphics[valign=m,width=1em]{pictures/python-logo.png}\hspace*{0.5em} \textbf{MISP API / PyMISP}
     \hspace*{0.25em}
     \begin{itemize}
         \item Needs CRON Jobs in place
@@ -105,7 +105,7 @@
         \item Not realtime
     \end{itemize}
     \vspace*{1em}
-    \includegraphics[valign=m,width=16px]{pictures/zeromq.png}\hspace*{0.5em} \textbf{PubSub channels}
+    \includegraphics[valign=m,width=1em]{pictures/zeromq.png}\hspace*{0.5em} \textbf{PubSub channels}
     \hspace*{0.25em}
     \begin{itemize}
         \item After the actions happen: No feedback to MISP
@@ -218,7 +218,7 @@
 
 \begin{frame}
     \frametitle{What kind of events?}
-    \includegraphics[width=60px]{pictures/sc-event.png}
+    \includegraphics[width=5em]{pictures/sc-event.png}
     \vspace*{0.5em}
     \begin{itemize}
         \item New MISP Event
@@ -235,7 +235,7 @@
 
 \begin{frame}
     \frametitle{Triggers currently available}
-    Currently 10 triggers can be hooked. 3 being \includegraphics[width=36px]{pictures/blocking-workflow.png}.
+    Currently 10 triggers can be hooked. 3 being \includegraphics[width=3em]{pictures/blocking-workflow.png}.
     \begin{center}
         \includegraphics[width=1.0\linewidth]{pictures/triggers.png}
     \end{center}
@@ -244,7 +244,7 @@
 \begin{frame}
     \frametitle{What kind of conditions?}
     \vspace*{0.25em}
-    \includegraphics[width=70px]{pictures/sc-condition.png}
+    \includegraphics[width=6em]{pictures/sc-condition.png}
     \vspace*{0.25em}
     \begin{itemize}
         \item A MISP Event is tagged with \texttt{tlp:red}
@@ -263,7 +263,7 @@
 \begin{frame}
     \frametitle{Workflow - Logic modules}
     \begin{itemize}
-        \item \includegraphics[width=12px]{pictures/sc-condition-icon.png} \textbf{logic} modules: Allow to redirect the execution flow.
+        \item \includegraphics[width=1em]{pictures/sc-condition-icon.png} \textbf{logic} modules: Allow to redirect the execution flow.
         \begin{itemize}
             \item IF conditions
             \item Delay execution
@@ -277,7 +277,7 @@
 \begin{frame}
     \frametitle{What kind of actions?}
     \vspace*{0.25em}
-    \includegraphics[width=60px]{pictures/sc-action.png}
+    \includegraphics[width=5em]{pictures/sc-action.png}
     \vspace*{0.25em}
     \begin{itemize}
         \item Send an email notification
@@ -297,7 +297,7 @@
 \begin{frame}
     \frametitle{Workflow - Action modules}
     \begin{itemize}
-        \item \includegraphics[width=12px]{pictures/sc-action-icon.png} \textbf{action} modules: Allow to executes operations
+        \item \includegraphics[width=1em]{pictures/sc-action-icon.png} \textbf{action} modules: Allow to executes operations
         \begin{itemize}
             \item Tag operations
             \item Send notifications
@@ -326,15 +326,15 @@
     \frametitle{Workflow execution for Event publish}
     \begin{itemize}
         \setlength\itemsep{1em}
-        \item[] \hspace*{-2em}\includegraphics[width=16px]{pictures/sc-event-icon.png} \hspace*{0.25em} An Event is about to be published
+        \item[] \hspace*{-2em}\includegraphics[width=1em]{pictures/sc-event-icon.png} \hspace*{0.25em} An Event is about to be published
         \begin{itemize}
             \item The workflow for the \texttt{event-publish} trigger starts
         \end{itemize}
-        \item[] \hspace*{-2em}\includegraphics[width=16px]{pictures/sc-condition-icon.png} \hspace*{0.25em} Conditions are evaluated
+        \item[] \hspace*{-2em}\includegraphics[width=1em]{pictures/sc-condition-icon.png} \hspace*{0.25em} Conditions are evaluated
         \begin{itemize}
             \item They might change the path taken during the execution
         \end{itemize}
-        \item[] \hspace*{-2em}\includegraphics[width=16px]{pictures/sc-action-icon.png} \hspace*{0.25em} Actions are executed
+        \item[] \hspace*{-2em}\includegraphics[width=1em]{pictures/sc-action-icon.png} \hspace*{0.25em} Actions are executed
         \begin{itemize}
             \setlength\itemsep{0.75em}
             \item {\bf\color{green!50!black}success}: Continue the publishing action
@@ -350,13 +350,13 @@
     Two types of workflows:
     \vspace{0.5em}
     \begin{itemize}
-        \item[] \hspace*{-2em}\includegraphics[valign=m,width=48px]{pictures/blocking-workflow.png} Workflows
+        \item[] \hspace*{-2em}\includegraphics[valign=m,width=4em]{pictures/blocking-workflow.png} Workflows
         \begin{itemize}
             \item Can prevent / block the original event to happen
-            \item If a \textbf{blocking module}\includegraphics[valign=b,width=12px]{pictures/blocking-module.png} blocks the action
+            \item If a \textbf{blocking module}\includegraphics[valign=b,width=1em]{pictures/blocking-module.png} blocks the action
         \end{itemize}
         \vspace{0.5em}
-        \item[] \hspace*{-2em}\includegraphics[valign=b,width=56px]{pictures/non-blocking-workflow.png} Workflows execution outcome has no impact
+        \item[] \hspace*{-2em}\includegraphics[valign=b,width=5em]{pictures/non-blocking-workflow.png} Workflows execution outcome has no impact
         \begin{itemize}
             \item No way to prevent something that happened in the past
         \end{itemize}
@@ -523,7 +523,7 @@ jq '.[] | select(.meta."module-type"[] | contains("action")) |
     \vspace*{3em}
     {\LARGE Let's see how to build a workflow!}
     \begin{center}
-        \includegraphics[width=24px]{pictures/build-icon.png}
+        \includegraphics[width=2em]{pictures/build-icon.png}
     \end{center}
 \end{frame}
 
