misp-modules 2.4.196__py3-none-any.whl

misp_modules/modules/expansion/mcafee_insights_enrich.py

@@ -0,0 +1,249 @@
+# Written by mohlcyber 13.08.2021
+# MISP Module for McAfee MVISION Insights to query campaign details
+
+import json
+import logging
+import requests
+import sys
+
+from . import check_input_attribute, standard_error_message
+from pymisp import MISPAttribute, MISPEvent, MISPObject
+
+misperrors = {'error': 'Error'}
+mispattributes = {'input': ["md5", "sha1", "sha256"],
+                  'format': 'misp_standard'}
+
+# possible module-types: 'expansion', 'hover' or both
+moduleinfo = {
+    'version': '1',
+    'author': 'Martin Ohl',
+    'description': 'Lookup McAfee MVISION Insights Details',
+    'module-type': ['hover'],
+    'name': 'McAfee MVISION Insights Lookup',
+    'logo': '',
+    'requirements': [],
+    'features': '',
+    'references': [],
+    'input': '',
+    'output': '',
+}
+
+# config fields that your code expects from the site admin
+moduleconfig = ['api_key', 'client_id', 'client_secret']
+
+
+class MVAPI():
+    def __init__(self, attribute, api_key, client_id, client_secret):
+        self.misp_event = MISPEvent()
+        self.attribute = MISPAttribute()
+        self.attribute.from_dict(**attribute)
+        self.misp_event.add_attribute(**self.attribute)
+
+        self.base_url = 'https://api.mvision.mcafee.com'
+        self.session = requests.Session()
+
+        self.api_key = api_key
+        auth = (client_id, client_secret)
+
+        self.logging()
+        self.auth(auth)
+
+    def logging(self):
+        self.logger = logging.getLogger('logs')
+        self.logger.setLevel('INFO')
+        handler = logging.StreamHandler()
+        formatter = logging.Formatter("%(asctime)s;%(levelname)s;%(message)s")
+        handler.setFormatter(formatter)
+        self.logger.addHandler(handler)
+
+    def auth(self, auth):
+        iam_url = "https://iam.mcafee-cloud.com/iam/v1.1/token"
+
+        headers = {
+            'x-api-key': self.api_key,
+            'Content-Type': 'application/vnd.api+json'
+        }
+
+        payload = {
+            "grant_type": "client_credentials",
+            "scope": "ins.user ins.suser ins.ms.r"
+        }
+
+        res = self.session.post(iam_url, headers=headers, auth=auth, data=payload)
+
+        if res.status_code != 200:
+            self.logger.error('Could not authenticate to get the IAM token: {0} - {1}'.format(res.status_code, res.text))
+            sys.exit()
+        else:
+            self.logger.info('Successful authenticated.')
+            access_token = res.json()['access_token']
+            headers['Authorization'] = 'Bearer ' + access_token
+            self.session.headers = headers
+
+    def search_ioc(self):
+        filters = {
+            'filter[type][eq]': self.attribute.type,
+            'filter[value]': self.attribute.value,
+            'fields': 'id, type, value, coverage, uid, is_coat, is_sdb_dirty, category, comment, campaigns, threat, prevalence'
+        }
+        res = self.session.get(self.base_url + '/insights/v2/iocs', params=filters)
+
+        if res.ok:
+            if len(res.json()['data']) == 0:
+                self.logger.info('No Hash details in MVISION Insights found.')
+            else:
+                self.logger.info('Successfully retrieved MVISION Insights details.')
+                self.logger.debug(res.text)
+                return res.json()
+        else:
+            self.logger.error('Error in search_ioc. HTTP {0} - {1}'.format(str(res.status_code), res.text))
+            sys.exit()
+
+    def prep_result(self, ioc):
+        res = ioc['data'][0]
+        results = []
+
+        # Parse out Attribute Category
+        category_attr = {
+            'type': 'text',
+            'object_relation': 'text',
+            'value': 'Attribute Category: {0}'.format(res['attributes']['category'])
+        }
+        results.append(category_attr)
+
+        # Parse out Attribute Comment
+        comment_attr = {
+            'type': 'text',
+            'object_relation': 'text',
+            'value': 'Attribute Comment: {0}'.format(res['attributes']['comment'])
+        }
+        results.append(comment_attr)
+
+        # Parse out Attribute Dat Coverage
+        cover_attr = {
+            'type': 'text',
+            'object_relation': 'text',
+            'value': 'Dat Version Coverage: {0}'.format(res['attributes']['coverage']['dat_version']['min'])
+        }
+        results.append(cover_attr)
+
+        # Parse out if Dirty
+        cover_attr = {
+            'type': 'text',
+            'object_relation': 'text',
+            'value': 'Is Dirty: {0}'.format(res['attributes']['is-sdb-dirty'])
+        }
+        results.append(cover_attr)
+
+        # Parse our targeted countries
+        countries_dict = []
+        countries = res['attributes']['prevalence']['countries']
+
+        for country in countries:
+            countries_dict.append(country['iso_code'])
+
+        country_attr = {
+            'type': 'text',
+            'object_relation': 'text',
+            'value': 'Targeted Countries: {0}'.format(countries_dict)
+        }
+        results.append(country_attr)
+
+        # Parse out targeted sectors
+        sectors_dict = []
+        sectors = res['attributes']['prevalence']['sectors']
+
+        for sector in sectors:
+            sectors_dict.append(sector['sector'])
+
+        sector_attr = {
+            'type': 'text',
+            'object_relation': 'text',
+            'value': 'Targeted Sectors: {0}'.format(sectors_dict)
+        }
+        results.append(sector_attr)
+
+        # Parse out Threat Classification
+        threat_class_attr = {
+            'type': 'text',
+            'object_relation': 'text',
+            'value': 'Threat Classification: {0}'.format(res['attributes']['threat']['classification'])
+        }
+        results.append(threat_class_attr)
+
+        # Parse out Threat Name
+        threat_name_attr = {
+            'type': 'text',
+            'object_relation': 'text',
+            'value': 'Threat Name: {0}'.format(res['attributes']['threat']['name'])
+        }
+        results.append(threat_name_attr)
+
+        # Parse out Threat Severity
+        threat_sev_attr = {
+            'type': 'text',
+            'object_relation': 'text',
+            'value': 'Threat Severity: {0}'.format(res['attributes']['threat']['severity'])
+        }
+        results.append(threat_sev_attr)
+
+        # Parse out Attribute ID
+        attr_id = {
+            'type': 'text',
+            'object_relation': 'text',
+            'value': 'Attribute ID: {0}'.format(res['id'])
+        }
+        results.append(attr_id)
+
+        # Parse out Campaign Relationships
+        campaigns = ioc['included']
+
+        for campaign in campaigns:
+            campaign_attr = {
+                'type': 'campaign-name',
+                'object_relation': 'campaign-name',
+                'value': campaign['attributes']['name']
+            }
+            results.append(campaign_attr)
+
+        mv_insights_obj = MISPObject(name='MVISION Insights Details')
+        for mvi_res in results:
+            mv_insights_obj.add_attribute(**mvi_res)
+        mv_insights_obj.add_reference(self.attribute.uuid, 'mvision-insights-details')
+
+        self.misp_event.add_object(mv_insights_obj)
+
+        event = json.loads(self.misp_event.to_json())
+        results_mvi = {key: event[key] for key in ('Attribute', 'Object') if (key in event and event[key])}
+
+        return {'results': results_mvi}
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    request = json.loads(q)
+
+    if not request.get('config') or not request['config'].get('api_key') or not request['config'].get('client_id') or not request['config'].get('client_secret'):
+        misperrors['error'] = "Please provide MVISION API Key, Client ID and Client Secret."
+        return misperrors
+    if request['attribute']['type'] not in mispattributes['input']:
+        return {'error': 'Unsupported attribute type. Please use {0}'.format(mispattributes['input'])}
+
+    api_key = request['config']['api_key']
+    client_id = request['config']['client_id']
+    client_secret = request['config']['client_secret']
+    attribute = request['attribute']
+
+    mvi = MVAPI(attribute, api_key, client_id, client_secret)
+    res = mvi.search_ioc()
+    return mvi.prep_result(res)
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo

misp_modules/modules/expansion/mmdb_lookup.py

@@ -0,0 +1,138 @@
+import json
+import requests
+from . import check_input_attribute, standard_error_message
+from pymisp import MISPEvent, MISPObject
+
+misperrors = {'error': 'Error'}
+mispattributes = {'input': ['ip-src', 'ip-src|port', 'ip-dst', 'ip-dst|port'], 'format': 'misp_standard'}
+moduleinfo = {
+    'version': '1',
+    'author': 'Jeroen Pinoy',
+    'description': "A hover and expansion module to enrich an ip with geolocation and ASN information from an mmdb server instance, such as CIRCL's ip.circl.lu.",
+    'module-type': ['expansion', 'hover'],
+    'name': 'GeoIP Enrichment',
+    'logo': 'circl.png',
+    'requirements': [],
+    'features': 'The module takes an IP address related attribute as input.\n It queries the public CIRCL.lu mmdb-server instance, available at ip.circl.lu, by default. The module can be configured with a custom mmdb server url if required.\n It is also possible to filter results on 1 db_source by configuring db_source_filter.',
+    'references': ['https://data.public.lu/fr/datasets/geo-open-ip-address-geolocation-per-country-in-mmdb-format/', 'https://github.com/adulau/mmdb-server'],
+    'input': 'An IP address attribute (for example ip-src or ip-src|port).',
+    'output': 'Geolocation and asn objects.',
+}
+moduleconfig = ["custom_API", "db_source_filter"]
+mmdblookup_url = 'https://ip.circl.lu/'
+
+
+class MmdbLookupParser():
+    def __init__(self, attribute, mmdblookupresult, api_url):
+        self.attribute = attribute
+        self.mmdblookupresult = mmdblookupresult
+        self.api_url = api_url
+        self.misp_event = MISPEvent()
+        self.misp_event.add_attribute(**attribute)
+
+    def get_result(self):
+        event = json.loads(self.misp_event.to_json())
+        results = {key: event[key] for key in ('Attribute', 'Object') if (key in event and event[key])}
+        return {'results': results}
+
+    def parse_mmdblookup_information(self):
+        # There is a chance some db's have a hit while others don't so we have to check if entry is empty each time
+        for result_entry in self.mmdblookupresult:
+            if result_entry['country_info']:
+                mmdblookup_object = MISPObject('geolocation')
+                mmdblookup_object.add_attribute('country',
+                                                **{'type': 'text', 'value': result_entry['country_info']['Country']})
+                mmdblookup_object.add_attribute('countrycode',
+                                                **{'type': 'text', 'value': result_entry['country']['iso_code']})
+                mmdblookup_object.add_attribute('latitude',
+                                                **{'type': 'float',
+                                                   'value': result_entry['country_info']['Latitude (average)']})
+                mmdblookup_object.add_attribute('longitude',
+                                                **{'type': 'float',
+                                                   'value': result_entry['country_info']['Longitude (average)']})
+                mmdblookup_object.add_attribute('text',
+                                                **{'type': 'text',
+                                                   'value': 'db_source: {}. build_db: {}. Latitude and longitude are country average.'.format(
+                                                       result_entry['meta']['db_source'],
+                                                       result_entry['meta']['build_db'])})
+                mmdblookup_object.add_reference(self.attribute['uuid'], 'related-to')
+                self.misp_event.add_object(mmdblookup_object)
+                if 'AutonomousSystemNumber' in result_entry['country']:
+                    mmdblookup_object_asn = MISPObject('asn')
+                    mmdblookup_object_asn.add_attribute('asn',
+                                                        **{'type': 'text',
+                                                           'value': result_entry['country'][
+                                                               'AutonomousSystemNumber']})
+                    mmdblookup_object_asn.add_attribute('description',
+                                                        **{'type': 'text',
+                                                           'value': 'ASNOrganization: {}. db_source: {}. build_db: {}.'.format(
+                                                               result_entry['country'][
+                                                                   'AutonomousSystemOrganization'],
+                                                               result_entry['meta']['db_source'],
+                                                               result_entry['meta']['build_db'])})
+                    mmdblookup_object_asn.add_reference(self.attribute['uuid'], 'related-to')
+                    self.misp_event.add_object(mmdblookup_object_asn)
+
+
+def check_url(url):
+    return "{}/".format(url) if not url.endswith('/') else url
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    request = json.loads(q)
+    if not request.get('attribute') or not check_input_attribute(request['attribute']):
+        return {'error': f'{standard_error_message}, which should contain at least a type, a value and an uuid.'}
+    attribute = request['attribute']
+    if attribute.get('type') == 'ip-src':
+        toquery = attribute['value']
+    elif attribute.get('type') == 'ip-src|port':
+        toquery = attribute['value'].split('|')[0]
+    elif attribute.get('type') == 'ip-dst':
+        toquery = attribute['value']
+    elif attribute.get('type') == 'ip-dst|port':
+        toquery = attribute['value'].split('|')[0]
+    else:
+        misperrors['error'] = 'There is no attribute of type ip-src or ip-dst provided as input'
+        return misperrors
+    api_url = check_url(request['config']['custom_API']) if 'config' in request and request['config'].get(
+        'custom_API') else mmdblookup_url
+    r = requests.get("{}/geolookup/{}".format(api_url, toquery))
+    if r.status_code == 200:
+        mmdblookupresult = r.json()
+        if not mmdblookupresult or len(mmdblookupresult) == 0:
+            misperrors['error'] = 'Empty result returned by server'
+            return misperrors
+        if 'config' in request and request['config'].get('db_source_filter'):
+            db_source_filter = request['config'].get('db_source_filter')
+            mmdblookupresult = [entry for entry in mmdblookupresult if entry['meta']['db_source'] == db_source_filter]
+            if not mmdblookupresult or len(mmdblookupresult) == 0:
+                misperrors['error'] = 'There was no result with the selected db_source'
+                return misperrors
+        # Server might return one or multiple entries which could all be empty, we check if there is at least one
+        # non-empty result below
+        empty_result = True
+        for lookup_result_entry in mmdblookupresult:
+            if lookup_result_entry['country_info']:
+                empty_result = False
+                break
+        if empty_result:
+            misperrors['error'] = 'Empty result returned by server'
+            return misperrors
+    else:
+        misperrors['error'] = 'API not accessible - http status code {} was returned'.format(r.status_code)
+        return misperrors
+    parser = MmdbLookupParser(attribute, mmdblookupresult, api_url)
+    parser.parse_mmdblookup_information()
+    result = parser.get_result()
+    return result
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo

misp_modules/modules/expansion/module.py.skeleton

@@ -0,0 +1,44 @@
+import json
+
+misperrors = {'error': 'Error'}
+mispattributes = {'input': ['hostname', 'domain'], 'output': ['ip-src',
+                                                              'ip-dst']}
+
+# possible module-types: 'expansion', 'hover' or both
+moduleinfo = {'version': '1', 'author': 'YOUR_NAME_HERE',
+              'description': 'MODULE_DESCRIPTION',
+              'module-type': ['expansion', 'hover']}
+
+# config fields that your code expects from the site admin
+moduleconfig = []
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    request = json.loads(q)
+    # You code that converts the data passed along in request
+    #  input will be the query values
+    #  output should be a list of dictionaries with types and values
+    # The types will be the types that the user can choose between
+    #  for a given value
+    # An example would be a network indicator enrichment that returns
+    #  a list of IP addresses and domain names.
+    # IP addresses would allow for attributes type ip-src and ip-dst,
+    #  either of which the user can choose
+    # So the resulting list would look like this:
+    # r = {'results': [{'types': ['ip-src', 'ip-dst'], 'values': ips},
+    #                 {'types': ['domain'], 'values': domains}]}
+    r = {'results': [{'types': types1, 'values': values1},
+                     {'types': types2, 'values': values2}]}
+    return r
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo
+

misp_modules/modules/expansion/mwdb.py

@@ -0,0 +1,152 @@
+import json
+import sys
+import base64
+#from distutils.util import strtobool
+
+import io
+import zipfile
+
+from pymisp import PyMISP
+from mwdblib import MWDB
+
+misperrors = {'error': 'Error'}
+mispattributes = {'input': ['attachment', 'malware-sample'], 'output': ['link']}
+moduleinfo = {
+    'version': '1',
+    'author': 'Koen Van Impe',
+    'description': 'Module to push malware samples to a MWDB instance',
+    'module-type': ['expansion'],
+    'name': 'MWDB Submit',
+    'logo': '',
+    'requirements': ['* mwdblib installed (pip install mwdblib) ; * (optional) keys.py file to add tags of events/attributes to MWDB * (optional) MWDB attribute created for the link back to MISP (defined in mwdb_misp_attribute)'],
+    'features': 'An expansion module to push malware samples to a MWDB (https://github.com/CERT-Polska/mwdb-core) instance. This module does not push samples to a sandbox. This can be achieved via Karton (connected to the MWDB). Does: * Upload of attachment or malware sample to MWDB * Tags of events and/or attributes are added to MWDB. * Comment of the MISP attribute is added to MWDB. * A link back to the MISP event is added to MWDB via the MWDB attribute.  * A link to the MWDB attribute is added as an enrichted attribute to the MISP event.',
+    'references': [],
+    'input': 'Attachment or malware sample',
+    'output': 'Link attribute that points to the sample at the MWDB instane',
+}
+
+moduleconfig = ['mwdb_apikey', 'mwdb_url', 'mwdb_misp_attribute', 'mwdb_public', 'include_tags_event', 'include_tags_attribute']
+
+pymisp_keys_file = "/var/www/MISP/PyMISP/"
+mwdb_public_default = True
+
+"""
+An expansion module to push malware samples to a MWDB (https://github.com/CERT-Polska/mwdb-core) instance.
+This module does not push samples to a sandbox. This can be achieved via Karton (connected to the MWDB)
+
+Does:
+- Upload of attachment or malware sample to MWDB
+- Tags of events and/or attributes are added to MWDB.
+- Comment of the MISP attribute is added to MWDB.
+- A link back to the MISP event is added to MWDB via the MWDB attribute.
+- A link to the MWDB attribute is added as an enriched attribute to the MISP event.
+
+Requires
+- mwdblib installed (pip install mwdblib)
+- (optional) keys.py file to add tags of events/attributes to MWDB
+- (optional) MWDB "attribute" created for the link back to MISP (defined in mwdb_misp_attribute)
+"""
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    request = json.loads(q)
+
+    try:
+        data = request.get("data")
+        if 'malware-sample' in request:
+            # malicious samples are encrypted with zip (password infected) and then base64 encoded
+            sample_filename = request.get("malware-sample").split("|", 1)[0]
+            data = base64.b64decode(data)
+            fl = io.BytesIO(data)
+            zf = zipfile.ZipFile(fl)
+            sample_hashname = zf.namelist()[0]
+            data = zf.read(sample_hashname, b"infected")
+            zf.close()
+        elif 'attachment' in request:
+            # All attachments get base64 encoded
+            sample_filename = request.get("attachment")
+            data = base64.b64decode(data)
+
+        else:
+            misperrors['error'] = "No malware sample or attachment supplied"
+            return misperrors
+    except Exception:
+        misperrors['error'] = "Unable to process submited sample data"
+        return misperrors
+
+    if (request["config"].get("mwdb_apikey") is None) or (request["config"].get("mwdb_url") is None):
+        misperrors["error"] = "Missing MWDB API key or server URL"
+        return misperrors
+
+    mwdb_misp_attribute = request["config"].get("mwdb_misp_attribute")
+    mwdb_public = request["config"].get("mwdb_public", mwdb_public_default)
+
+    include_tags_event = request["config"].get("include_tags_event")
+    include_tags_attribute = request["config"].get("include_tags_attribute")
+    misp_event_id = request.get("event_id")
+    misp_attribute_uuid = request.get("attribute_uuid")
+    misp_attribute_comment = ""
+    mwdb_tags = []
+    misp_info = ""
+
+    try:
+        if include_tags_event:
+            sys.path.append(pymisp_keys_file)
+            from keys import misp_url, misp_key, misp_verifycert
+            misp = PyMISP(misp_url, misp_key, misp_verifycert, False)
+            misp_event = misp.get_event(misp_event_id)
+            if "Event" in misp_event:
+                misp_info = misp_event["Event"]["info"]
+                if "Tag" in misp_event["Event"]:
+                    tags = misp_event["Event"]["Tag"]
+                    for tag in tags:
+                        if "misp-galaxy" not in tag["name"]:
+                            mwdb_tags.append(tag["name"])
+        if include_tags_attribute:
+            sys.path.append(pymisp_keys_file)
+            from keys import misp_url, misp_key, misp_verifycert
+            misp = PyMISP(misp_url, misp_key, misp_verifycert, False)
+            misp_attribute = misp.get_attribute(misp_attribute_uuid)
+            if "Attribute" in misp_attribute:
+                if "Tag" in misp_attribute["Attribute"]:
+                    tags = misp_attribute["Attribute"]["Tag"]
+                    for tag in tags:
+                        if "misp-galaxy" not in tag["name"]:
+                            mwdb_tags.append(tag["name"])
+                misp_attribute_comment = misp_attribute["Attribute"]["comment"]
+    except Exception:
+        misperrors['error'] = "Unable to read PyMISP (keys.py) configuration file"
+        return misperrors
+
+    try:
+        mwdb = MWDB(api_key=request["config"].get("mwdb_apikey"), api_url=request["config"].get("mwdb_url"))
+        if mwdb_misp_attribute and len(mwdb_misp_attribute) > 0:
+            metakeys = {mwdb_misp_attribute: misp_event_id}
+        else:
+            metakeys = False
+        file_object = mwdb.upload_file(sample_filename, data, metakeys=metakeys, public=mwdb_public)
+        for tag in mwdb_tags:
+            file_object.add_tag(tag)
+        if len(misp_attribute_comment) < 1:
+            misp_attribute_comment = "MISP attribute {}".format(misp_attribute_uuid)
+        file_object.add_comment(misp_attribute_comment)
+        if len(misp_event) > 0:
+            file_object.add_comment("Fetched from event {} - {}".format(misp_event_id, misp_info))
+        mwdb_link = request["config"].get("mwdb_url").replace("/api", "/file/") + "{}".format(file_object.md5)
+    except Exception:
+        misperrors['error'] = "Unable to send sample to MWDB instance"
+        return misperrors
+
+    r = {'results': [{'types': 'link', 'values': mwdb_link, 'comment': 'Link to MWDB sample'}]}
+    return r
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo

misp_modules/modules/expansion/ocr_enrich.py

@@ -0,0 +1,74 @@
+import json
+import binascii
+import cv2
+import np
+import pytesseract
+
+misperrors = {'error': 'Error'}
+mispattributes = {'input': ['attachment'],
+                  'output': ['freetext']}
+moduleinfo = {
+    'version': '0.2',
+    'author': 'Sascha Rommelfangen',
+    'description': 'Module to process some optical character recognition on pictures.',
+    'module-type': ['expansion'],
+    'name': 'OCR Enrich',
+    'logo': '',
+    'requirements': ['cv2: The OpenCV python library.'],
+    'features': 'The module takes an attachment attributes as input and process some optical character recognition on it. The text found is then passed to the Freetext importer to extract potential IoCs.',
+    'references': [],
+    'input': 'A picture attachment.',
+    'output': 'Text and freetext fetched from the input picture.',
+}
+
+moduleconfig = []
+
+
+def filter_decoded(decoded):
+    for line in decoded.split('\n'):
+        decoded_line = line.strip('\t\x0b\x0c\r ')
+        if decoded_line:
+            yield decoded_line
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    q = json.loads(q)
+    filename = q['attachment']
+    try:
+        img_array = np.frombuffer(binascii.a2b_base64(q['data']), np.uint8)
+    except Exception as e:
+        print(e)
+        err = "Couldn't fetch attachment (JSON 'data' is empty). Are you using the 'Query enrichment' action?"
+        misperrors['error'] = err
+        print(err)
+        return misperrors
+
+    image = img_array
+    image = cv2.imdecode(img_array, cv2.IMREAD_COLOR)
+    try:
+        decoded = pytesseract.image_to_string(cv2.cvtColor(image, cv2.COLOR_BGR2RGB))
+        return {
+            'results': [
+                {
+                    'types': ['freetext'],
+                    'values': list(filter_decoded(decoded)),
+                    'comment': f"OCR from file {filename}"
+                }
+            ]
+        }
+    except Exception as e:
+        print(e)
+        err = "Couldn't analyze file type. Only images are supported right now."
+        misperrors['error'] = err
+        return misperrors
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo