misp-modules 2.4.196__py3-none-any.whl

misp_modules/modules/import_mod/lastline_import.py

@@ -0,0 +1,160 @@
+#!/usr/bin/env python3
+"""
+Deprecation notice: this module will be deprecated by December 2021, please use vmware_nsx module.
+
+Module (type "import") to import a Lastline report from an analysis link.
+"""
+import json
+
+import lastline_api
+
+
+misperrors = {
+    "error": "Error",
+}
+
+userConfig = {
+    "analysis_link": {
+        "type": "String",
+        "errorMessage": "Expected analysis link",
+        "message": "The link to a Lastline analysis"
+    },
+}
+
+inputSource = []
+
+moduleinfo = {
+    'version': '0.1',
+    'author': 'Stefano Ortolani',
+    'description': 'Deprecation notice: this module will be deprecated by December 2021, please use vmware_nsx module.\n\nModule to import and parse reports from Lastline analysis links.',
+    'module-type': ['import'],
+    'name': 'Lastline Import',
+    'logo': 'lastline.png',
+    'requirements': [],
+    'features': 'The module requires a Lastline Portal `username` and `password`.\nThe module uses the new format and it is able to return MISP attributes and objects.\nThe module returns the same results as the [lastline_query](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/expansion/lastline_query.py) expansion module.',
+    'references': ['https://www.lastline.com'],
+    'input': 'Link to a Lastline analysis.',
+    'output': 'MISP attributes and objects parsed from the analysis report.',
+}
+
+moduleconfig = [
+    "username",
+    "password",
+    "verify_ssl",
+]
+
+
+def introspection():
+    modulesetup = {}
+    try:
+        userConfig
+        modulesetup["userConfig"] = userConfig
+    except NameError:
+        pass
+    try:
+        inputSource
+        modulesetup["inputSource"] = inputSource
+    except NameError:
+        pass
+    modulesetup["format"] = "misp_standard"
+    return modulesetup
+
+
+def version():
+    moduleinfo["config"] = moduleconfig
+    return moduleinfo
+
+
+def handler(q=False):
+    if q is False:
+        return False
+
+    request = json.loads(q)
+
+    # Parse the init parameters
+    try:
+        config = request["config"]
+        auth_data = lastline_api.LastlineAbstractClient.get_login_params_from_dict(config)
+        analysis_link = request["config"]["analysis_link"]
+        # The API url changes based on the analysis link host name
+        api_url = lastline_api.get_portal_url_from_task_link(analysis_link)
+    except Exception as e:
+        misperrors["error"] = "Error parsing configuration: {}".format(e)
+        return misperrors
+
+    # Parse the call parameters
+    try:
+        task_uuid = lastline_api.get_uuid_from_task_link(analysis_link)
+    except (KeyError, ValueError) as e:
+        misperrors["error"] = "Error processing input parameters: {}".format(e)
+        return misperrors
+
+    # Make the API calls
+    try:
+        api_client = lastline_api.PortalClient(api_url, auth_data, verify_ssl=config.get('verify_ssl', True).lower() in ("true"))
+        response = api_client.get_progress(task_uuid)
+        if response.get("completed") != 1:
+            raise ValueError("Analysis is not finished yet.")
+
+        response = api_client.get_result(task_uuid)
+        if not response:
+            raise ValueError("Analysis report is empty.")
+
+    except Exception as e:
+        misperrors["error"] = "Error issuing the API call: {}".format(e)
+        return misperrors
+
+    # Parse and return
+    result_parser = lastline_api.LastlineResultBaseParser()
+    result_parser.parse(analysis_link, response)
+
+    event = result_parser.misp_event
+    event_dictionary = json.loads(event.to_json())
+
+    return {
+        "results": {
+            key: event_dictionary[key]
+            for key in ("Attribute", "Object", "Tag")
+            if (key in event and event[key])
+        }
+    }
+
+
+if __name__ == "__main__":
+    """Test importing information from a Lastline analysis link."""
+    import argparse
+    import configparser
+
+    parser = argparse.ArgumentParser()
+    parser.add_argument("-c", "--config-file", dest="config_file")
+    parser.add_argument("-s", "--section-name", dest="section_name")
+    args = parser.parse_args()
+    c = configparser.ConfigParser()
+    c.read(args.config_file)
+    a = lastline_api.LastlineAbstractClient.get_login_params_from_conf(c, args.section_name)
+
+    j = json.dumps(
+        {
+            "config": {
+                **a,
+                "analysis_link": (
+                    "https://user.lastline.com/portal#/analyst/task/"
+                    "1fcbcb8f7fb400100772d6a7b62f501b/overview"
+                )
+            }
+        }
+    )
+    print(json.dumps(handler(j), indent=4, sort_keys=True))
+
+    j = json.dumps(
+        {
+            "config": {
+                **a,
+                "analysis_link": (
+                    "https://user.lastline.com/portal#/analyst/task/"
+                    "f3c0ae115d51001017ff8da768fa6049/overview"
+                )
+            }
+        }
+    )
+    print(json.dumps(handler(j), indent=4, sort_keys=True))