@@ -545,7 +545,7 @@ jq '.[] | select(.meta."module-type"[] | contains("action")) |
     }
     \textbf{Objective:} Overview of some common pitfalls
     \begin{center}
-        \includegraphics[width=24px]{pictures/radar.png}
+        \includegraphics[width=2em]{pictures/radar.png}
     \end{center}
 \end{frame}
 
@@ -591,8 +591,8 @@ jq '.[] | select(.meta."module-type"[] | contains("action")) |
     \frametitle{Working with the editor}
     Cases showing a warning:
     \begin{itemize}
-        \item \textbf{Blocking} modules \includegraphics[width=10px]{pictures/blocking-module.png} in a \includegraphics[valign=b,width=56px]{pictures/non-blocking-workflow.png} workflow \includegraphics[width=0.12\linewidth]{pictures/time-machine.png}
+        \item \textbf{Blocking} modules \includegraphics[width=1em]{pictures/blocking-module.png} in a \includegraphics[valign=b,width=4em]{pictures/non-blocking-workflow.png} workflow \includegraphics[width=0.12\linewidth]{pictures/time-machine.png}
-        \item \textbf{Blocking} modules \includegraphics[width=10px]{pictures/blocking-module.png} after a \textbf{concurrent tasks} module
+        \item \textbf{Blocking} modules \includegraphics[width=1em]{pictures/blocking-module.png} after a \textbf{concurrent tasks} module
         \begin{center}
             \frame{\includegraphics[width=1.0\linewidth]{pictures/editor-warning-1.png}}
         \end{center}
@@ -611,7 +611,7 @@ jq '.[] | select(.meta."module-type"[] | contains("action")) |
 
