misp-modules 2.4.196__py3-none-any.whl

misp_modules/modules/expansion/xforceexchange.py

@@ -0,0 +1,189 @@
+import requests
+import json
+import sys
+from . import check_input_attribute, standard_error_message
+from collections import defaultdict
+from pymisp import MISPAttribute, MISPEvent, MISPObject
+from requests.auth import HTTPBasicAuth
+
+sys.path.append('./')
+
+misperrors = {'error': 'Error'}
+mispattributes = {'input': ['ip-src', 'ip-dst', 'vulnerability', 'md5', 'sha1', 'sha256', 'domain', 'hostname', 'url'],
+                  'output': ['ip-src', 'ip-dst', 'text', 'domain'],
+                  'format': 'misp_standard'}
+
+# possible module-types: 'expansion', 'hover' or both
+moduleinfo = {
+    'version': '2',
+    'author': 'Joerg Stephan (@johest)',
+    'description': 'An expansion module for IBM X-Force Exchange.',
+    'module-type': ['expansion', 'hover'],
+    'name': 'IBM X-Force Exchange Lookup',
+    'logo': 'xforce.png',
+    'requirements': ['An access to the X-Force API (apikey)'],
+    'features': 'This module takes a MISP attribute as input to query the X-Force API. The API returns then additional information known in their threats data, that is mapped into MISP attributes.',
+    'references': ['https://exchange.xforce.ibmcloud.com/'],
+    'input': 'A MISP attribute included in the following list:\n- ip-src\n- ip-dst\n- vulnerability\n- md5\n- sha1\n- sha256',
+    'output': 'MISP attributes mapped from the result of the query on X-Force Exchange.',
+}
+
+# config fields that your code expects from the site admin
+moduleconfig = ["apikey", "apipassword"]
+
+
+class XforceExchange():
+    def __init__(self, attribute, apikey, apipassword):
+        self.base_url = "https://api.xforce.ibmcloud.com"
+        self.misp_event = MISPEvent()
+        self.attribute = MISPAttribute()
+        self.attribute.from_dict(**attribute)
+        self._apikey = apikey
+        self._apipassword = apipassword
+        self.result = {}
+        self.objects = defaultdict(dict)
+        self.status_mapping = {403: "Access denied, please check if your authentication is valid and if you did not reach the limit of queries.",
+                               404: "No result found for your query."}
+
+    def parse(self):
+        mapping = {'url': '_parse_url', 'vulnerability': '_parse_vulnerability'}
+        mapping.update(dict.fromkeys(('md5', 'sha1', 'sha256'), '_parse_hash'))
+        mapping.update(dict.fromkeys(('domain', 'hostname'), '_parse_dns'))
+        mapping.update(dict.fromkeys(('ip-src', 'ip-dst'), '_parse_ip'))
+        to_call = mapping[self.attribute.type]
+        getattr(self, to_call)(self.attribute.value)
+
+    def get_result(self):
+        if not self.misp_event.objects:
+            if 'error' not in self.result:
+                self.result['error'] = "No additional data found on Xforce Exchange."
+            return self.result
+        self.misp_event.add_attribute(**self.attribute)
+        event = json.loads(self.misp_event.to_json())
+        result = {key: event[key] for key in ('Attribute', 'Object') if (key in event and event[key])}
+        return {'results': result}
+
+    def _api_call(self, url):
+        try:
+            result = requests.get(url, auth=HTTPBasicAuth(self._apikey, self._apipassword))
+        except Exception as e:
+            self.result['error'] = e
+            return
+        status_code = result.status_code
+        if status_code != 200:
+            try:
+                self.result['error'] = self.status_mapping[status_code]
+            except KeyError:
+                self.result['error'] = 'An error with the API has occurred.'
+            return
+        return result.json()
+
+    def _create_file(self, malware, relationship):
+        file_object = MISPObject('file')
+        for key, relation in zip(('filepath', 'md5'), ('filename', 'md5')):
+            file_object.add_attribute(relation, malware[key])
+        file_object.add_reference(self.attribute.uuid, relationship)
+        return file_object
+
+    def _create_url(self, malware):
+        url_object = MISPObject('url')
+        for key, relation in zip(('uri', 'domain'), ('url', 'domain')):
+            url_object.add_attribute(relation, malware[key])
+        attributes = tuple(f'{attribute.object_relation}_{attribute.value}' for attribute in url_object.attributes)
+        if attributes in self.objects['url']:
+            del url_object
+            return self.objects['url'][attributes]
+        url_uuid = url_object.uuid
+        self.misp_event.add_object(**url_object)
+        self.objects['url'][attributes] = url_uuid
+        return url_uuid
+
+    def _fetch_types(self, value):
+        if self.attribute.type in ('ip-src', 'ip-dst'):
+            return 'ip', 'domain', self.attribute.value
+        return 'domain', 'ip', value
+
+    def _handle_file(self, malware, relationship):
+        file_object = self._create_file(malware, relationship)
+        attributes = tuple(f'{attribute.object_relation}_{attribute.value}' for attribute in file_object.attributes)
+        if attributes in self.objects['file']:
+            self.objects['file'][attributes].add_reference(self._create_url(malware), 'dropped-by')
+            del file_object
+            return
+        file_object.add_reference(self._create_url(malware), 'dropped-by')
+        self.objects['file'][attributes] = file_object
+        self.misp_event.add_object(**file_object)
+
+    def _parse_dns(self, value):
+        dns_result = self._api_call(f'{self.base_url}/resolve/{value}')
+        if dns_result.get('Passive') and dns_result['Passive'].get('records'):
+            itype, ftype, value = self._fetch_types(dns_result['Passive']['query'])
+            misp_object = MISPObject('domain-ip')
+            misp_object.add_attribute(itype, value)
+            for record in dns_result['Passive']['records']:
+                misp_object.add_attribute(ftype, record['value'])
+            misp_object.add_reference(self.attribute.uuid, 'related-to')
+            self.misp_event.add_object(**misp_object)
+
+    def _parse_hash(self, value):
+        malware_result = self._api_call(f'{self.base_url}/malware/{value}')
+        if malware_result and malware_result.get('malware'):
+            malware_report = malware_result['malware']
+            for malware in malware_report.get('origins', {}).get('CnCServers', {}).get('rows', []):
+                self._handle_file(malware, 'related-to')
+
+    def _parse_ip(self, value):
+        self._parse_dns(value)
+        self._parse_malware(value, 'ipr')
+
+    def _parse_malware(self, value, feature):
+        malware_result = self._api_call(f'{self.base_url}/{feature}/malware/{value}')
+        if malware_result and malware_result.get('malware'):
+            for malware in malware_result['malware']:
+                self._handle_file(malware, 'associated-with')
+
+    def _parse_url(self, value):
+        self._parse_dns(value)
+        self._parse_malware(value, 'url')
+
+    def _parse_vulnerability(self, value):
+        vulnerability_result = self._api_call(f'{self.base_url}/vulnerabilities/search/{value}')
+        if vulnerability_result:
+            for vulnerability in vulnerability_result:
+                misp_object = MISPObject('vulnerability')
+                for code in vulnerability['stdcode']:
+                    misp_object.add_attribute('id', code)
+                for feature, relation in zip(('title', 'description', 'temporal_score'),
+                                             ('summary', 'description', 'cvss-score')):
+                    misp_object.add_attribute(relation, vulnerability[feature])
+                for reference in vulnerability['references']:
+                    misp_object.add_attribute('references', reference['link_target'])
+                misp_object.add_reference(self.attribute.uuid, 'related-to')
+                self.misp_event.add_object(**misp_object)
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    request = json.loads(q)
+    if not request.get('config') or not (request['config'].get('apikey') and request['config'].get('apipassword')):
+        misperrors['error'] = 'An API authentication is required (key and password).'
+        return misperrors
+    key = request["config"]["apikey"]
+    password = request['config']['apipassword']
+    if not request.get('attribute') or not check_input_attribute(request['attribute']):
+        return {'error': f'{standard_error_message} which should contain at least a type, a value and an uuid.'}
+    if request['attribute']['type'] not in mispattributes['input']:
+        return {'error': 'Unsupported attribute type.'}
+    parser = XforceExchange(request['attribute'], key, password)
+    parser.parse()
+    return parser.get_result()
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo

misp_modules/modules/expansion/xlsx_enrich.py

@@ -0,0 +1,63 @@
+import json
+import binascii
+import np
+import pandas
+import io
+
+misperrors = {'error': 'Error'}
+mispattributes = {'input': ['attachment'],
+                  'output': ['freetext', 'text']}
+moduleinfo = {
+    'version': '0.1',
+    'author': 'Sascha Rommelfangen',
+    'description': 'Module to extract freetext from a .xlsx document.',
+    'module-type': ['expansion'],
+    'name': 'XLXS Enrich',
+    'logo': 'xlsx.png',
+    'requirements': ['pandas: Python library to perform data analysis, time series and statistics.'],
+    'features': 'The module reads the text contained in a .xlsx document. The result is passed to the freetext import parser so IoCs can be extracted out of it.',
+    'references': [],
+    'input': 'Attachment attribute containing a .xlsx document.',
+    'output': 'Text and freetext parsed from the document.',
+}
+
+moduleconfig = []
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    q = json.loads(q)
+    filename = q['attachment']
+    try:
+        xlsx_array = np.frombuffer(binascii.a2b_base64(q['data']), np.uint8)
+    except Exception as e:
+        print(e)
+        err = "Couldn't fetch attachment (JSON 'data' is empty). Are you using the 'Query enrichment' action?"
+        misperrors['error'] = err
+        print(err)
+        return misperrors
+
+    xls_content = ""
+    xls_file = io.BytesIO(xlsx_array)
+    pandas.set_option('display.max_colwidth', -1)
+    try:
+        xls = pandas.read_excel(xls_file)
+        xls_content = xls.to_string(max_rows=None)
+        print(xls_content)
+        return {'results': [{'types': ['freetext'], 'values': xls_content, 'comment': ".xlsx-to-text from file " + filename},
+                            {'types': ['text'], 'values': xls_content, 'comment': ".xlsx-to-text from file " + filename}]}
+    except Exception as e:
+        print(e)
+        err = "Couldn't analyze file as .xlsx. Error was: " + str(e)
+        misperrors['error'] = err
+        return misperrors
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo

misp_modules/modules/expansion/yara_query.py

@@ -0,0 +1,70 @@
+import json
+import re
+try:
+    import yara
+except (OSError, ImportError):
+    print("yara is missing, use 'pip3 install -I -r REQUIREMENTS' from the root of this repository to install it.")
+
+misperrors = {'error': 'Error'}
+moduleinfo = {
+    'version': '1',
+    'author': 'Christian STUDER',
+    'description': 'jj',
+    'module-type': ['expansion', 'hover'],
+    'name': 'YARA Rule Generator',
+    'require_standard_format': True,
+    'logo': 'yara.png',
+    'requirements': ['yara-python python library'],
+    'features': "The module takes a hash attribute (md5, sha1, sha256, imphash) as input, and is returning a YARA rule from it. This YARA rule is also validated using the same method as in 'yara_syntax_validator' module.\nBoth hover and expansion functionalities are supported with this module, where the hover part is displaying the resulting YARA rule and the expansion part allows you to add the rule as a new attribute, as usual with expansion modules.",
+    'references': ['https://virustotal.github.io/yara/', 'https://github.com/virustotal/yara-python'],
+    'input': 'MISP Hash attribute (md5, sha1, sha256, imphash, or any of the composite attribute with filename and one of the previous hash type).',
+    'output': 'YARA rule.',
+}
+moduleconfig = []
+mispattributes = {'input': ['md5', 'sha1', 'sha256', 'filename|md5', 'filename|sha1', 'filename|sha256', 'imphash'], 'output': ['yara']}
+
+
+def extract_input_attribute(request):
+    for input_type in mispattributes['input']:
+        if input_type in request:
+            return input_type, request[input_type]
+
+
+def get_hash_condition(hashtype, hashvalue):
+    hashvalue = hashvalue.lower()
+    required_module, params = ('pe', '()') if hashtype == 'imphash' else ('hash', '(0, filesize)')
+    return '{}.{}{} == "{}"'.format(required_module, hashtype, params, hashvalue), required_module
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    request = json.loads(q)
+    attribute = extract_input_attribute(request)
+    if attribute is None:
+        return {'error': f'Wrong input type, please choose in the following: {", ".join(mispattributes["input"])}'}
+    uuid = request.pop('attribute_uuid') if 'attribute_uuid' in request else None
+    attribute_type, value = attribute
+    if 'filename' in attribute_type:
+        _, attribute_type = attribute_type.split('|')
+        _, value = value.split('|')
+    condition, required_module = get_hash_condition(attribute_type, value)
+    import_section = 'import "{}"'.format(required_module)
+    rule_start = '%s\r\nrule %s_%s {' % (import_section, attribute_type.upper(), re.sub(r'\W+', '_', uuid)) if uuid else '%s\r\nrule %s {' % (import_section, attribute_type.upper())
+    condition = '\tcondition:\r\n\t\t{}'.format(condition)
+    rule = '\r\n'.join([rule_start, condition, '}'])
+    try:
+        yara.compile(source=rule)
+    except Exception as e:
+        misperrors['error'] = 'Syntax error: {}'.format(e)
+        return misperrors
+    return {'results': [{'types': mispattributes['output'], 'values': rule}]}
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo

misp_modules/modules/expansion/yara_syntax_validator.py

@@ -0,0 +1,49 @@
+import json
+try:
+    import yara
+except (OSError, ImportError):
+    print("yara is missing, use 'pip3 install -I -r REQUIREMENTS' from the root of this repository to install it.")
+
+misperrors = {'error': 'Error'}
+mispattributes = {'input': ['yara'], 'output': ['text']}
+moduleinfo = {
+    'version': '0.1',
+    'author': 'Dennis Rand',
+    'description': 'An expansion hover module to perform a syntax check on if yara rules are valid or not.',
+    'module-type': ['hover'],
+    'name': 'YARA Syntax Validator',
+    'logo': 'yara.png',
+    'requirements': ['yara_python python library'],
+    'features': 'This modules simply takes a YARA rule as input, and checks its syntax. It returns then a confirmation if the syntax is valid, otherwise the syntax error is displayed.',
+    'references': ['http://virustotal.github.io/yara/'],
+    'input': 'YARA rule attribute.',
+    'output': 'Text to inform users if their rule is valid.',
+}
+moduleconfig = []
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    request = json.loads(q)
+    if not request.get('yara'):
+        misperrors['error'] = 'Yara rule missing'
+        return misperrors
+
+    try:
+        yara.compile(source=request.get('yara'))
+        summary = ("Syntax valid")
+    except Exception as e:
+        summary = ("Syntax error: " + str(e))
+
+    r = {'results': [{'types': mispattributes['output'], 'values': summary}]}
+    return r
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo

misp_modules/modules/expansion/yeti.py

@@ -0,0 +1,196 @@
+import json
+import logging
+
+try:
+    import pyeti
+except ImportError:
+    print("pyeti module not installed.")
+
+from pymisp import MISPEvent, MISPObject
+
+misperrors = {'error': 'Error'}
+
+mispattributes = {'input': ['AS', 'ip-src', 'ip-dst', 'hostname', 'domain', 'sha256', 'sha1', 'md5', 'url'],
+                  'format': 'misp_standard'
+                  }
+# possible module-types: 'expansion', 'hover' or both
+moduleinfo = {
+    'version': '1',
+    'author': 'Sebastien Larinier @sebdraven',
+    'description': 'Module to process a query on Yeti.',
+    'module-type': ['expansion', 'hover'],
+    'name': 'Yeti Lookup',
+    'logo': 'yeti.png',
+    'requirements': ['pyeti', 'API key '],
+    'features': 'This module add context and links between observables using yeti',
+    'references': ['https://github.com/yeti-platform/yeti', 'https://github.com/sebdraven/pyeti'],
+    'input': 'A domain, hostname,IP, sha256,sha1, md5, url of MISP attribute.',
+    'output': 'MISP attributes and objects fetched from the Yeti instances.',
+}
+
+moduleconfig = ['apikey', 'url']
+
+
+class Yeti():
+
+    def __init__(self, url, key, attribute):
+        self.misp_mapping = {'Ip': 'ip-dst', 'Domain': 'domain', 'Hostname': 'hostname', 'Url': 'url',
+                             'AutonomousSystem': 'AS', 'File': 'sha256'}
+        self.yeti_client = pyeti.YetiApi(url=url, api_key=key)
+        self.attribute = attribute
+        self.misp_event = MISPEvent()
+        self.misp_event.add_attribute(**attribute)
+
+    def search(self, value):
+        obs = self.yeti_client.observable_search(value=value)
+        if obs:
+            return obs[0]
+
+    def get_neighboors(self, obs_id):
+        neighboors = self.yeti_client.neighbors_observables(obs_id)
+        if neighboors and 'objs' in neighboors:
+            links_by_id = {link['dst']['id']: (link['description'], 'dst') for link in neighboors['links']
+                           if link['dst']['id'] != obs_id}
+            links_by_id.update({link['src']['id']: (link['description'], 'src') for link in neighboors['links']
+                                if link['src']['id'] != obs_id})
+
+            for n in neighboors['objs']:
+                yield n, links_by_id[n['id']]
+
+    def parse_yeti_result(self):
+        obs = self.search(self.attribute['value'])
+
+        for obs_to_add, link in self.get_neighboors(obs['id']):
+            object_misp_domain_ip = self.__get_object_domain_ip(obs_to_add)
+            if object_misp_domain_ip:
+                self.misp_event.add_object(object_misp_domain_ip)
+                continue
+            object_misp_url = self.__get_object_url(obs_to_add)
+            if object_misp_url:
+                self.misp_event.add_object(object_misp_url)
+                continue
+            if link[0] == 'NS record':
+                object_ns_record = self.__get_object_ns_record(obs_to_add, link[1])
+                if object_ns_record:
+                    self.misp_event.add_object(object_ns_record)
+                    continue
+            self.__get_attribute(obs_to_add, link[0])
+
+    def get_result(self):
+        event = json.loads(self.misp_event.to_json())
+        results = {key: event[key] for key in ('Attribute', 'Object') if key in event}
+        return results
+
+    def __get_attribute(self, obs_to_add, link):
+
+        try:
+            type_attr = self.misp_mapping[obs_to_add['type']]
+            value = None
+            if obs_to_add['type'] == 'File':
+                value = obs_to_add['value'].split(':')[1]
+            else:
+                value = obs_to_add['value']
+            attr = self.misp_event.add_attribute(value=value, type=type_attr)
+            attr.comment = '%s: %s' % (link, self.attribute['value'])
+        except KeyError:
+            logging.error('type not found %s' % obs_to_add['type'])
+            return
+
+        for t in obs_to_add['tags']:
+            self.misp_event.add_attribute_tag(t['name'], attr['uuid'])
+
+    def __get_object_domain_ip(self, obj_to_add):
+        if (obj_to_add['type'] == 'Ip' and self.attribute['type'] in ['hostname', 'domain']) or \
+                (obj_to_add['type'] in ('Hostname', 'Domain') and self.attribute['type'] in ('ip-src', 'ip-dst')):
+            domain_ip_object = MISPObject('domain-ip')
+            domain_ip_object.add_attribute(self.__get_relation(obj_to_add),
+                                           obj_to_add['value'])
+            domain_ip_object.add_attribute(self.__get_relation(self.attribute, is_yeti_object=False),
+                                           self.attribute['value'])
+            domain_ip_object.add_reference(self.attribute['uuid'], 'related_to')
+
+            return domain_ip_object
+
+    def __get_object_url(self, obj_to_add):
+        if (obj_to_add['type'] == 'Url' and self.attribute['type'] in ['hostname', 'domain', 'ip-src', 'ip-dst']) or (
+                obj_to_add['type'] in ('Hostname', 'Domain', 'Ip') and self.attribute['type'] == 'url'
+        ):
+            url_object = MISPObject('url')
+            obj_relation = self.__get_relation(obj_to_add)
+            if obj_relation:
+                url_object.add_attribute(obj_relation, obj_to_add['value'])
+            obj_relation = self.__get_relation(self.attribute, is_yeti_object=False)
+            if obj_relation:
+                url_object.add_attribute(obj_relation,
+                                         self.attribute['value'])
+            url_object.add_reference(self.attribute['uuid'], 'related_to')
+
+            return url_object
+
+    def __get_object_ns_record(self, obj_to_add, link):
+        queried_domain = None
+        ns_domain = None
+        object_dns_record = MISPObject('dns-record')
+        if link == 'dst':
+            queried_domain = self.attribute['value']
+            ns_domain = obj_to_add['value']
+        elif link == 'src':
+            queried_domain = obj_to_add['value']
+            ns_domain = self.attribute['value']
+        if queried_domain and ns_domain:
+            object_dns_record.add_attribute('queried-domain', queried_domain)
+            object_dns_record.add_attribute('ns-record', ns_domain)
+            object_dns_record.add_reference(self.attribute['uuid'], 'related_to')
+
+            return object_dns_record
+
+    def __get_relation(self, obj, is_yeti_object=True):
+        if is_yeti_object:
+            type_attribute = self.misp_mapping[obj['type']]
+        else:
+            type_attribute = obj['type']
+        if type_attribute == 'ip-src' or type_attribute == 'ip-dst':
+            return 'ip'
+        elif 'domain' == type_attribute:
+            return 'domain'
+        elif 'hostname' == type_attribute:
+            return 'domain'
+        elif type_attribute == 'url':
+            return type_attribute
+
+
+def handler(q=False):
+    if q is False:
+        return False
+
+    apikey = None
+    yeti_url = None
+    yeti_client = None
+
+    request = json.loads(q)
+    attribute = request['attribute']
+    if attribute['type'] not in mispattributes['input']:
+        return {'error': 'Unsupported attributes type'}
+
+    if 'config' in request and 'url' in request['config']:
+        yeti_url = request['config']['url']
+    if 'config' in request and 'apikey' in request['config']:
+        apikey = request['config']['apikey']
+    if apikey and yeti_url:
+        yeti_client = Yeti(yeti_url, apikey, attribute)
+
+    if yeti_client:
+        yeti_client.parse_yeti_result()
+        return {'results': yeti_client.get_result()}
+    else:
+        misperrors['error'] = 'Yeti Config Error'
+        return misperrors
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo
+
+
+def introspection():
+    return mispattributes

misp_modules/modules/export_mod/__init__.py

@@ -0,0 +1,3 @@
+__all__ = ['cef_export', 'mass_eql_export', 'liteexport', 'goamlexport', 'threat_connect_export', 'pdfexport',
+           'threatStream_misp_export', 'osqueryexport', 'nexthinkexport', 'vt_graph', 'defender_endpoint_export',
+           'virustotal_collections', 'yara_export', 'cisco_firesight_manager_ACL_rule_export']

misp_modules/modules/export_mod/cef_export.py

@@ -0,0 +1,93 @@
+import json
+import base64
+import datetime
+
+misperrors = {'error': 'Error'}
+
+# possible module-types: 'expansion', 'hover' or both
+moduleinfo = {
+    'version': '1',
+    'author': 'Hannah Ward',
+    'description': 'Module to export a MISP event in CEF format.',
+    'module-type': ['export'],
+    'name': 'CEF Export',
+    'logo': '',
+    'requirements': [],
+    'features': 'The module takes a MISP event in input, to look every attribute. Each attribute matching with some predefined types is then exported in Common Event Format.\nThus, there is no particular feature concerning MISP Events since any event can be exported. However, 4 configuration parameters recognized by CEF format are required and should be provided by users before exporting data: the device vendor, product and version, as well as the default severity of data.',
+    'references': ['https://community.softwaregrp.com/t5/ArcSight-Connectors/ArcSight-Common-Event-Format-CEF-Guide/ta-p/1589306?attachment-id=65537'],
+    'input': 'MISP Event attributes',
+    'output': 'Common Event Format file',
+}
+
+# config fields that your code expects from the site admin
+moduleconfig = ["Default_Severity", "Device_Vendor", "Device_Product", "Device_Version"]
+
+cefmapping = {"ip-src": "src", "ip-dst": "dst", "hostname": "dhost", "domain": "dhost",
+              "md5": "fileHash", "sha1": "fileHash", "sha256": "fileHash",
+              "url": "request"}
+
+mispattributes = {'input': list(cefmapping.keys())}
+outputFileExtension = "cef"
+responseType = "application/txt"
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    request = json.loads(q)
+    if "config" in request:
+        config = request["config"]
+    else:
+        config = {"Default_Severity": 1, "Device_Vendor": "MISP",
+                  "Device_Product": "MISP", "Device_Version": 1}
+
+    data = request["data"]
+    response = ""
+    for ev in data:
+        event = ev["Attribute"]
+        for attr in event:
+            if attr["type"] in cefmapping:
+                response += "{} host CEF:0|{}|{}|{}|{}|{}|{}|{}={}\n".format(
+                            datetime.datetime.fromtimestamp(int(attr["timestamp"])).strftime("%b %d %H:%M:%S"),
+                            config["Device_Vendor"],
+                            config["Device_Product"],
+                            config["Device_Version"],
+                            attr["category"],
+                            attr["category"],
+                            config["Default_Severity"],
+                            cefmapping[attr["type"]],
+                            attr["value"],
+                )
+
+    r = {"response": [], "data": str(base64.b64encode(bytes(response, 'utf-8')), 'utf-8')}
+    return r
+
+
+def introspection():
+    modulesetup = {}
+    try:
+        responseType
+        modulesetup['responseType'] = responseType
+    except NameError:
+        pass
+    try:
+        userConfig
+        modulesetup['userConfig'] = userConfig
+    except NameError:
+        pass
+    try:
+        outputFileExtension
+        modulesetup['outputFileExtension'] = outputFileExtension
+    except NameError:
+        pass
+    try:
+        inputSource
+        modulesetup['inputSource'] = inputSource
+    except NameError:
+        pass
+    return modulesetup
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo