misp-modules 2.4.196__py3-none-any.whl

misp_modules/modules/expansion/shodan.py

@@ -0,0 +1,244 @@
+# -*- coding: utf-8 -*-
+
+import json
+try:
+    import shodan
+except ImportError:
+    print("shodan module not installed.")
+from . import check_input_attribute, standard_error_message
+from datetime import datetime
+from pymisp import MISPAttribute, MISPEvent, MISPObject
+
+misperrors = {'error': 'Error'}
+mispattributes = {'input': ['ip-src', 'ip-dst'],
+                  'format': 'misp_standard'}
+moduleinfo = {
+    'version': '0.2',
+    'author': 'Raphaël Vinot',
+    'description': 'Module to query on Shodan.',
+    'module-type': ['expansion'],
+    'name': 'Shodan Lookup',
+    'logo': 'shodan.png',
+    'requirements': ['shodan python library', 'An access to the Shodan API (apikey)'],
+    'features': 'The module takes an IP address as input and queries the Shodan API to get some additional data about it.',
+    'references': ['https://www.shodan.io/'],
+    'input': 'An IP address MISP attribute.',
+    'output': 'Text with additional data about the input, resulting from the query on Shodan.',
+}
+
+moduleconfig = ['apikey']
+
+
+class ShodanParser():
+    def __init__(self, attribute):
+        self.misp_event = MISPEvent()
+        self.attribute = MISPAttribute()
+        self.attribute.from_dict(**attribute)
+        self.misp_event.add_attribute(**self.attribute)
+        self.ip_address_mapping = {
+            'asn': {'type': 'AS', 'object_relation': 'asn'},
+            'city': {'type': 'text', 'object_relation': 'city'},
+            'country_code': {'type': 'text', 'object_relation': 'country-code'},
+            'country_name': {'type': 'text', 'object_relation': 'country'},
+            'isp': {'type': 'text', 'object_relation': 'ISP'},
+            'latitude': {'type': 'float', 'object_relation': 'latitude'},
+            'longitude': {'type': 'float', 'object_relation': 'longitude'},
+            'org': {'type': 'text', 'object_relation': 'organization'},
+            'postal_code': {'type': 'text', 'object_relation': 'zipcode'},
+            'region_code': {'type': 'text', 'object_relation': 'region-code'}
+        }
+        self.ip_port_mapping = {
+            'domains': {'type': 'domain', 'object_relation': 'domain'},
+            'hostnames': {'type': 'hostname', 'object_relation': 'hostname'}
+        }
+        self.vulnerability_mapping = {
+            'cvss': {'type': 'float', 'object_relation': 'cvss-score'},
+            'summary': {'type': 'text', 'object_relation': 'summary'}
+        }
+        self.x509_mapping = {
+            'bits': {'type': 'text', 'object_relation': 'pubkey-info-size'},
+            'expires': {'type': 'datetime', 'object_relation': 'validity-not-after'},
+            'issued': {'type': 'datetime', 'object_relation': 'validity-not-before'},
+            'issuer': {'type': 'text', 'object_relation': 'issuer'},
+            'serial': {'type': 'text', 'object_relation': 'serial-number'},
+            'sig_alg': {'type': 'text', 'object_relation': 'signature_algorithm'},
+            'subject': {'type': 'text', 'object_relation': 'subject'},
+            'type': {'type': 'text', 'object_relation': 'pubkey-info-algorithm'},
+            'version': {'type': 'text', 'object_relation': 'version'}
+        }
+
+    def query_shodan(self, apikey):
+        # Query Shodan and get the results in a json blob
+        api = shodan.Shodan(apikey)
+        query_results = api.host(self.attribute.value)
+
+        # Parse the information about the IP address used as input
+        ip_address_attributes = []
+        for feature, mapping in self.ip_address_mapping.items():
+            if query_results.get(feature):
+                attribute = {'value': query_results[feature]}
+                attribute.update(mapping)
+                ip_address_attributes.append(attribute)
+        if ip_address_attributes:
+            ip_address_object = MISPObject('ip-api-address')
+            for attribute in ip_address_attributes:
+                ip_address_object.add_attribute(**attribute)
+            ip_address_object.add_reference(self.attribute.uuid, 'describes')
+            self.misp_event.add_object(ip_address_object)
+
+        # Parse the hostnames / domains and ports associated with the IP address
+        if query_results.get('ports'):
+            ip_port_object = MISPObject('ip-port')
+            ip_port_object.add_attribute(**self._get_source_attribute())
+            feature = self.attribute.type.split('-')[1]
+            for port in query_results['ports']:
+                attribute = {
+                    'type': 'port',
+                    'object_relation': f'{feature}-port',
+                    'value': port
+                }
+                ip_port_object.add_attribute(**attribute)
+            for feature, mapping in self.ip_port_mapping.items():
+                for value in query_results.get(feature, []):
+                    attribute = {'value': value}
+                    attribute.update(mapping)
+                    ip_port_object.add_attribute(**attribute)
+            ip_port_object.add_reference(self.attribute.uuid, 'extends')
+            self.misp_event.add_object(ip_port_object)
+        else:
+            if any(query_results.get(feature) for feature in ('domains', 'hostnames')):
+                domain_ip_object = MISPObject('domain-ip')
+                domain_ip_object.add_attribute(**self._get_source_attribute())
+                for feature in ('domains', 'hostnames'):
+                    for value in query_results[feature]:
+                        attribute = {
+                            'type': 'domain',
+                            'object_relation': 'domain',
+                            'value': value
+                        }
+                        domain_ip_object.add_attribute(**attribute)
+                domain_ip_object.add_reference(self.attribute.uuid, 'extends')
+                self.misp_event.add_object(domain_ip_object)
+
+        # Parse data within the "data" field
+        if query_results.get('vulns'):
+            vulnerabilities = {}
+            for data in query_results['data']:
+                # Parse vulnerabilities
+                if data.get('vulns'):
+                    for cve, vulnerability in data['vulns'].items():
+                        if cve not in vulnerabilities:
+                            vulnerabilities[cve] = vulnerability
+                # Also parse the certificates
+                if data.get('ssl'):
+                    self._parse_cert(data['ssl'])
+            for cve, vulnerability in vulnerabilities.items():
+                vulnerability_object = MISPObject('vulnerability')
+                vulnerability_object.add_attribute(**{
+                    'type': 'vulnerability',
+                    'object_relation': 'id',
+                    'value': cve
+                })
+                for feature, mapping in self.vulnerability_mapping.items():
+                    if vulnerability.get(feature):
+                        attribute = {'value': vulnerability[feature]}
+                        attribute.update(mapping)
+                        vulnerability_object.add_attribute(**attribute)
+                if vulnerability.get('references'):
+                    for reference in vulnerability['references']:
+                        vulnerability_object.add_attribute(**{
+                            'type': 'link',
+                            'object_relation': 'references',
+                            'value': reference
+                        })
+                vulnerability_object.add_reference(self.attribute.uuid, 'vulnerability-of')
+                self.misp_event.add_object(vulnerability_object)
+            for cve_id in query_results['vulns']:
+                if cve_id not in vulnerabilities:
+                    attribute = {
+                        'type': 'vulnerability',
+                        'value': cve_id
+                    }
+                    self.misp_event.add_attribute(**attribute)
+        else:
+            # We have no vulnerability data, we only check if we have
+            # certificates within the "data" field
+            for data in query_results['data']:
+                if data.get('ssl'):
+                    self._parse_cert(data['ssl']['cert'])
+
+    def get_result(self):
+        event = json.loads(self.misp_event.to_json())
+        results = {key: event[key] for key in ('Attribute', 'Object') if (key in event and event[key])}
+        return {'results': results}
+
+    # When we want to add the IP address information in objects such as the
+    # domain-ip or ip-port objects referencing the input IP address attribute
+    def _get_source_attribute(self):
+        return {
+            'type': self.attribute.type,
+            'object_relation': self.attribute.type,
+            'value': self.attribute.value
+        }
+
+    def _parse_cert(self, certificate):
+        x509_object = MISPObject('x509')
+        for feature in ('serial', 'sig_alg', 'version'):
+            if certificate.get(feature):
+                attribute = {'value': certificate[feature]}
+                attribute.update(self.x509_mapping[feature])
+                x509_object.add_attribute(**attribute)
+        # Parse issuer and subject value
+        for feature in ('issuer', 'subject'):
+            if certificate.get(feature):
+                attribute_value = (f'{identifier}={value}' for identifier, value in certificate[feature].items())
+                attribute = {'value': f'/{"/".join(attribute_value)}'}
+                attribute.update(self.x509_mapping[feature])
+                x509_object.add_attribute(**attribute)
+        # Parse datetime attributes
+        for feature in ('expires', 'issued'):
+            if certificate.get(feature):
+                attribute = {'value': datetime.strptime(certificate[feature], '%Y%m%d%H%M%SZ')}
+                attribute.update(self.x509_mapping[feature])
+                x509_object.add_attribute(**attribute)
+        # Parse fingerprints
+        if certificate.get('fingerprint'):
+            for hash_type, hash_value in certificate['fingerprint'].items():
+                x509_object.add_attribute(**{
+                    'type': f'x509-fingerprint-{hash_type}',
+                    'object_relation': f'x509-fingerprint-{hash_type}',
+                    'value': hash_value
+                })
+        # Parse public key related info
+        if certificate.get('pubkey'):
+            for feature, value in certificate['pubkey'].items():
+                attribute = {'value': value}
+                attribute.update(self.x509_mapping[feature])
+                x509_object.add_attribute(**attribute)
+        x509_object.add_reference(self.attribute.uuid, 'identifies')
+        self.misp_event.add_object(x509_object)
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    request = json.loads(q)
+    if not request.get('config', {}).get('apikey'):
+        return {'error': 'Shodan authentication is missing'}
+    if not request.get('attribute') or not check_input_attribute(request['attribute']):
+        return {'error': f'{standard_error_message}, which should contain at least a type, a value and an uuid.'}
+    attribute = request['attribute']
+    if attribute['type'] not in mispattributes['input']:
+        return {'error': 'Unsupported attribute type.'}
+    shodan_parser = ShodanParser(attribute)
+    shodan_parser.query_shodan(request['config']['apikey'])
+    return shodan_parser.get_result()
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo

misp_modules/modules/expansion/sigma_queries.py

@@ -0,0 +1,61 @@
+import io
+import json
+try:
+    from sigma.parser.collection import SigmaCollectionParser
+    from sigma.configuration import SigmaConfiguration
+    from sigma.backends.discovery import getBackend
+except ImportError:
+    print("sigma or yaml is missing, use 'pip3 install sigmatools' to install it.")
+
+misperrors = {'error': 'Error'}
+mispattributes = {'input': ['sigma'], 'output': ['text']}
+moduleinfo = {
+    'version': '0.1',
+    'author': 'Christian Studer',
+    'module-type': ['expansion', 'hover'],
+    'name': 'Sigma Rule Converter',
+    'description': 'An expansion hover module to display the result of sigma queries.',
+    'logo': 'sigma.png',
+    'requirements': ['Sigma python library'],
+    'features': 'This module takes a Sigma rule attribute as input and tries all the different queries available to convert it into different formats recognized by SIEMs.',
+    'references': ['https://github.com/Neo23x0/sigma/wiki'],
+    'input': 'A Sigma attribute.',
+    'output': 'Text displaying results of queries on the Sigma attribute.',
+}
+moduleconfig = []
+sigma_targets = ('es-dsl', 'es-qs', 'graylog', 'kibana', 'xpack-watcher', 'logpoint', 'splunk', 'grep', 'mdatp', 'splunkxml', 'arcsight', 'qualys')
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    request = json.loads(q)
+    if not request.get('sigma'):
+        misperrors['error'] = 'Sigma rule missing'
+        return misperrors
+    config = SigmaConfiguration()
+    f = io.TextIOWrapper(io.BytesIO(request.get('sigma').encode()), encoding='utf-8')
+    parser = SigmaCollectionParser(f, config)
+    targets = []
+    results = []
+    for t in sigma_targets:
+        backend = getBackend(t)(config, {'rulecomment': False})
+        try:
+            parser.generate(backend)
+            result = backend.finalize()
+            if result:
+                results.append(result)
+                targets.append(t)
+        except Exception:
+            continue
+    d_result = {t: r.strip() for t, r in zip(targets, results)}
+    return {'results': [{'types': mispattributes['output'], 'values': d_result}]}
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo

misp_modules/modules/expansion/sigma_syntax_validator.py

@@ -0,0 +1,49 @@
+import json
+try:
+    import yaml
+    from sigma.parser.rule import SigmaParser
+    from sigma.configuration import SigmaConfiguration
+except ImportError:
+    print("sigma or yaml is missing, use 'pip3 install sigmatools' to install it.")
+
+misperrors = {'error': 'Error'}
+mispattributes = {'input': ['sigma'], 'output': ['text']}
+moduleinfo = {
+    'version': '0.1',
+    'author': 'Christian Studer',
+    'module-type': ['expansion', 'hover'],
+    'name': 'Sigma Syntax Validator',
+    'description': 'An expansion hover module to perform a syntax check on sigma rules.',
+    'logo': 'sigma.png',
+    'requirements': ['Sigma python library', 'Yaml python library'],
+    'features': 'This module takes a Sigma rule attribute as input and performs a syntax check on it.\n\nIt displays then that the rule is valid if it is the case, and the error related to the rule otherwise.',
+    'references': ['https://github.com/Neo23x0/sigma/wiki'],
+    'input': 'A Sigma attribute.',
+    'output': 'Text describing the validity of the Sigma rule.',
+}
+moduleconfig = []
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    request = json.loads(q)
+    if not request.get('sigma'):
+        misperrors['error'] = 'Sigma rule missing'
+        return misperrors
+    config = SigmaConfiguration()
+    try:
+        parser = SigmaParser(yaml.safe_load(request.get('sigma')), config)
+        result = ("Syntax valid: {}".format(parser.values))
+    except Exception as e:
+        result = ("Syntax error: {}".format(str(e)))
+    return {'results': [{'types': mispattributes['output'], 'values': result}]}
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo

misp_modules/modules/expansion/sigmf_expand.py

@@ -0,0 +1,303 @@
+# -*- coding: utf-8 -*-
+
+import base64
+import numpy as np
+import matplotlib.pyplot as plt
+import io
+import json
+import tempfile
+import logging
+import sys
+from pymisp import MISPObject, MISPEvent
+from sigmf import SigMFFile
+from sigmf.archive import SIGMF_DATASET_EXT, SIGMF_METADATA_EXT
+import tarfile
+
+log = logging.getLogger("sigmf-expand")
+log.setLevel(logging.DEBUG)
+sh = logging.StreamHandler(sys.stdout)
+sh.setLevel(logging.DEBUG)
+fmt = logging.Formatter(
+    "%(asctime)s - %(name)s - %(levelname)s - %(message)s"
+)
+sh.setFormatter(fmt)
+log.addHandler(sh)
+
+misperrors = {'error': 'Error'}
+mispattributes = {'input': ['sigmf-recording', 'sigmf-archive'], 'output': [
+    'MISP objects'], 'format': 'misp_standard'}
+moduleinfo = {
+    'version': '0.1',
+    'author': 'Luciano Righetti',
+    'description': 'Expands a SigMF Recording object into a SigMF Expanded Recording object, extracts a SigMF archive into a SigMF Recording object.',
+    'module-type': ['expansion'],
+    'name': 'SigMF Expansion',
+    'logo': '',
+    'requirements': [],
+    'features': '',
+    'references': [],
+    'input': '',
+    'output': '',
+}
+
+
+def get_samples(data_bytes, data_type) -> np.ndarray:
+    """
+    Get samples from bytes.
+
+    Source: https://github.com/IQEngine/IQEngine/blob/main/api/rf/samples.py
+
+    Parameters
+    ----------
+    data_bytes : bytes
+        The bytes to convert to samples.
+    data_type : str
+        The data type of the bytes.
+
+    Returns
+    -------
+    np.ndarray
+        The samples.
+    """
+
+    if data_type == "ci16_le" or data_type == "ci16":
+        samples = np.frombuffer(data_bytes, dtype=np.int16)
+        samples = samples[::2] + 1j * samples[1::2]
+    elif data_type == "cf32_le":
+        samples = np.frombuffer(data_bytes, dtype=np.complex64)
+    elif data_type == "ci8" or data_type == "i8":
+        samples = np.frombuffer(data_bytes, dtype=np.int8)
+        samples = samples[::2] + 1j * samples[1::2]
+    else:
+        raise ("Datatype " + data_type + " not implemented")
+    return samples
+
+
+def generate_plots(recording, meta_filename, data_bytes):
+    # FFT plot
+    filename = meta_filename.replace('.sigmf-data', '')
+    samples = get_samples(
+        data_bytes, recording.get_global_info()['core:datatype'])
+    sample_rate = recording.get_global_info()['core:sample_rate']
+
+    # Waterfall plot
+    # snippet from https://pysdr.org/content/frequency_domain.html#fast-fourier-transform-fft
+    fft_size = 1024
+    # // is an integer division which rounds down
+    num_rows = len(samples) // fft_size
+    spectrogram = np.zeros((num_rows, fft_size))
+    for i in range(num_rows):
+        spectrogram[i, :] = 10 * \
+            np.log10(np.abs(np.fft.fftshift(
+                np.fft.fft(samples[i*fft_size:(i+1)*fft_size])))**2)
+
+    plt.figure(figsize=(10, 4))
+    plt.title(filename)
+    plt.imshow(spectrogram, aspect='auto', extent=[
+               sample_rate/-2/1e6, sample_rate/2/1e6, 0, len(samples)/sample_rate])
+    plt.xlabel("Frequency [MHz]")
+    plt.ylabel("Time [ms]")
+    plt.savefig(filename + '-spectrogram.png')
+    waterfall_buff = io.BytesIO()
+    plt.savefig(waterfall_buff, format='png')
+    waterfall_buff.seek(0)
+    waterfall_png = base64.b64encode(waterfall_buff.read()).decode('utf-8')
+
+    waterfall_attr = {
+        'type': 'attachment',
+        'value': filename + '-waterfall.png',
+        'data': waterfall_png,
+        'comment': 'Waterfall plot of the recording'
+    }
+
+    return [{'relation': 'waterfall-plot', 'attribute': waterfall_attr}]
+
+
+def process_sigmf_archive(object):
+
+    event = MISPEvent()
+    sigmf_data_attr = None
+    sigmf_meta_attr = None
+
+    try:
+        # get sigmf-archive attribute
+        for attribute in object['Attribute']:
+            if attribute['object_relation'] == 'SigMF-archive':
+
+                # write temp data file to disk
+                sigmf_archive_file = tempfile.NamedTemporaryFile(
+                    suffix='.sigmf')
+                sigmf_archive_bin = base64.b64decode(attribute['data'])
+                with open(sigmf_archive_file.name, 'wb') as f:
+                    f.write(sigmf_archive_bin)
+                    f.close()
+
+                sigmf_tarfile = tarfile.open(
+                    sigmf_archive_file.name, mode="r", format=tarfile.PAX_FORMAT)
+
+            files = sigmf_tarfile.getmembers()
+
+            for file in files:
+                if file.name.endswith(SIGMF_METADATA_EXT):
+                    metadata_reader = sigmf_tarfile.extractfile(file)
+                    sigmf_meta_attr = {
+                        'type': 'attachment',
+                        'value': file.name,
+                        'data': base64.b64encode(metadata_reader.read()).decode("utf-8"),
+                        'comment': 'SigMF metadata file',
+                        'object_relation': 'SigMF-meta'
+                    }
+
+                if file.name.endswith(SIGMF_DATASET_EXT):
+                    data_reader = sigmf_tarfile.extractfile(file)
+                    sigmf_data_attr = {
+                        'type': 'attachment',
+                        'value': file.name,
+                        'data': base64.b64encode(data_reader.read()).decode("utf-8"),
+                        'comment': 'SigMF data file',
+                        'object_relation': 'SigMF-data'
+                    }
+
+            if sigmf_meta_attr is None:
+                return {"error": "No SigMF metadata file found"}
+
+            recording = MISPObject('sigmf-recording')
+            recording.add_attribute(**sigmf_meta_attr)
+            recording.add_attribute(**sigmf_data_attr)
+
+            # add reference to original SigMF Archive object
+            recording.add_reference(object['uuid'], "expands")
+
+            event.add_object(recording)
+            event = json.loads(event.to_json())
+
+            return {"results": {'Object': event['Object']}}
+
+        # no sigmf-archive attribute found
+        return {"error": "No SigMF-archive attribute found"}
+
+    except Exception as e:
+        logging.exception(e)
+        return {"error": "An error occured when processing the SigMF archive"}
+
+
+def process_sigmf_recording(object):
+
+    event = MISPEvent()
+
+    for attribute in object['Attribute']:
+        if attribute['object_relation'] == 'SigMF-data':
+            sigmf_data_attr = attribute
+
+        if attribute['object_relation'] == 'SigMF-meta':
+            sigmf_meta_attr = attribute
+
+    if sigmf_meta_attr is None:
+        return {"error": "No SigMF-data attribute"}
+
+    if sigmf_data_attr is None:
+        return {"error": "No SigMF-meta attribute"}
+
+    try:
+        sigmf_meta = base64.b64decode(sigmf_meta_attr['data']).decode('utf-8')
+        sigmf_meta = json.loads(sigmf_meta)
+    except Exception as e:
+        logging.exception(e)
+        return {"error": "Provided .sigmf-meta is not a valid JSON string"}
+
+    # write temp data file to disk
+    sigmf_data_file = tempfile.NamedTemporaryFile(suffix='.sigmf-data')
+    sigmf_data_bin = base64.b64decode(sigmf_data_attr['data'])
+    with open(sigmf_data_file.name, 'wb') as f:
+        f.write(sigmf_data_bin)
+        f.close()
+
+    try:
+        recording = SigMFFile(
+            metadata=sigmf_meta,
+            data_file=sigmf_data_file.name
+        )
+    except Exception as e:
+        logging.exception(e)
+        return {"error": "Provided .sigmf-meta and .sigmf-data is not a valid SigMF file"}
+
+    expanded_sigmf = MISPObject('sigmf-expanded-recording')
+
+    if 'core:author' in sigmf_meta['global']:
+        expanded_sigmf.add_attribute(
+            'author', **{'type': 'text', 'value': sigmf_meta['global']['core:author']})
+    if 'core:datatype' in sigmf_meta['global']:
+        expanded_sigmf.add_attribute(
+            'datatype', **{'type': 'text', 'value': sigmf_meta['global']['core:datatype']})
+    if 'core:description' in sigmf_meta['global']:
+        expanded_sigmf.add_attribute(
+            'description', **{'type': 'text', 'value': sigmf_meta['global']['core:description']})
+    if 'core:license' in sigmf_meta['global']:
+        expanded_sigmf.add_attribute(
+            'license', **{'type': 'text', 'value': sigmf_meta['global']['core:license']})
+    if 'core:num_channels' in sigmf_meta['global']:
+        expanded_sigmf.add_attribute(
+            'num_channels', **{'type': 'counter', 'value': sigmf_meta['global']['core:num_channels']})
+    if 'core:recorder' in sigmf_meta['global']:
+        expanded_sigmf.add_attribute(
+            'recorder', **{'type': 'text', 'value': sigmf_meta['global']['core:recorder']})
+    if 'core:sample_rate' in sigmf_meta['global']:
+        expanded_sigmf.add_attribute(
+            'sample_rate', **{'type': 'float', 'value': sigmf_meta['global']['core:sample_rate']})
+    if 'core:sha512' in sigmf_meta['global']:
+        expanded_sigmf.add_attribute(
+            'sha512', **{'type': 'text', 'value': sigmf_meta['global']['core:sha512']})
+    if 'core:version' in sigmf_meta['global']:
+        expanded_sigmf.add_attribute(
+            'version', **{'type': 'text', 'value': sigmf_meta['global']['core:version']})
+
+    # add reference to original SigMF Recording object
+    expanded_sigmf.add_reference(object['uuid'], "expands")
+
+    # add FFT and waterfall plot
+    try:
+        plots = generate_plots(
+            recording, sigmf_data_attr['value'], sigmf_data_bin)
+    except Exception as e:
+        logging.exception(e)
+        return {"error": "Could not generate plots"}
+
+    for plot in plots:
+        expanded_sigmf.add_attribute(plot['relation'], **plot['attribute'])
+
+    event.add_object(expanded_sigmf)
+    event = json.loads(event.to_json())
+
+    return {"results": {'Object': event['Object']}}
+
+
+def handler(q=False):
+    request = json.loads(q)
+    object = request.get("object")
+    event = MISPEvent()
+
+    if not object:
+        return {"error": "No object provided"}
+
+    if 'Attribute' not in object:
+        return {"error": "Empty Attribute list"}
+
+    # check if it's a SigMF Archive
+    if object['name'] == 'sigmf-archive':
+        return process_sigmf_archive(object)
+
+    # check if it's a SigMF Recording
+    if object['name'] == 'sigmf-recording':
+        return process_sigmf_recording(object)
+
+    # TODO: add support for SigMF Collection
+
+    return {"error": "No SigMF object provided"}
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    return moduleinfo