 \begin{frame}
     \frametitle{Workflow blueprints}
-    \hspace*{0.9\textwidth}\includegraphics[width=32px]{pictures/blueprint-32.png}
+    \hspace*{0.9\textwidth}\includegraphics[width=3em]{pictures/blueprint-32.png}
     \vspace*{-2em}
     \begin{enumerate}
         \item Blueprints allow to \textbf{re-use parts} of a workflow in another one
@@ -644,7 +644,7 @@ jq '.[] | select(.meta."module-type"[] | contains("action")) |
     \begin{itemize}
         \item Logic module allowing \textbf{multiple output} connections
         \item \textbf{Postpone the execution} for remaining modules
-        \item Convert \includegraphics[valign=b,width=44px]{pictures/blocking-workflow.png} \faIcon{long-arrow-alt-right} \includegraphics[valign=b,width=56px]{pictures/non-blocking-workflow.png}
+        \item Convert \includegraphics[valign=b,width=4em]{pictures/blocking-workflow.png} \faIcon{long-arrow-alt-right} \includegraphics[valign=b,width=5em]{pictures/non-blocking-workflow.png}
     \end{itemize}
     \begin{center}
         \frame{\includegraphics[width=0.5\linewidth]{pictures/module-concurrent.png}}
@@ -1004,7 +1004,7 @@ jq '.[] | select(.meta."module-type"[] | contains("action")) |
 \begin{frame}
     \frametitle{Debugging Workflows: Debug mode}
     \begin{itemize}
-        \item The \includegraphics[width=70px]{pictures/debug-mode.png} can be turned on for each workflows
+        \item The \includegraphics[width=6em]{pictures/debug-mode.png} can be turned on for each workflows
         \item Each nodes will send data to the provided URL
         \begin{itemize}
             \item Configure the setting: \texttt{Plugin.Workflow\_debug\_url}
@@ -1151,9 +1151,9 @@ jq '.[] | select(.meta."module-type"[] | contains("action")) |
     \begin{columns}
         \begin{column}{0.55\textwidth}
             \begin{itemize}
-                \item More \includegraphics[width=12px]{pictures/sc-action-icon.png} modules
+                \item More \includegraphics[width=1em]{pictures/sc-action-icon.png} modules
-                \item More \includegraphics[width=12px]{pictures/sc-condition-icon.png} modules
+                \item More \includegraphics[width=1em]{pictures/sc-condition-icon.png} modules
-                \item More \includegraphics[width=12px]{pictures/sc-event-icon.png} triggers
+                \item More \includegraphics[width=1em]{pictures/sc-event-icon.png} triggers
                 \item More documentation
                 \item Recursion prevention system
                 \item On-the-fly data override?

b.6-automation/slide.tex

@@ -4,6 +4,7 @@
 \definecolor{textcolor}{RGB}{128, 128, 128}
 \definecolor{background}{RGB}{240, 247, 255}
 
+
 % \usepackage{pgfpages}
 % \setbeameroption{show notes on second screen=right}
 \usepackage[draft]{pdfcomment}
@@ -15,7 +16,7 @@
 \usepackage{listings}
 \usepackage{fontawesome5}
 \usepackage[export]{adjustbox}
-\usepackage{fourier}
+\usepackage{fourier-otf}
 \usetikzlibrary{positioning}
 \usetikzlibrary{shapes,arrows}
 

includes/agenda.txt

@@ -1,3 +1,3 @@
 \begin{itemize}
-    \item Agenda and details available \url{https://hdoc.csirt-tooling.org/tq-qyvTQTLeZ0wy-OPXjiw?view}
+    \item Agenda and details available \url{https://tinyurl.com/CRI-MISP}
 \end{itemize}

includes/location.txt

@@ -1 +1 @@
-CTIS 2022
+CRI MISP 2024