MISP
/
misp-warninglists
mirror of https://github.com/MISP/misp-warninglists
2
0
Fork 0
Code Issues Releases Wiki Activity

updated MS O365 script to handle json and updated list.json

pull/96/head
Faber 2019-03-09 19:43:13 -05:00
parent b6fed81a87
commit 91d77374ff
2 changed files with 739 additions and 1511 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1084
lists/microsoft-office365/list.json
View File

File diff suppressed because it is too large Load Diff

16
tools/generate-office365.py
View File

@ -2,16 +2,18 @@
# -*- coding: utf-8 -*- # -*- coding: utf-8 -*-
import requests import requests
import xml.etree.ElementTree as ET
import json import json
import datetime import datetime
url = 'https://support.content.office.net/en-us/static/O365IPAddresses.xml' url = 'https://endpoints.office.com/endpoints/worldwide?clientrequestid=b10c5ed1-bad1-445f-b386-b919946339a7'
r = requests.get(url) r = requests.get(url)
office365 = ET.fromstring(r.text) service_list = r.json()
l = [] l = []
for address in office365.iter('address'): for service in service_list:
l.append(address.text.replace('*', '')) for url in service.get('urls', []):
l.append(url.replace('*', ''))
for ip in service.get('ips', []):
l.append(ip)
warninglist = {} warninglist = {}
warninglist['name'] = 'List of known Office 365 URLs and IP address ranges' warninglist['name'] = 'List of known Office 365 URLs and IP address ranges'
@ -20,5 +22,5 @@ warninglist['description'] = 'Office 365 URLs and IP address ranges'
warninglist['list'] = sorted(set(l)) warninglist['list'] = sorted(set(l))
warninglist['matching_attributes'] = ["ip-src", "ip-dst", "domain|ip", "hostname"] warninglist['matching_attributes'] = ["ip-src", "ip-dst", "domain|ip", "hostname"]
with open('../lists/microsoft-office365/list.json', 'w') as data_file:
print(json.dumps(warninglist)) json.dump(warninglist, data_file, indent=4, sort_keys=True)