misp-modules 2.4.196__py3-none-any.whl

misp_modules/modules/expansion/intel471.py

@@ -0,0 +1,73 @@
+import json
+from pyintel471 import PyIntel471
+
+misperrors = {'error': 'Error'}
+mispattributes = {'input': ['hostname', 'domain', 'url', 'ip-src', 'ip-dst', 'email-src',
+                            'email-dst', 'target-email', 'whois-registrant-email',
+                            'whois-registrant-name', 'md5', 'sha1', 'sha256'], 'output': ['freetext']}
+moduleinfo = {
+    'version': '0.1',
+    'author': 'Raphaël Vinot',
+    'description': 'Module to access Intel 471',
+    'module-type': ['hover', 'expansion'],
+    'name': 'Intel471 Lookup',
+    'logo': 'intel471.png',
+    'requirements': ['The intel471 python library'],
+    'features': 'The module uses the Intel471 python library to query the Intel471 API with the value of the input attribute. The result of the query is then returned as freetext so the Freetext import parses it.',
+    'references': ['https://public.intel471.com/'],
+    'input': 'A MISP attribute whose type is included in the following list:\n- hostname\n- domain\n- url\n- ip-src\n- ip-dst\n- email-src\n- email-dst\n- target-email\n- whois-registrant-email\n- whois-registrant-name\n- md5\n- sha1\n- sha256',
+    'output': 'Freetext',
+    'descrption': 'An expansion module to query Intel471 in order to get additional information about a domain, ip address, email address, url or hash.',
+}
+moduleconfig = ['email', 'authkey']
+
+
+def cleanup(response):
+    '''The entries have uids that will be recognised as hashes when they shouldn't'''
+    j = response.json()
+    if j['iocTotalCount'] == 0:
+        return 'Nothing has been found.'
+    for ioc in j['iocs']:
+        ioc.pop('uid')
+        if ioc['links']['actorTotalCount'] > 0:
+            for actor in ioc['links']['actors']:
+                actor.pop('uid')
+        if ioc['links']['reportTotalCount'] > 0:
+            for report in ioc['links']['reports']:
+                report.pop('uid')
+    return json.dumps(j, indent=2)
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    request = json.loads(q)
+    for input_type in mispattributes['input']:
+        if input_type in request:
+            to_query = request[input_type]
+            break
+    else:
+        misperrors['error'] = "Unsupported attributes type"
+        return misperrors
+
+    if (request.get('config')):
+        if (request['config'].get('email') is None) or (request['config'].get('authkey') is None):
+            misperrors['error'] = 'Intel 471 authentication is missing'
+            return misperrors
+
+    intel471 = PyIntel471(email=request['config'].get('email'), authkey=request['config'].get('authkey'))
+    ioc_filters = intel471.iocs_filters(ioc=to_query)
+    res = intel471.iocs(filters=ioc_filters)
+    to_return = cleanup(res)
+
+    r = {'results': [{'types': mispattributes['output'], 'values': to_return}]}
+    return r
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo

misp_modules/modules/expansion/intelmq_eventdb.py.experimental

@@ -0,0 +1,67 @@
+import json
+import psycopg2
+
+misperrors = {'error': 'Error'}
+mispattributes = {'input': ['hostname', 'domain', 'ip-src', 'ip-dst', 'AS'], 'output': ['freetext']}
+moduleinfo = {'version': '0.1', 'author': 'L. Aaron Kaplan <kaplan@cert.at>', 'description': 'Module to access intelmqs eventdb', 'module-type': ['expansion', 'hover']}
+moduleconfig = ['username', 'password', 'hostname', 'database']
+
+
+def connect(user, password, host, dbname):
+    try:
+        conn = psycopg2.connect(database=dbname,  user=user,  host=host,  password=password)
+    except Exception as e:
+        print("I am unable to connect to the database: %s" %e)
+    return conn
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    request = json.loads(q)
+    #if request.get('hostname'):
+    #    toquery = request['hostname']
+    #elif request.get('domain'):
+    #    toquery = request['domain']
+    if request.get('ip-src'):
+        toquery = request['ip-src']
+    #elif request.get('ip-dst'):
+    #    toquery = request['ip-dst']
+    #elif request.get('AS'):
+    #    toquery = request['AS']
+    else:
+        misperrors['error'] = "Unsupported attributes type"
+        return misperrors
+
+    if (request.get('config')):
+        if (request['config'].get('username') is None) or (request['config'].get('password') is None):
+            misperrors['error'] = 'intelmq eventdb authentication is missing'
+            return misperrors
+
+    conn = connect(request['config']['username'], request['config']['password'], request['config']['hostname'], request['config']['database'])
+    cur = conn.cursor()
+    SQL1 = 'SELECT COUNT(*) from events where "source.ip" = \'%s\'' %(toquery)
+    try:
+        cur.execute(SQL1)
+    except Exception as e:
+        misperrors['error'] = 'can not query database'
+        print(e)
+        return misperrors
+
+    results = cur.fetchone()
+
+    out = ''
+    out = out + "{} ".format(results[0]) + " results found in the DB"
+
+    r = {'results': [{'types': mispattributes['output'], 'values': out}]}
+    conn.close()
+    return r
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo

misp_modules/modules/expansion/ip2locationio.py

@@ -0,0 +1,90 @@
+import json
+import requests
+from . import check_input_attribute, standard_error_message
+from pymisp import MISPAttribute, MISPEvent, MISPObject
+
+mispattributes = {
+    'input': ['ip-src', 'ip-dst'],
+    'format': 'misp_standard'
+}
+moduleinfo = {
+    'version': 1,
+    'author': 'IP2Location.io',
+    'description': 'An expansion module to query IP2Location.io to gather more information on a given IP address.',
+    'module-type': ['expansion', 'hover'],
+    'name': 'IP2Location.io Lookup',
+    'logo': 'ip2locationio.png',
+    'requirements': ['An IP2Location.io token'],
+    'features': 'The module takes an IP address attribute as input and queries the IP2Location.io API.  \nFree plan user will get the basic geolocation informaiton, and different subsription plan will get more information on the IP address. \n Refer to [pricing page](https://www.ip2location.io/pricing) for more information on data available for each plan. \n\nMore information on the responses content is available in the [documentation](https://www.ip2location.io/ip2location-documentation).',
+    'references': ['https://www.ip2location.io/ip2location-documentation'],
+    'input': 'IP address attribute.',
+    'output': 'Additional information on the IP address, such as geolocation, proxy and so on. Refer to the Response Format section in https://www.ip2location.io/ip2location-documentation to find out the full format of the data returned.',
+}
+moduleconfig = ['key']
+
+_GEOLOCATION_OBJECT_MAPPING = {
+    'country_code': 'countrycode',
+    'country_name': 'country',
+    'region_name': 'region',
+    'city_name': 'city',
+    'zip_code': 'zipcode',
+    'latitude': 'latitude',
+    'longitude': 'longitude'
+}
+
+
+def handler(q=False):
+    # Input checks
+    if q is False:
+        return False
+    request = json.loads(q)
+    if not request.get('attribute') or not check_input_attribute(request['attribute']):
+        return {'error': f'{standard_error_message}, which should contain at least a type, a value and an uuid.'}
+    attribute = request['attribute']
+    if attribute.get('type') not in mispattributes['input']:
+        return {'error': 'Wrong input attribute type.'}
+    if not request.get('config'):
+        return {'error': 'Missing ip2locationio config.'}
+    if not request['config'].get('key'):
+        return {'error': 'Missing ip2locationio API key.'}
+
+    # Query ip2location.io
+    query = requests.get(
+        f"https://api.ip2location.io/json?key={request['config']['key']}&ip={attribute['value']}"
+    )
+    if query.status_code != 200:
+        return {'error': f'Error while querying ip2location.io - {query.status_code}: {query.reason}'}
+    iplio_result = query.json()
+
+    # Check if the IP address is not reserved for special use
+    # if ipinfo.get('bogon', False):
+    if '' in iplio_result and iplio_result[''] == 'RSV':
+        return {'error': 'The IP address is reserved for special use'}
+
+    # Initiate the MISP data structures
+    misp_event = MISPEvent()
+    input_attribute = MISPAttribute()
+    input_attribute.from_dict(**attribute)
+    misp_event.add_attribute(**input_attribute)
+
+    # Parse the geolocation information related to the IP address
+    geolocation = MISPObject('geolocation')
+    for field, relation in _GEOLOCATION_OBJECT_MAPPING.items():
+        geolocation.add_attribute(relation, iplio_result[field])
+    geolocation.add_reference(input_attribute.uuid, 'locates')
+    misp_event.add_object(geolocation)
+
+    # Return the results in MISP format
+    event = json.loads(misp_event.to_json())
+    return {
+        'results': {key: event[key] for key in ('Attribute', 'Object')}
+    }
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo

misp_modules/modules/expansion/ipasn.py

@@ -0,0 +1,70 @@
+# -*- coding: utf-8 -*-
+
+import json
+from . import check_input_attribute, standard_error_message
+from pyipasnhistory import IPASNHistory
+from pymisp import MISPAttribute, MISPEvent, MISPObject
+
+misperrors = {'error': 'Error'}
+mispattributes = {'input': ['ip-src', 'ip-dst', 'ip'], 'format': 'misp_standard'}
+moduleinfo = {
+    'version': '0.3',
+    'author': 'Raphaël Vinot',
+    'description': 'Module to query an IP ASN history service (https://github.com/D4-project/IPASN-History).',
+    'module-type': ['expansion', 'hover'],
+    'name': 'IPASN-History Lookup',
+    'logo': '',
+    'requirements': ['pyipasnhistory: Python library to access IPASN-history instance'],
+    'features': 'This module takes an IP address attribute as input and queries the CIRCL IPASN service. The result of the query is the latest asn related to the IP address, that is returned as a MISP object.',
+    'references': ['https://github.com/D4-project/IPASN-History'],
+    'input': 'An IP address MISP attribute.',
+    'output': 'Asn object(s) objects related to the IP address used as input.',
+}
+
+
+def parse_result(attribute, values):
+    event = MISPEvent()
+    initial_attribute = MISPAttribute()
+    initial_attribute.from_dict(**attribute)
+    event.add_attribute(**initial_attribute)
+    mapping = {'asn': ('AS', 'asn'), 'prefix': ('ip-src', 'subnet-announced')}
+    for last_seen, response in values['response'].items():
+        asn = MISPObject('asn')
+        asn.add_attribute('last-seen', **{'type': 'datetime', 'value': last_seen})
+        for feature, attribute_fields in mapping.items():
+            attribute_type, object_relation = attribute_fields
+            asn.add_attribute(object_relation, **{'type': attribute_type, 'value': response[feature]})
+        asn.add_reference(initial_attribute.uuid, 'related-to')
+        event.add_object(**asn)
+    event = json.loads(event.to_json())
+    return {key: event[key] for key in ('Attribute', 'Object')}
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    request = json.loads(q)
+    if not request.get('attribute') or not check_input_attribute(request['attribute']):
+        return {'error': f'{standard_error_message}, which should contain at least a type, a value and an uuid.'}
+    if request['attribute']['type'] not in mispattributes['input']:
+        return {'error': 'Unsupported attribute type.'}
+    if request['attribute']['type'] == 'ip':
+        request['attribute']['type'] = 'ip-src'
+
+    toquery = request['attribute']['value']
+
+    ipasn = IPASNHistory()
+    values = ipasn.query(toquery)
+
+    if not values:
+        misperrors['error'] = 'Unable to find the history of this IP'
+        return misperrors
+    return {'results': parse_result(request['attribute'], values)}
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    return moduleinfo

misp_modules/modules/expansion/ipinfo.py

@@ -0,0 +1,112 @@
+import json
+import requests
+from . import check_input_attribute, standard_error_message
+from pymisp import MISPAttribute, MISPEvent, MISPObject
+
+mispattributes = {
+    'input': ['ip-src', 'ip-dst'],
+    'format': 'misp_standard'
+}
+moduleinfo = {
+    'version': 1,
+    'author': 'Christian Studer',
+    'description': 'An expansion module to query ipinfo.io to gather more information on a given IP address.',
+    'module-type': ['expansion', 'hover'],
+    'name': 'IPInfo.io Lookup',
+    'logo': 'ipinfo.png',
+    'requirements': ['An ipinfo.io token'],
+    'features': 'The module takes an IP address attribute as input and queries the ipinfo.io API.  \nThe geolocation information on the IP address is always returned.\n\nDepending on the subscription plan, the API returns different pieces of information then:\n- With a basic plan (free) you get the AS number and the AS organisation name concatenated in the `org` field.\n- With a paid subscription, the AS information is returned in the `asn` field with additional AS information, and depending on which plan the user has, you can also get information on the privacy method used to protect the IP address, the related domains, or the point of contact related to the IP address in case of an abuse.\n\nMore information on the responses content is available in the [documentation](https://ipinfo.io/developers).',
+    'references': ['https://ipinfo.io/developers'],
+    'input': 'IP address attribute.',
+    'output': 'Additional information on the IP address, like its geolocation, the autonomous system it is included in, and the related domain(s).',
+}
+moduleconfig = ['token']
+
+_GEOLOCATION_OBJECT_MAPPING = {
+    'city': 'city',
+    'postal': 'zipcode',
+    'region': 'region',
+    'country': 'countrycode'
+}
+
+
+def handler(q=False):
+    # Input checks
+    if q is False:
+        return False
+    request = json.loads(q)
+    if not request.get('attribute') or not check_input_attribute(request['attribute']):
+        return {'error': f'{standard_error_message}, which should contain at least a type, a value and an uuid.'}
+    attribute = request['attribute']
+    if attribute.get('type') not in mispattributes['input']:
+        return {'error': 'Wrong input attribute type.'}
+    if not request.get('config'):
+        return {'error': 'Missing ipinfo config.'}
+    if not request['config'].get('token'):
+        return {'error': 'Missing ipinfo token.'}
+
+    # Query ipinfo.io
+    query = requests.get(
+        f"https://ipinfo.io/{attribute['value']}/json?token={request['config']['token']}"
+    )
+    if query.status_code != 200:
+        return {'error': f'Error while querying ipinfo.io - {query.status_code}: {query.reason}'}
+    ipinfo = query.json()
+
+    # Check if the IP address is not reserved for special use
+    if ipinfo.get('bogon', False):
+        return {'error': 'The IP address is reserved for special use'}
+
+    # Initiate the MISP data structures
+    misp_event = MISPEvent()
+    input_attribute = MISPAttribute()
+    input_attribute.from_dict(**attribute)
+    misp_event.add_attribute(**input_attribute)
+
+    # Parse the geolocation information related to the IP address
+    geolocation = MISPObject('geolocation')
+    for field, relation in _GEOLOCATION_OBJECT_MAPPING.items():
+        geolocation.add_attribute(relation, ipinfo[field])
+    for relation, value in zip(('latitude', 'longitude'), ipinfo['loc'].split(',')):
+        geolocation.add_attribute(relation, value)
+    geolocation.add_reference(input_attribute.uuid, 'locates')
+    misp_event.add_object(geolocation)
+
+    # Parse the domain information
+    domain_ip = misp_event.add_object(name='domain-ip')
+    for feature in ('hostname', 'ip'):
+        domain_ip.add_attribute(feature, ipinfo[feature])
+    domain_ip.add_reference(input_attribute.uuid, 'resolves')
+    if ipinfo.get('domain') is not None:
+        for domain in ipinfo['domain']['domains']:
+            domain_ip.add_attribute('domain', domain)
+
+    # Parse the AS information
+    asn = MISPObject('asn')
+    asn.add_reference(input_attribute.uuid, 'includes')
+    if ipinfo.get('asn') is not None:
+        asn_info = ipinfo['asn']
+        asn.add_attribute('asn', asn_info['asn'])
+        asn.add_attribute('description', asn_info['name'])
+        misp_event.add_object(asn)
+    elif ipinfo.get('org'):
+        as_value, *description = ipinfo['org'].split(' ')
+        asn.add_attribute('asn', as_value)
+        asn.add_attribute('description', ' '.join(description))
+        misp_event.add_object(asn)
+
+
+    # Return the results in MISP format
+    event = json.loads(misp_event.to_json())
+    return {
+        'results': {key: event[key] for key in ('Attribute', 'Object')}
+    }
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo