misp-modules 2.4.196__py3-none-any.whl

misp_modules/modules/export_mod/cisco_firesight_manager_ACL_rule_export.py

@@ -0,0 +1,150 @@
+######################################################
+#                                                    #
+# Author: Stanislav Klevtsov, Ukraine; Feb 2019.     #
+#                                                    #
+#                                                    #
+# Script was tested on the following configuration:  #
+#    MISP v2.4.90                                    #
+#    Cisco Firesight Manager Console v6.2.3 (bld 84) #
+#                                                    #
+######################################################
+
+import json
+import base64
+from urllib.parse import quote
+
+misperrors = {'error': 'Error'}
+
+moduleinfo = {
+    'version': '1',
+    'author': 'Stanislav Klevtsov',
+    'description': 'Module to export malicious network activity attributes to Cisco fireSIGHT manager block rules.',
+    'module-type': ['export'],
+    'name': 'Cisco fireSIGHT blockrule Export',
+    'logo': 'cisco.png',
+    'requirements': ['Firesight manager console credentials'],
+    'features': 'The module goes through the attributes to find all the network activity ones in order to create block rules for the Cisco fireSIGHT manager.',
+    'references': [],
+    'input': 'Network activity attributes (IPs, URLs).',
+    'output': 'Cisco fireSIGHT manager block rules.',
+}
+
+
+moduleconfig = ['fmc_ip_addr', 'fmc_login', 'fmc_pass', 'domain_id', 'acpolicy_id']
+
+fsmapping = {"ip-dst": "dst", "url": "request"}
+
+mispattributes = {'input': list(fsmapping.keys())}
+
+# options: event, attribute, event-collection, attribute-collection
+inputSource = ['event']
+
+outputFileExtension = 'sh'
+responseType = 'application/txt'
+
+# .sh file templates
+SH_FILE_HEADER = """#!/bin/sh\n\n"""
+
+BLOCK_JSON_TMPL = """
+BLOCK_RULE='{{ "action": "BLOCK", "enabled": true, "type": "AccessRule", "name": "{rule_name}", "destinationNetworks": {{ "literals": [ {dst_networks} ] }}, "urls": {{ "literals": [ {urls} ]  }}, "newComments": [ "{event_info_comment}" ] }}'\n
+"""
+
+BLOCK_DST_JSON_TMPL = """{{ "type": "Host", "value": "{ipdst}" }} """
+BLOCK_URL_JSON_TMPL = """{{ "type": "Url", "url": "{url}" }} """
+
+CURL_ADD_RULE_TMPL = """
+curl -X POST -v -k -H 'Content-Type: application/json' -H \"Authorization: Basic $LOGINPASS_BASE64\" -H \"X-auth-access-token: $ACC_TOKEN\" -i \"https://$FIRESIGHT_IP_ADDR/api/fmc_config/v1/domain/$DOMAIN_ID/policy/accesspolicies/$ACPOLICY_ID/accessrules\" --data \"$BLOCK_RULE\" """
+
+
+def handler(q=False):
+    if q is False:
+        return False
+
+    r = {'results': []}
+    request = json.loads(q)
+
+    if "config" in request:
+        config = request["config"]
+
+    # check if config is empty
+    if not config['fmc_ip_addr']:
+        config['fmc_ip_addr'] = "0.0.0.0"
+    if not config['fmc_login']:
+        config['fmc_login'] = "login"
+    if not config['fmc_pass']:
+        config['fmc_pass'] = "password"
+    if not config['domain_id']:
+        config['domain_id'] = "SET_FIRESIGHT_DOMAIN_ID"
+    if not config['acpolicy_id']:
+        config['acpolicy_id'] = "SET_FIRESIGHT_ACPOLICY_ID"
+
+    data = request["data"]
+    output = ""
+    ipdst = []
+    urls = []
+
+    # populate the ACL rule with attributes
+    for ev in data:
+
+        event = ev["Attribute"]
+        event_id = ev["Event"]["id"]
+        event_info = ev["Event"]["info"]
+
+        for index, attr in enumerate(event):
+            if attr["to_ids"] is True:
+                if attr["type"] in fsmapping:
+                    if attr["type"] == "ip-dst":
+                        ipdst.append(BLOCK_DST_JSON_TMPL.format(ipdst=attr["value"]))
+                    else:
+                        urls.append(BLOCK_URL_JSON_TMPL.format(url=quote(attr["value"], safe='@/:;?&=-_.,+!*')))
+
+    # building the .sh file
+    output += SH_FILE_HEADER
+    output += "FIRESIGHT_IP_ADDR='{}'\n".format(config['fmc_ip_addr'])