misp_modules/modules/import_mod/mispjson.py

@@ -0,0 +1,73 @@
+import json
+import base64
+
+misperrors = {'error': 'Error'}
+userConfig = {}
+
+inputSource = ['file']
+
+moduleinfo = {
+    'version': '0.1',
+    'author': 'Richard van den Berg',
+    'description': 'Module to import MISP JSON format for merging MISP events.',
+    'module-type': ['import'],
+    'name': 'MISP JSON Import',
+    'logo': '',
+    'requirements': [],
+    'features': 'The module simply imports MISP Attributes from an other MISP Event in order to merge events together. There is thus no special feature to make it work.',
+    'references': [],
+    'input': 'MISP Event',
+    'output': 'MISP Event attributes',
+}
+
+moduleconfig = []
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    r = {'results': []}
+    request = json.loads(q)
+    try:
+        mfile = base64.b64decode(request["data"]).decode('utf-8')
+        misp = json.loads(mfile)
+        event = misp['response'][0]['Event']
+        for a in event["Attribute"]:
+            tmp = {}
+            tmp["values"] = a["value"]
+            tmp["categories"] = a["category"]
+            tmp["types"] = a["type"]
+            tmp["to_ids"] = a["to_ids"]
+            tmp["comment"] = a["comment"]
+            if a.get("data"):
+                tmp["data"] = a["data"]
+            r['results'].append(tmp)
+    except Exception:
+        pass
+    return r
+
+
+def introspection():
+    modulesetup = {}
+    try:
+        userConfig
+        modulesetup['userConfig'] = userConfig
+    except NameError:
+        pass
+    try:
+        inputSource
+        modulesetup['inputSource'] = inputSource
+    except NameError:
+        pass
+    return modulesetup
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo
+
+
+if __name__ == '__main__':
+    x = open('test.json', 'r')
+    r = handler(q=x.read())
+    print(json.dumps(r))

misp_modules/modules/import_mod/ocr.py

@@ -0,0 +1,122 @@
+import sys
+import json
+import base64
+from io import BytesIO
+
+import logging
+
+log = logging.getLogger('ocr')
+log.setLevel(logging.DEBUG)
+ch = logging.StreamHandler(sys.stdout)
+ch.setLevel(logging.DEBUG)
+formatter = logging.Formatter('%(asctime)s - %(name)s - %(levelname)s - %(message)s')
+ch.setFormatter(formatter)
+log.addHandler(ch)
+
+misperrors = {'error': 'Error'}
+userConfig = {}
+
+inputSource = ['file']
+
+moduleinfo = {
+    'version': '0.2',
+    'author': 'Alexandre Dulaunoy',
+    'description': 'Optical Character Recognition (OCR) module for MISP.',
+    'module-type': ['import'],
+    'name': 'OCR Import',
+    'logo': '',
+    'requirements': [],
+    'features': 'The module tries to recognize some text from an image and import the result as a freetext attribute, there is then no special feature asked to users to make it work.',
+    'references': [],
+    'input': 'Image',
+    'output': 'freetext MISP attribute',
+}
+
+moduleconfig = []
+
+
+def handler(q=False):
+    # try to import modules and return errors if module not found
+    try:
+        from PIL import Image
+    except ImportError:
+        misperrors['error'] = "Please pip(3) install pillow"
+        return misperrors
+
+    try:
+        # Official ImageMagick module
+        from wand.image import Image as WImage
+    except ImportError:
+        misperrors['error'] = "Please pip(3) install wand"
+        return misperrors
+
+    try:
+        from pytesseract import image_to_string
+    except ImportError:
+        misperrors['error'] = "Please pip(3) install pytesseract"
+        return misperrors
+
+    if q is False:
+        return False
+    r = {'results': []}
+    request = json.loads(q)
+    document = base64.b64decode(request["data"])
+    document = WImage(blob=document)
+    if document.format == 'PDF':
+        with document as pdf:
+            # Get number of pages
+            pages = len(pdf.sequence)
+            log.debug("PDF with {} page(s) detected".format(pages))
+            # Create new image object where the height will be the number of pages. With huge PDFs this will overflow, break, consume silly memory etc…
+            img = WImage(width=pdf.width, height=pdf.height * pages)
+            # Cycle through pages and stitch it together to one big file
+            for p in range(pages):
+                log.debug("Stitching page {}".format(p + 1))
+                image = img.composite(pdf.sequence[p], top=pdf.height * p, left=0)
+            # Create a png blob
+            image = img.make_blob('png')
+            log.debug("Final image size is {}x{}".format(pdf.width, pdf.height * (p + 1)))
+    else:
+        image = base64.b64decode(request["data"])
+
+    image_file = BytesIO(image)
+    image_file.seek(0)
+
+    try:
+        im = Image.open(image_file)
+    except IOError:
+        misperrors['error'] = "Corrupt or not an image file."
+        return misperrors
+
+    ocrized = image_to_string(im)
+
+    freetext = {}
+    freetext['values'] = ocrized
+    freetext['types'] = ['freetext']
+    r['results'].append(freetext)
+    return r
+
+
+def introspection():
+    modulesetup = {}
+    try:
+        userConfig
+        modulesetup['userConfig'] = userConfig
+    except NameError:
+        pass
+    try:
+        inputSource
+        modulesetup['inputSource'] = inputSource
+    except NameError:
+        pass
+    return modulesetup
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo
+
+
+if __name__ == '__main__':
+    x = open('test.json', 'r')
+    handler(q=x.read())

misp_modules/modules/import_mod/openiocimport.py

@@ -0,0 +1,99 @@
+import json
+import base64
+
+from pymisp.tools import openioc
+
+misperrors = {'error': 'Error'}
+userConfig = {'not save ioc': {'type': 'Boolean',
+                               'message': 'If you check this box, IOC file will not save as an attachment in MISP'
+                               },
+              'default tag': {
+                  'type': 'String',
+                  'message': 'Add tags spaced by a comma (tlp:white,misp:threat-level="no-risk")',
+                  'validation': '0'}
+              }
+
+inputSource = ['file']
+
+moduleinfo = {
+    'version': '0.1',
+    'author': 'Raphaël Vinot',
+    'description': 'Module to import OpenIOC packages.',
+    'module-type': ['import'],
+    'name': 'OpenIOC Import',
+    'logo': '',
+    'requirements': ['PyMISP'],
+    'features': 'The module imports MISP Attributes from OpenIOC packages, there is then no special feature for users to make it work.',
+    'references': ['https://www.fireeye.com/blog/threat-research/2013/10/openioc-basics.html'],
+    'input': 'OpenIOC packages',
+    'output': 'MISP Event attributes',
+}
+
+moduleconfig = []
+
+
+def handler(q=False):
+    # Just in case we have no data
+    if q is False:
+        return False
+
+    # The return value
+    r = {'results': []}
+
+    # Load up that JSON
+    q = json.loads(q)
+
+    # It's b64 encoded, so decode that stuff
+    package = base64.b64decode(q.get("data")).decode('utf-8')
+
+    # If something really weird happened
+    if not package:
+        return json.dumps({"success": 0})
+
+    pkg = openioc.load_openioc(package)
+
+    if q.get('config'):
+        if q['config'].get('not save ioc') == "0":
+            addFile = {"values": [q.get('filename')],
+                       "types": ['attachment'],
+                       "categories": ['Support Tool'],
+                       "data": q.get('data')}
+            # add tag
+            if q['config'].get('default tag') is not None:
+                addFile["tags"] = q['config']['default tag'].split(",")
+            # add file as attachment
+            r["results"].append(addFile)
+
+    # return all attributes
+    for attrib in pkg.attributes:
+        toAppend = {
+            "values": [attrib.value],
+            "types": [attrib.type],
+            "categories": [attrib.category],
+            "comment": getattr(attrib, 'comment', '')}
+        # add tag
+        if q.get('config') and q['config'].get('default tag') is not None:
+            toAppend["tags"] = q['config']['default tag'].split(",")
+
+        r["results"].append(toAppend)
+    return r
+
+
+def introspection():
+    modulesetup = {}
+    try:
+        userConfig
+        modulesetup['userConfig'] = userConfig
+    except NameError:
+        pass
+    try:
+        inputSource
+        modulesetup['inputSource'] = inputSource
+    except NameError:
+        pass
+    return modulesetup
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo