MISP
/
threat-actor-intelligence-server
mirror of https://github.com/MISP/threat-actor-intelligence-server
2
0
Fork 0
Code Issues Releases Wiki Activity

chg: [api] add /info entrypoint to give details about the version of threat actor galaxy loaded

pull/1/head
Alexandre Dulaunoy 2020-01-08 13:32:33 +01:00
parent a8de744ca1
commit 9e41395073
1 changed files with 15 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
bin/tai-server.py
View File

@ -5,6 +5,7 @@ from tornado.escape import json_decode, json_encode
import os.path import os.path
import sys import sys
import json import json
import datetime
class Query(tornado.web.RequestHandler): class Query(tornado.web.RequestHandler):
@ -47,10 +48,15 @@ class Get(tornado.web.RequestHandler):
result = {'error': 'UUID is not known in the MISP galaxy threat-actor'} result = {'error': 'UUID is not known in the MISP galaxy threat-actor'}
return self.write("{}".format(json.dumps(result))) return self.write("{}".format(json.dumps(result)))
class Info(tornado.web.RequestHandler):
def get(self):
return self.write("{}".format(json.dumps(tai_info)))
application = tornado.web.Application([ application = tornado.web.Application([
(r"/query", Query), (r"/query", Query),
(r"/get/(.*)", Get) (r"/get/(.*)", Get),
(r"/info", Info)
]) ])
if not (os.path.exists('../misp-galaxy/clusters/threat-actor.json')): if not (os.path.exists('../misp-galaxy/clusters/threat-actor.json')):
@ -61,17 +67,25 @@ with open('../misp-galaxy/clusters/threat-actor.json', 'rb') as galaxyta:
tai_full = {} tai_full = {}
tai_names = {} tai_names = {}
tai_info = {}
tai_info['version'] = threat_actors['version']
tai_info['number_actors'] = 0
tai_info['number_synonyms'] = 0
tai_info['started'] = datetime.datetime.now().strftime("%d/%m/%Y %H:%M:%S")
for threat_actor in threat_actors['values']: for threat_actor in threat_actors['values']:
tai_full[threat_actor['uuid']] = threat_actor tai_full[threat_actor['uuid']] = threat_actor
tai_names[threat_actor['value'].lower()] = [] tai_names[threat_actor['value'].lower()] = []
tai_names[threat_actor['value'].lower()].append(threat_actor['uuid']) tai_names[threat_actor['value'].lower()].append(threat_actor['uuid'])
tai_info['number_actors'] += 1
if 'meta' in threat_actor: if 'meta' in threat_actor:
if 'synonyms' in threat_actor['meta']: if 'synonyms' in threat_actor['meta']:
for synonym in threat_actor['meta']['synonyms']: for synonym in threat_actor['meta']['synonyms']:
if not synonym.lower() in tai_names: if not synonym.lower() in tai_names:
tai_names[synonym.lower()] = [] tai_names[synonym.lower()] = []
tai_names[synonym.lower()].append(threat_actor['uuid']) tai_names[synonym.lower()].append(threat_actor['uuid'])
tai_info['number_synonyms'] += 1
if __name__ == "__main__": if __name__ == "__main__":