+
+    output += "LOGINPASS_BASE64=`echo -n '{}:{}' | base64`\n".format(config['fmc_login'], config['fmc_pass'])
+    output += "DOMAIN_ID='{}'\n".format(config['domain_id'])
+    output += "ACPOLICY_ID='{}'\n\n".format(config['acpolicy_id'])
+
+    output += "ACC_TOKEN=`curl -X POST -v -k -sD - -o /dev/null -H \"Authorization: Basic $LOGINPASS_BASE64\" -i \"https://$FIRESIGHT_IP_ADDR/api/fmc_platform/v1/auth/generatetoken\" | grep -i x-auth-acc | sed 's/.*:\\ //g' | tr -d '[:space:]' | tr -d '\\n'`\n"
+
+    output += BLOCK_JSON_TMPL.format(rule_name="misp_event_{}".format(event_id),
+                                     dst_networks=', '.join(ipdst),
+                                     urls=', '.join(urls),
+                                     event_info_comment=event_info) + "\n"
+
+    output += CURL_ADD_RULE_TMPL
+    # END building the .sh file
+
+    r = {"data": base64.b64encode(output.encode('utf-8')).decode('utf-8')}
+    return r
+
+
+def introspection():
+    modulesetup = {}
+    try:
+        responseType
+        modulesetup['responseType'] = responseType
+    except NameError:
+        pass
+    try:
+        userConfig
+        modulesetup['userConfig'] = userConfig
+    except NameError:
+        pass
+    try:
+        outputFileExtension
+        modulesetup['outputFileExtension'] = outputFileExtension
+    except NameError:
+        pass
+    try:
+        inputSource
+        modulesetup['inputSource'] = inputSource
+    except NameError:
+        pass
+    return modulesetup
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo

misp_modules/modules/export_mod/defender_endpoint_export.py

@@ -0,0 +1,141 @@
+"""
+Export module for coverting MISP events into Defender for Endpoint KQL queries.
+Config['Period'] : allows to define period over witch to look for IOC from now
+"""
+
+import base64
+import json
+
+misperrors = {"error": "Error"}
+
+types_to_use = ['sha256', 'sha1', 'md5', 'domain', 'ip-src', 'ip-dst', 'url']
+
+userConfig = {
+
+}
+
+moduleconfig = ["Period"]
+inputSource = ['event']
+
+outputFileExtension = 'kql'
+responseType = 'application/txt'
+
+moduleinfo = {
+    'version': '1.1',
+    'author': 'Julien Bachmann, Hacknowledge, Maik Wuerth',
+    'description': 'Defender for Endpoint KQL hunting query export module',
+    'module-type': ['export'],
+    'name': 'Microsoft Defender for Endpoint KQL Export',
+    'logo': 'defender_endpoint.png',
+    'requirements': [],
+    'features': 'This module export an event as Defender for Endpoint KQL queries that can then be used in your own python3 or Powershell tool. If you are using Microsoft Sentinel, you can directly connect your MISP instance to Sentinel and then create queries using the `ThreatIntelligenceIndicator` table to match events against imported IOC.',
+    'references': ['https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference'],
+    'input': 'MISP Event attributes',
+    'output': 'Defender for Endpoint KQL queries',
+}
+
+
+def handle_sha256(value, period):
+    query = f"""find in (DeviceEvents, DeviceAlertEvents,AlertInfo, AlertEvidence,  DeviceFileEvents, DeviceImageLoadEvents, DeviceProcessEvents)
+        where (SHA256 == '{value}' or InitiatingProcessSHA1 == '{value}') and
+        Timestamp between(ago({period}) .. now())"""
+    return query.replace('\n', ' ')
+
+
+def handle_sha1(value, period):
+    query = f"""find in (DeviceEvents, DeviceAlertEvents, AlertInfo, AlertEvidence, DeviceFileEvents, DeviceImageLoadEvents, DeviceProcessEvents)
+        where (SHA1 == '{value}' or InitiatingProcessSHA1 == '{value}') and
+        Timestamp between(ago({period}) .. now())"""
+    return query.replace('\n', ' ')
+
+
+def handle_md5(value, period):
+    query = f"""find in (DeviceEvents, DeviceAlertEvents, AlertInfo, AlertEvidence, DeviceFileEvents, DeviceImageLoadEvents, DeviceProcessEvents)
+        where (MD5 == '{value}' or InitiatingProcessMD5 == '{value}') and
+        Timestamp between(ago({period}) .. now())"""
+    return query.replace('\n', ' ')
+
+
+def handle_domain(value, period):
+    query = f"""find in (DeviceAlertEvents, AlertInfo, AlertEvidence, DeviceNetworkEvents)
+        where RemoteUrl contains '{value}' and
+        Timestamp between(ago({period}) .. now())"""
+    return query.replace('\n', ' ')
+
+
+def handle_ip(value, period):
+    query = f"""find in (DeviceAlertEvents, AlertInfo, AlertEvidence, DeviceNetworkEvents)
+        where RemoteIP == '{value}' and
+        Timestamp between(ago({period}) .. now())"""
+    return query.replace('\n', ' ')
+
+
+def handle_url(value, period):
+    query = f"""let url = '{value}';
+        search in (EmailUrlInfo,UrlClickEvents,DeviceNetworkEvents,DeviceFileEvents,DeviceEvents,BehaviorEntities, AlertInfo, AlertEvidence, DeviceAlertEvents)
+        Timestamp between(ago({period}) .. now()) and
+        RemoteUrl has url
+        or FileOriginUrl has url
+        or FileOriginReferrerUrl has url
+        or Url has url"""
+    return query.replace('\n', ' ')
+
+
+handlers = {
+    'sha256': handle_sha256,
+    'sha1': handle_sha1,
+    'md5': handle_md5,
+    'domain': handle_url,
+    'ip-src': handle_ip,
+    'ip-dst': handle_ip,
+    'url': handle_url
+}
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    request = json.loads(q)
+    config = request.get("config", {"Period": ""})
+    output = ''
+
+    for event in request["data"]:
+        for attribute in event["Attribute"]:
+            if attribute['type'] in types_to_use:
+                output = output + handlers[attribute['type']](attribute['value'], config['Period']) + '\n'
+        for obj in event["Object"]:
+            for attribute in obj["Attribute"]:
+                if attribute['type'] in types_to_use:
+                    output = output + handlers[attribute['type']](attribute['value'], config['Period']) + '\n'
+    r = {"response": [], "data": str(base64.b64encode(bytes(output, 'utf-8')), 'utf-8')}
+    return r
+
+
+def introspection():
+    modulesetup = {}
+    try:
+        responseType
+        modulesetup['responseType'] = responseType
+    except NameError:
+        pass
+    try:
+        userConfig
+        modulesetup['userConfig'] = userConfig
+    except NameError:
+        pass
+    try:
+        outputFileExtension
+        modulesetup['outputFileExtension'] = outputFileExtension
+    except NameError:
+        pass
+    try:
+        inputSource
+        modulesetup['inputSource'] = inputSource
+    except NameError:
+        pass
+    return modulesetup
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo

misp_modules/modules/export_mod/goamlexport.py

@@ -0,0 +1,255 @@
+import json
+import base64
+from pymisp import MISPEvent
+from collections import defaultdict, Counter
+
+misperrors = {'error': 'Error'}
+moduleinfo = {
+    'version': '1',
+    'author': 'Christian Studer',
+    'description': 'This module is used to export MISP events containing transaction objects into GoAML format.',
+    'module-type': ['export'],
+    'name': 'GoAML Export',
+    'require_standard_format': True,
+    'logo': 'goAML.jpg',
+    'requirements': ['PyMISP', 'MISP objects'],
+    'features': "The module works as long as there is at least one transaction object in the Event.\n\nThen in order to have a valid GoAML document, please follow these guidelines:\n- For each transaction object, use either a bank-account, person, or legal-entity object to describe the origin of the transaction, and again one of them to describe the target of the transaction.\n- Create an object reference for both origin and target objects of the transaction.\n- A bank-account object needs a signatory, which is a person object, put as object reference of the bank-account.\n- A person can have an address, which is a geolocation object, put as object reference of the person.\n\nSupported relation types for object references that are recommended for each object are the folowing:\n- transaction:\n\t- 'from', 'from_my_client': Origin of the transaction - at least one of them is required.\n\t- 'to', 'to_my_client': Target of the transaction - at least one of them is required.\n\t- 'address': Location of the transaction - optional.\n- bank-account:\n\t- 'signatory': Signatory of a bank-account - the reference from bank-account to a signatory is required, but the relation-type is optional at the moment since this reference will always describe a signatory.\n\t- 'entity': Entity owning the bank account - optional.\n- person:\n\t- 'address': Address of a person - optional.",
+    'references': ['http://goaml.unodc.org/'],
+    'input': 'MISP objects (transaction, bank-account, person, legal-entity, geolocation), with references, describing financial transactions and their origin and target.',
+    'output': 'GoAML format file, describing financial transactions, with their origin and target (bank accounts, persons or entities).',
+}
+moduleconfig = ['rentity_id']
+mispattributes = {'input': ['MISPEvent'], 'output': ['xml file']}
+outputFileExtension = "xml"
+responseType = "application/xml"
+
+objects_to_parse = ['transaction', 'bank-account', 'person', 'entity', 'geolocation']
+
+goAMLmapping = {'bank-account': {'bank-account': 't_account', 'institution-name': 'institution_name',
+                                 'institution-code': 'institution_code', 'iban': 'iban', 'swift': 'swift',
+                                 'branch': 'branch', 'non-banking-institution': 'non_bank_institution',
+                                 'account': 'account', 'currency-code': 'currency_code',
+                                 'account-name': 'account_name', 'client-number': 'client_number',
+                                 'personal-account-type': 'personal_account_type', 'opened': 'opened',
+                                 'closed': 'closed', 'balance': 'balance', 'status-code': 'status_code',
+                                 'beneficiary': 'beneficiary', 'beneficiary-comment': 'beneficiary_comment',
+                                 'comments': 'comments'},
+                'person': {'person': 't_person', 'text': 'comments', 'first-name': 'first_name',
+                           'middle-name': 'middle_name', 'last-name': 'last_name', 'title': 'title',
+                           'mothers-name': 'mothers_name', 'alias': 'alias', 'date-of-birth': 'birthdate',
+                           'place-of-birth': 'birth_place', 'gender': 'gender', 'nationality': 'nationality1',
+                           'passport-number': 'passport_number', 'passport-country': 'passport_country',
+                           'social-security-number': 'ssn', 'identity-card-number': 'id_number'},
+                'geolocation': {'geolocation': 'location', 'city': 'city', 'region': 'state',
+                                'country': 'country_code', 'address': 'address', 'zipcode': 'zip'},
+                'transaction': {'transaction': 'transaction', 'transaction-number': 'transactionnumber',
+                                'date': 'date_transaction', 'location': 'transaction_location',
+                                'transmode-code': 'transmode_code', 'amount': 'amount_local',
+                                'transmode-comment': 'transmode_comment', 'date-posting': 'date_posting',
+                                'teller': 'teller', 'authorized': 'authorized',
+                                'text': 'transaction_description'},
+                'legal-entity': {'legal-entity': 'entity', 'name': 'name', 'business': 'business',
+                                 'commercial-name': 'commercial_name', 'phone-number': 'phone',
+                                 'legal-form': 'incorporation_legal_form',
+                                 'registration-number': 'incorporation_number'}}
+
+referencesMapping = {'bank-account': {'aml_type': '{}_account', 'bracket': 't_{}'},
+                     'person': {'transaction': {'aml_type': '{}_person', 'bracket': 't_{}'}, 'bank-account': {'aml_type': 't_person', 'bracket': 'signatory'}},
+                     'legal-entity': {'transaction': {'aml_type': '{}_entity', 'bracket': 't_{}'}, 'bank-account': {'aml_type': 't_entity'}},
+                     'geolocation': {'aml_type': 'address', 'bracket': 'addresses'}}
+
+
+class GoAmlGeneration(object):
+    def __init__(self, config):
+        self.config = config
+        self.parsed_uuids = defaultdict(list)
+
+    def from_event(self, event):
+        self.misp_event = MISPEvent()
+        self.misp_event.load(event)
+
+    def parse_objects(self):
+        uuids = defaultdict(list)
+        report_code = []
+        currency_code = []
+        for obj in self.misp_event.objects:
+            obj_type = obj.name
+            uuids[obj_type].append(obj.uuid)
+            if obj_type == 'bank-account':
+                try:
+                    report_code.append(obj.get_attributes_by_relation('report-code')[0].value.split(' ')[0])
+                    currency_code.append(obj.get_attributes_by_relation('currency-code')[0].value)
+                except IndexError:
+                    print('report_code or currency_code error')
+        self.uuids, self.report_codes, self.currency_codes = uuids, report_code, currency_code
+
+    def build_xml(self):
+        self.xml = {'header': "<report><rentity_id>{}</rentity_id><submission_code>E</submission_code>".format(self.config),
+                    'data': ""}
+        if "STR" in self.report_codes:
+            report_code = "STR"
+        else:
+            report_code = Counter(self.report_codes).most_common(1)[0][0]
+        self.xml['header'] += "<report_code>{}</report_code>".format(report_code)
+        submission_date = str(self.misp_event.timestamp).replace(' ', 'T')
+        self.xml['header'] += "<submission_date>{}</submission_date>".format(submission_date)
+        self.xml['header'] += "<currency_code_local>{}</currency_code_local>".format(Counter(self.currency_codes).most_common(1)[0][0])
+        for trans_uuid in self.uuids.get('transaction'):
+            self.itterate('transaction', 'transaction', trans_uuid, 'data')
+        person_to_parse = [person_uuid for person_uuid in self.uuids.get('person') if person_uuid not in self.parsed_uuids.get('person')]
+        if len(person_to_parse) == 1:
+            self.itterate('person', 'reporting_person', person_to_parse[0], 'header')
+        try:
+            location_to_parse = [location_uuid for location_uuid in self.uuids.get('geolocation') if location_uuid not in self.parsed_uuids.get('geolocation')]
+            if len(location_to_parse) == 1:
+                self.itterate('geolocation', 'location', location_to_parse[0], 'header')
+        except TypeError:
+            pass
+        self.xml['data'] += "</report>"
+
+    def itterate(self, object_type, aml_type, uuid, xml_part):
+        obj = self.misp_event.get_object_by_uuid(uuid)
+        if object_type == 'transaction':
+            self.xml[xml_part] += "<{}>".format(aml_type)
+            self.fill_xml_transaction(object_type, obj.attributes, xml_part)
+            self.parsed_uuids[object_type].append(uuid)
+            if obj.ObjectReference:
+                self.parseObjectReferences(object_type, xml_part, obj.ObjectReference)
+            self.xml[xml_part] += "</{}>".format(aml_type)
+        else:
+            if 'to_' in aml_type or 'from_' in aml_type:
+                relation_type = aml_type.split('_')[0]
+                self.xml[xml_part] += "<{0}_funds_code>{1}</{0}_funds_code>".format(relation_type, self.from_and_to_fields[relation_type]['funds'].split(' ')[0])
+                self.itterate_normal_case(object_type, obj, aml_type, uuid, xml_part)
+                self.xml[xml_part] += "<{0}_country>{1}</{0}_country>".format(relation_type, self.from_and_to_fields[relation_type]['country'])
+            else:
+                self.itterate_normal_case(object_type, obj, aml_type, uuid, xml_part)
+
+    def itterate_normal_case(self, object_type, obj, aml_type, uuid, xml_part):
+        self.xml[xml_part] += "<{}>".format(aml_type)
+        self.fill_xml(object_type, obj, xml_part)
+        self.parsed_uuids[object_type].append(uuid)
+        if obj.ObjectReference:
+            self.parseObjectReferences(object_type, xml_part, obj.ObjectReference)
+        self.xml[xml_part] += "</{}>".format(aml_type)
+
+    def parseObjectReferences(self, object_type, xml_part, references):
+        for ref in references:
+            next_uuid = ref.referenced_uuid
+            next_object_type = ref.Object.get('name')
+            relationship_type = ref.relationship_type
+            self.parse_references(object_type, next_object_type, next_uuid, relationship_type, xml_part)
+
+    def fill_xml_transaction(self, object_type, attributes, xml_part):
+        from_and_to_fields = {'from': {}, 'to': {}}
+        for attribute in attributes:
+            object_relation = attribute.object_relation
+            attribute_value = attribute.value
+            if object_relation == 'date-posting':
+                self.xml[xml_part] += "<late_deposit>True</late_deposit>"
+            elif object_relation in ('from-funds-code', 'to-funds-code'):
+                relation_type, field, _ = object_relation.split('-')
+                from_and_to_fields[relation_type][field] = attribute_value
+                continue
+            elif object_relation in ('from-country', 'to-country'):
+                relation_type, field = object_relation.split('-')
+                from_and_to_fields[relation_type][field] = attribute_value
+                continue
+            try:
+                self.xml[xml_part] += "<{0}>{1}</{0}>".format(goAMLmapping[object_type][object_relation], attribute_value)
+            except KeyError:
+                pass
+        self.from_and_to_fields = from_and_to_fields
+
+    def fill_xml(self, object_type, obj, xml_part):
+        if obj.name == 'bank-account':
+            for attribute in obj.attributes:
+                if attribute.object_relation in ('personal-account-type', 'status-code'):
+                    attribute_value = attribute.value.split(' - ')[0]
+                else:
+                    attribute_value = attribute.value
+                try:
+                    self.xml[xml_part] += "<{0}>{1}</{0}>".format(goAMLmapping[object_type][attribute.object_relation], attribute_value)
+                except KeyError:
+                    pass
+        else:
+            for attribute in obj.attributes:
+                try:
+                    self.xml[xml_part] += "<{0}>{1}</{0}>".format(goAMLmapping[object_type][attribute.object_relation], attribute.value)
+                except KeyError:
+                    pass
+
+    def parse_references(self, object_type, next_object_type, uuid, relationship_type, xml_part):
+        reference = referencesMapping[next_object_type]
+        try:
+            next_aml_type = reference[object_type].get('aml_type').format(relationship_type.split('_')[0])
+            try:
+                bracket = reference[object_type].get('bracket').format(relationship_type)
+                self.xml[xml_part] += "<{}>".format(bracket)
+                self.itterate(next_object_type, next_aml_type, uuid, xml_part)
+                self.xml[xml_part] += "</{}>".format(bracket)
+            except KeyError:
+                self.itterate(next_object_type, next_aml_type, uuid, xml_part)
+        except KeyError:
+            next_aml_type = reference.get('aml_type').format(relationship_type.split('_')[0])
+            bracket = reference.get('bracket').format(relationship_type)
+            self.xml[xml_part] += "<{}>".format(bracket)
+            self.itterate(next_object_type, next_aml_type, uuid, xml_part)
+            self.xml[xml_part] += "</{}>".format(bracket)
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    request = json.loads(q)
+    if 'data' not in request:
+        return False
+    if not request.get('config') and not request['config'].get('rentity_id'):
+        misperrors['error'] = "Configuration error."
+        return misperrors
+    config = request['config'].get('rentity_id')
+    export_doc = GoAmlGeneration(config)
+    export_doc.from_event(request['data'][0])
+    if not export_doc.misp_event.Object:
+        misperrors['error'] = "There is no object in this event."
+        return misperrors
+    types = []
+    for obj in export_doc.misp_event.Object:
+        types.append(obj.name)
+    if 'transaction' not in types:
+        misperrors['error'] = "There is no transaction object in this event."
+        return misperrors
+    export_doc.parse_objects()
+    export_doc.build_xml()
+    exp_doc = "{}{}".format(export_doc.xml.get('header'), export_doc.xml.get('data'))
+    return {'response': [], 'data': str(base64.b64encode(bytes(exp_doc, 'utf-8')), 'utf-8')}
+
+
+def introspection():
+    modulesetup = {}
+    try:
+        responseType
+        modulesetup['responseType'] = responseType
+    except NameError:
+        pass
+    try:
+        userConfig
+        modulesetup['userConfig'] = userConfig
+    except NameError:
+        pass
+    try:
+        outputFileExtension
+        modulesetup['outputFileExtension'] = outputFileExtension
+    except NameError:
+        pass
+    try:
+        inputSource
+        moduleSetup['inputSource'] = inputSource
+    except NameError:
+        pass
+    return modulesetup
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo

misp_modules/modules/export_mod/liteexport.py

@@ -0,0 +1,97 @@
+import json
+import base64
+
+misperrors = {'error': 'Error'}
+
+moduleinfo = {
+    'version': '1',
+    'author': 'TM',
+    'description': 'Lite export of a MISP event.',
+    'module-type': ['export'],
+    'name': 'Lite Export',
+    'logo': '',
+    'requirements': [],
+    'features': 'This module is simply producing a json MISP event format file, but exporting only Attributes from the Event. Thus, MISP Events exported with this module should have attributes that are not internal references, otherwise the resulting event would be empty.',
+    'references': [],
+    'input': 'MISP Event attributes',
+    'output': 'Lite MISP Event',
+}
+
+moduleconfig = ["indent_json_export"]
+
+mispattributes = {}
+outputFileExtension = "json"
+responseType = "application/json"
+
+
+def handler(q=False):
+    if q is False:
+        return False
+
+    request = json.loads(q)
+
+    config = {}
+    if "config" in request:
+        config = request["config"]
+    else:
+        config = {"indent_json_export": None}
+
+    if config['indent_json_export'] is not None:
+        try:
+            config['indent_json_export'] = int(config['indent_json_export'])
+        except Exception:
+            config['indent_json_export'] = None
+
+    if 'data' not in request:
+        return False
+
+    # ~ Misp json structur
+    liteEvent = {'Event': {}}
+
+    for evt in request['data']:
+        rawEvent = evt['Event']
+        liteEvent['Event']['info'] = rawEvent['info']
+        liteEvent['Event']['Attribute'] = []
+
+        attrs = evt['Attribute']
+        for attr in attrs:
+            if 'Internal reference' not in attr['category']:
+                liteAttr = {}
+                liteAttr['category'] = attr['category']
+                liteAttr['type'] = attr['type']
+                liteAttr['value'] = attr['value']
+                liteEvent['Event']['Attribute'].append(liteAttr)
+
+    return {'response': [],
+            'data': str(base64.b64encode(bytes(
+                json.dumps(liteEvent, indent=config['indent_json_export']), 'utf-8')), 'utf-8')}
+
+
+def introspection():
+    modulesetup = {}
+    try:
+        responseType
+        modulesetup['responseType'] = responseType
+    except NameError:
+        pass
+    try:
+        userConfig
+        modulesetup['userConfig'] = userConfig
+    except NameError:
+        pass
+    try:
+        outputFileExtension
+        modulesetup['outputFileExtension'] = outputFileExtension
+    except NameError:
+        pass
+    try:
+        inputSource
+        modulesetup['inputSource'] = inputSource
+    except NameError:
+        pass
+    return modulesetup
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo