misp-modules 3.0.6__tar.gz → 3.0.8__tar.gz

{misp_modules-3.0.6 → misp_modules-3.0.8}/PKG-INFO

@@ -1,12 +1,12 @@
 Metadata-Version: 2.4
 Name: misp-modules
-Version: 3.0.6
+Version: 3.0.8
 Summary: MISP modules are autonomous modules that can be used for expansion and other services in MISP
 License-Expression: AGPL-3.0-only
 License-File: LICENSE
 Author: Alexandre Dulaunoy
 Author-email: alexandre.dulaunoy@circl.lu
-Requires-Python: >=3.9,<3.13
+Requires-Python: >=3.10,<4.0
 Classifier: License :: OSI Approved :: GNU Affero General Public License v3
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Environment :: Console
@@ -15,7 +15,7 @@ Classifier: Programming Language :: Python :: 3
 Classifier: Topic :: Security
 Provides-Extra: all
 Provides-Extra: minimal
-Requires-Dist: anyrun-sdk (>=1.10.10,<2.0.0)
+Requires-Dist: anyrun-sdk (>=1.10.10,<2.0.0) ; extra == "all"
 Requires-Dist: apiosintds ; extra == "all"
 Requires-Dist: assemblyline_client ; extra == "all"
 Requires-Dist: backscatter ; extra == "all"
@@ -27,6 +27,7 @@ Requires-Dist: censys (==2.0.9) ; extra == "all"
 Requires-Dist: censys (==2.0.9) ; extra == "minimal"
 Requires-Dist: clamd ; extra == "all"
 Requires-Dist: clamd ; extra == "minimal"
+Requires-Dist: click (==8.1.8)
 Requires-Dist: crowdstrike-falconpy ; extra == "all"
 Requires-Dist: crowdstrike-falconpy ; extra == "minimal"
 Requires-Dist: dnsdb2 ; extra == "all"
@@ -40,6 +41,8 @@ Requires-Dist: greynoise ; extra == "minimal"
 Requires-Dist: jbxapi ; extra == "all"
 Requires-Dist: jbxapi ; extra == "minimal"
 Requires-Dist: jinja2
+Requires-Dist: lief (>=0.17.6) ; extra == "all"
+Requires-Dist: lxml (>=6.1.1) ; extra == "all"
 Requires-Dist: maclookup ; extra == "all"
 Requires-Dist: maclookup ; extra == "minimal"
 Requires-Dist: markdownify
@@ -47,19 +50,17 @@ Requires-Dist: matplotlib ; extra == "all"
 Requires-Dist: matplotlib ; extra == "minimal"
 Requires-Dist: mattermostdriver ; extra == "all"
 Requires-Dist: mattermostdriver ; extra == "minimal"
-Requires-Dist: misp-lib-stix2 (>=3.0.1.2) ; extra == "all"
-Requires-Dist: misp-stix (>=2025.1.10) ; extra == "all"
+Requires-Dist: misp-stix (>=2026.6.1) ; extra == "all"
 Requires-Dist: mwdblib ; extra == "all"
 Requires-Dist: ndjson ; extra == "all"
 Requires-Dist: ndjson ; extra == "minimal"
-Requires-Dist: np ; extra == "all"
-Requires-Dist: numpy (>=1.26.4,<2.0.0) ; extra == "all"
+Requires-Dist: numpy (>=2.0.0) ; extra == "all"
 Requires-Dist: oauth2 ; extra == "all"
 Requires-Dist: oauth2 ; extra == "minimal"
 Requires-Dist: opencv-python ; extra == "all"
 Requires-Dist: openpyxl ; extra == "all"
-Requires-Dist: orjson
-Requires-Dist: pandas (>=2.0.0) ; extra == "all"
+Requires-Dist: orjson (>=3.11.9)
+Requires-Dist: pandas (>=2.0.0,<3.0.0) ; extra == "all"
 Requires-Dist: pandas_ods_reader (>=1.0.0) ; extra == "all"
 Requires-Dist: pandoc ; extra == "all"
 Requires-Dist: passivetotal ; extra == "all"
@@ -79,8 +80,8 @@ Requires-Dist: pyintel471 ; extra == "all"
 Requires-Dist: pyintel471 ; extra == "minimal"
 Requires-Dist: pyipasnhistory ; extra == "all"
 Requires-Dist: pyipasnhistory ; extra == "minimal"
-Requires-Dist: pymisp
-Requires-Dist: pymisp[email,fileobjects,openioc,pdfexport] ; extra == "all"
+Requires-Dist: pymisp (>=2.5.34.1)
+Requires-Dist: pymisp[email,fileobjects,openioc,pdfexport] (>=2.5.34.1) ; extra == "all"
 Requires-Dist: pypdns ; extra == "all"
 Requires-Dist: pypdns ; extra == "minimal"
 Requires-Dist: pypssl ; extra == "all"
@@ -135,18 +136,19 @@ Description-Content-Type: text/markdown
 
 MISP modules are autonomous modules that can be used to extend [MISP](https://github.com/MISP/MISP) for new services such as expansion, import, export and workflow action.
 
-MISP modules can be also installed and used without MISP as a [standalone tool accessible via a convenient web interface](./website).
+MISP modules can be also installed and used without [MISP](https://misp-project.org/) as a [standalone tool accessible via a convenient web interface](./website) or using a [cli tool](https://github.com/MISP/misp-modules-cli).
 
-The modules are written in Python 3 following a simple API interface. The objective is to ease the extensions of MISP functionalities
-without modifying core components. The API is available via a simple REST API which is independent from MISP installation or configuration and can be used with other tools.
+The modules are written in Python 3 following a simple API interface. The objective is to ease the extensions of MISP functionalities without modifying core components. The API is available via a simple REST API which is independent from MISP installation or configuration and can be used with other tools. The API is also documented automatically via an OpenAPI end-point or a swagger file.
 
 For more information: [Extending MISP with Python modules](https://www.misp-project.org/misp-training/3.1-misp-modules.pdf) slides from [MISP training](https://github.com/MISP/misp-training).
 
 # Installation
+
 Installation instructions can be found in the [installation documentation](https://misp.github.io/misp-modules/install/).
 
 # How to add your own MISP modules?
-Developing a MISP module yourself is fairly easy. Start with a template or existing module and continue from there. \
+
+Developing a MISP module yourself is fairly easy. Start with a template or existing module and continue from there.
 More information can be found in the [contribute](https://misp.github.io/misp-modules/contribute/) section of the documentation.
 
 # Documentation
@@ -169,9 +171,9 @@ The specification is generated during service startup, so restart `misp-modules`
 ## Licenses
 For further Information see the [license file](https://misp.github.io/misp-modules/license/).
 
-# List of MISP modules
+## Existing MISP modules
 
-## Expansion Modules
+### Expansion Modules
 * [Abuse IPDB](https://misp.github.io/misp-modules/expansion/#abuse-ipdb) - AbuseIPDB MISP expansion module
 * [ANYRUN Sandbox Submit](https://misp.github.io/misp-modules/expansion/#anyrun-sandbox-submit) - A module designed to submit URLs or files to the ANY.RUN Sandbox for analysis and return the unique analysis link and ID.
 * [OSINT DigitalSide](https://misp.github.io/misp-modules/expansion/#osint-digitalside) - On demand query API for OSINT.digitalside.it project.
@@ -218,7 +220,7 @@ For further Information see the [license file](https://misp.github.io/misp-modul
 * [IP2Location.io Lookup](https://misp.github.io/misp-modules/expansion/#ip2location.io-lookup) - An expansion module to query IP2Location.io to gather more information on a given IP address.
 * [IPASN-History Lookup](https://misp.github.io/misp-modules/expansion/#ipasn-history-lookup) - Module to query an IP ASN history service (https://github.com/D4-project/IPASN-History).
 * [IPInfo.io Lookup](https://misp.github.io/misp-modules/expansion/#ipinfo.io-lookup) - An expansion module to query ipinfo.io to gather more information on a given IP address.
-* [IPQualityScore Lookup](https://misp.github.io/misp-modules/expansion/#ipqualityscore-lookup) - IPQualityScore MISP Expansion Module for IP reputation, Email Validation, Phone Number Validation, Malicious Domain and Malicious URL Scanner.
+* [IPQualityScore Lookup](https://misp.github.io/misp-modules/expansion/#ipqualityscore-lookup) - IPQualityScore MISP Expansion Module for IP reputation,        Email Validation, Phone Number Validation, Malicious Domain,Malicious URL Scanner,Malicious File Scanner & Compromised username, Password, Email  
 * [IPRep Lookup](https://misp.github.io/misp-modules/expansion/#iprep-lookup) - Module to query IPRep data for IP addresses.
 * [Ninja Template Rendering](https://misp.github.io/misp-modules/expansion/#ninja-template-rendering) - Render the template with the data passed
 * [Joe Sandbox Import](https://misp.github.io/misp-modules/expansion/#joe-sandbox-import) - Query Joe Sandbox API with a submission url to get the json report and extract its data that is parsed and converted into MISP attributes and objects.
@@ -244,12 +246,13 @@ For further Information see the [license file](https://misp.github.io/misp-modul
 * [PDF Enrich](https://misp.github.io/misp-modules/expansion/#pdf-enrich) - Module to extract freetext from a PDF document.
 * [PPTX Enrich](https://misp.github.io/misp-modules/expansion/#pptx-enrich) - Module to extract freetext from a .pptx document.
 * [Qintel QSentry Lookup](https://misp.github.io/misp-modules/expansion/#qintel-qsentry-lookup) - A hover and expansion module which queries Qintel QSentry for ip reputation data
-* [QR Code Decode](https://misp.github.io/misp-modules/expansion/#qr-code-decode) - Module to decode QR codes.
+* [QR Code Decode](https://misp.github.io/misp-modules/expansion/#qr-code-decode) - Decode QR codes from attachments OR remote URLs (Anti-Quishing).
 * [RandomcoinDB Lookup](https://misp.github.io/misp-modules/expansion/#randomcoindb-lookup) - Module to access the ransomcoinDB (see https://ransomcoindb.concinnity-risks.com)
-* [r7_akb](https://misp.github.io/misp-modules/expansion/#r7_akb) - Enrich CVEs via AttackerKB and return structured MISP events. Handles rate limits, regex CVE detection, and markdown cleanup.
+* [Rapid7 AttackerKB lookup](https://misp.github.io/misp-modules/expansion/#rapid7-attackerkb-lookup) - Module to lookup CVE attributes in Rapid7 AttackerKB.
 * [Real-time Blackhost Lists Lookup](https://misp.github.io/misp-modules/expansion/#real-time-blackhost-lists-lookup) - Module to check an IPv4 address against known RBLs.
 * [Recorded Future Enrich](https://misp.github.io/misp-modules/expansion/#recorded-future-enrich) - Module to enrich attributes with threat intelligence from Recorded Future.
 * [Reverse DNS](https://misp.github.io/misp-modules/expansion/#reverse-dns) - Simple Reverse DNS expansion service to resolve reverse DNS from MISP attributes.
+* [ReversingLabs Spectra Analyze](https://misp.github.io/misp-modules/expansion/#reversinglabs-spectra-analyze) - Threat intelligence enrichment module
 * [SecurityTrails Lookup](https://misp.github.io/misp-modules/expansion/#securitytrails-lookup) - An expansion modules for SecurityTrails.
 * [Shodan Lookup](https://misp.github.io/misp-modules/expansion/#shodan-lookup) - Module to query on Shodan.
 * [Sigma Rule Converter](https://misp.github.io/misp-modules/expansion/#sigma-rule-converter) - An expansion hover module to display the result of sigma queries.
@@ -267,6 +270,7 @@ For further Information see the [license file](https://misp.github.io/misp-modul
 * [TruSTAR Enrich](https://misp.github.io/misp-modules/expansion/#trustar-enrich) - Module to get enrich indicators with TruSTAR.
 * [URLhaus Lookup](https://misp.github.io/misp-modules/expansion/#urlhaus-lookup) - Query of the URLhaus API to get additional information about the input attribute.
 * [URLScan Lookup](https://misp.github.io/misp-modules/expansion/#urlscan-lookup) - An expansion module to query urlscan.io.
+* [Validin DNS History](https://misp.github.io/misp-modules/expansion/#validin-dns-history) - Validin internet dataset expansion. Returns dns-records, web crawls, registration (WHOIS) records, and certificates from Validin's historic internet intelligence dataset.
 * [VARIoT db Lookup](https://misp.github.io/misp-modules/expansion/#variot-db-lookup) - An expansion module to query the VARIoT db API for more information about a vulnerability.
 * [VirusTotal v3 Lookup](https://misp.github.io/misp-modules/expansion/#virustotal-v3-lookup) - Enrich observables with the VirusTotal v3 API
 * [VirusTotal Public API Lookup](https://misp.github.io/misp-modules/expansion/#virustotal-public-api-lookup) - Enrich observables with the VirusTotal v3 public API
@@ -286,7 +290,7 @@ For further Information see the [license file](https://misp.github.io/misp-modul
 * [YARA Syntax Validator](https://misp.github.io/misp-modules/expansion/#yara-syntax-validator) - An expansion hover module to perform a syntax check on if yara rules are valid or not.
 * [Yeti Lookup](https://misp.github.io/misp-modules/expansion/#yeti-lookup) - Module to process a query on Yeti.
 
-## Export Modules
+### Export Modules
 * [CEF Export](https://misp.github.io/misp-modules/export_mod/#cef-export) - Module to export a MISP event in CEF format.
 * [Cisco fireSIGHT blockrule Export](https://misp.github.io/misp-modules/export_mod/#cisco-firesight-blockrule-export) - Module to export malicious network activity attributes to Cisco fireSIGHT manager block rules.
 * [Microsoft Defender for Endpoint KQL Export](https://misp.github.io/misp-modules/export_mod/#microsoft-defender-for-endpoint-kql-export) - Defender for Endpoint KQL hunting query export module
@@ -303,7 +307,7 @@ For further Information see the [license file](https://misp.github.io/misp-modul
 * [VirusTotal Graph Export](https://misp.github.io/misp-modules/export_mod/#virustotal-graph-export) - This module is used to create a VirusTotal Graph from a MISP event.
 * [YARA Rule Export](https://misp.github.io/misp-modules/export_mod/#yara-rule-export) - This module is used to export MISP events to YARA.
 
-## Import Modules
+### Import Modules
 * [ANYRUN Sandbox Import](https://misp.github.io/misp-modules/import_mod/#anyrun-sandbox-import) - A module designed to retrieve an analysis report from the ANY.RUN Sandbox by its unique ID and extract results (such as verdict, malware tags, and IOCs), converting them into MISP attributes within your event.
 * [PDNS COF Importer](https://misp.github.io/misp-modules/import_mod/#pdns-cof-importer) - Passive DNS Common Output Format (COF) MISP importer
 * [CSV Import](https://misp.github.io/misp-modules/import_mod/#csv-import) - Module to import MISP attributes from a csv file.
@@ -323,7 +327,8 @@ For further Information see the [license file](https://misp.github.io/misp-modul
 * [VMRay API Import](https://misp.github.io/misp-modules/import_mod/#vmray-api-import) - Module to import VMRay (VTI) results.
 * [VMRay Summary JSON Import](https://misp.github.io/misp-modules/import_mod/#vmray-summary-json-import) - Import a VMRay Summary JSON report.
 
-## Action Modules
+### Action Modules
+* [Export to Sentinel or Defender](https://misp.github.io/misp-modules/action_mod/#export-to-sentinel-or-defender) - Export indicators to Microsoft Sentinel or Microsoft Defender. Requires an existing installation of MISP2Sentinel or MISP2Defender.
 * [Mattermost](https://misp.github.io/misp-modules/action_mod/#mattermost) - Simplistic module to send message to a Mattermost channel.
 * [Nextcloud talk](https://misp.github.io/misp-modules/action_mod/#nextcloud-talk) - Simplistic module to send a message to a Nextcloud talk conversation.
 * [Slack](https://misp.github.io/misp-modules/action_mod/#slack) - Simplistic module to send messages to a Slack channel.
@@ -331,3 +336,4 @@ For further Information see the [license file](https://misp.github.io/misp-modul
 
 
 
+

{misp_modules-3.0.6 → misp_modules-3.0.8}/README.md

@@ -7,18 +7,19 @@
 
 MISP modules are autonomous modules that can be used to extend [MISP](https://github.com/MISP/MISP) for new services such as expansion, import, export and workflow action.
 
-MISP modules can be also installed and used without MISP as a [standalone tool accessible via a convenient web interface](./website).
+MISP modules can be also installed and used without [MISP](https://misp-project.org/) as a [standalone tool accessible via a convenient web interface](./website) or using a [cli tool](https://github.com/MISP/misp-modules-cli).
 
-The modules are written in Python 3 following a simple API interface. The objective is to ease the extensions of MISP functionalities
-without modifying core components. The API is available via a simple REST API which is independent from MISP installation or configuration and can be used with other tools.
+The modules are written in Python 3 following a simple API interface. The objective is to ease the extensions of MISP functionalities without modifying core components. The API is available via a simple REST API which is independent from MISP installation or configuration and can be used with other tools. The API is also documented automatically via an OpenAPI end-point or a swagger file.
 
 For more information: [Extending MISP with Python modules](https://www.misp-project.org/misp-training/3.1-misp-modules.pdf) slides from [MISP training](https://github.com/MISP/misp-training).
 
 # Installation
+
 Installation instructions can be found in the [installation documentation](https://misp.github.io/misp-modules/install/).
 
 # How to add your own MISP modules?
-Developing a MISP module yourself is fairly easy. Start with a template or existing module and continue from there. \
+
+Developing a MISP module yourself is fairly easy. Start with a template or existing module and continue from there.
 More information can be found in the [contribute](https://misp.github.io/misp-modules/contribute/) section of the documentation.
 
 # Documentation
@@ -41,9 +42,9 @@ The specification is generated during service startup, so restart `misp-modules`
 ## Licenses
 For further Information see the [license file](https://misp.github.io/misp-modules/license/).
 
-# List of MISP modules
+## Existing MISP modules
 
-## Expansion Modules
+### Expansion Modules
 * [Abuse IPDB](https://misp.github.io/misp-modules/expansion/#abuse-ipdb) - AbuseIPDB MISP expansion module
 * [ANYRUN Sandbox Submit](https://misp.github.io/misp-modules/expansion/#anyrun-sandbox-submit) - A module designed to submit URLs or files to the ANY.RUN Sandbox for analysis and return the unique analysis link and ID.
 * [OSINT DigitalSide](https://misp.github.io/misp-modules/expansion/#osint-digitalside) - On demand query API for OSINT.digitalside.it project.
@@ -90,7 +91,7 @@ For further Information see the [license file](https://misp.github.io/misp-modul
 * [IP2Location.io Lookup](https://misp.github.io/misp-modules/expansion/#ip2location.io-lookup) - An expansion module to query IP2Location.io to gather more information on a given IP address.
 * [IPASN-History Lookup](https://misp.github.io/misp-modules/expansion/#ipasn-history-lookup) - Module to query an IP ASN history service (https://github.com/D4-project/IPASN-History).
 * [IPInfo.io Lookup](https://misp.github.io/misp-modules/expansion/#ipinfo.io-lookup) - An expansion module to query ipinfo.io to gather more information on a given IP address.
-* [IPQualityScore Lookup](https://misp.github.io/misp-modules/expansion/#ipqualityscore-lookup) - IPQualityScore MISP Expansion Module for IP reputation, Email Validation, Phone Number Validation, Malicious Domain and Malicious URL Scanner.
+* [IPQualityScore Lookup](https://misp.github.io/misp-modules/expansion/#ipqualityscore-lookup) - IPQualityScore MISP Expansion Module for IP reputation,        Email Validation, Phone Number Validation, Malicious Domain,Malicious URL Scanner,Malicious File Scanner & Compromised username, Password, Email  
 * [IPRep Lookup](https://misp.github.io/misp-modules/expansion/#iprep-lookup) - Module to query IPRep data for IP addresses.
 * [Ninja Template Rendering](https://misp.github.io/misp-modules/expansion/#ninja-template-rendering) - Render the template with the data passed
 * [Joe Sandbox Import](https://misp.github.io/misp-modules/expansion/#joe-sandbox-import) - Query Joe Sandbox API with a submission url to get the json report and extract its data that is parsed and converted into MISP attributes and objects.
@@ -116,12 +117,13 @@ For further Information see the [license file](https://misp.github.io/misp-modul
 * [PDF Enrich](https://misp.github.io/misp-modules/expansion/#pdf-enrich) - Module to extract freetext from a PDF document.
 * [PPTX Enrich](https://misp.github.io/misp-modules/expansion/#pptx-enrich) - Module to extract freetext from a .pptx document.
 * [Qintel QSentry Lookup](https://misp.github.io/misp-modules/expansion/#qintel-qsentry-lookup) - A hover and expansion module which queries Qintel QSentry for ip reputation data
-* [QR Code Decode](https://misp.github.io/misp-modules/expansion/#qr-code-decode) - Module to decode QR codes.
+* [QR Code Decode](https://misp.github.io/misp-modules/expansion/#qr-code-decode) - Decode QR codes from attachments OR remote URLs (Anti-Quishing).
 * [RandomcoinDB Lookup](https://misp.github.io/misp-modules/expansion/#randomcoindb-lookup) - Module to access the ransomcoinDB (see https://ransomcoindb.concinnity-risks.com)
-* [r7_akb](https://misp.github.io/misp-modules/expansion/#r7_akb) - Enrich CVEs via AttackerKB and return structured MISP events. Handles rate limits, regex CVE detection, and markdown cleanup.
+* [Rapid7 AttackerKB lookup](https://misp.github.io/misp-modules/expansion/#rapid7-attackerkb-lookup) - Module to lookup CVE attributes in Rapid7 AttackerKB.
 * [Real-time Blackhost Lists Lookup](https://misp.github.io/misp-modules/expansion/#real-time-blackhost-lists-lookup) - Module to check an IPv4 address against known RBLs.
 * [Recorded Future Enrich](https://misp.github.io/misp-modules/expansion/#recorded-future-enrich) - Module to enrich attributes with threat intelligence from Recorded Future.
 * [Reverse DNS](https://misp.github.io/misp-modules/expansion/#reverse-dns) - Simple Reverse DNS expansion service to resolve reverse DNS from MISP attributes.
+* [ReversingLabs Spectra Analyze](https://misp.github.io/misp-modules/expansion/#reversinglabs-spectra-analyze) - Threat intelligence enrichment module
 * [SecurityTrails Lookup](https://misp.github.io/misp-modules/expansion/#securitytrails-lookup) - An expansion modules for SecurityTrails.
 * [Shodan Lookup](https://misp.github.io/misp-modules/expansion/#shodan-lookup) - Module to query on Shodan.
 * [Sigma Rule Converter](https://misp.github.io/misp-modules/expansion/#sigma-rule-converter) - An expansion hover module to display the result of sigma queries.
@@ -139,6 +141,7 @@ For further Information see the [license file](https://misp.github.io/misp-modul
 * [TruSTAR Enrich](https://misp.github.io/misp-modules/expansion/#trustar-enrich) - Module to get enrich indicators with TruSTAR.
 * [URLhaus Lookup](https://misp.github.io/misp-modules/expansion/#urlhaus-lookup) - Query of the URLhaus API to get additional information about the input attribute.
 * [URLScan Lookup](https://misp.github.io/misp-modules/expansion/#urlscan-lookup) - An expansion module to query urlscan.io.
+* [Validin DNS History](https://misp.github.io/misp-modules/expansion/#validin-dns-history) - Validin internet dataset expansion. Returns dns-records, web crawls, registration (WHOIS) records, and certificates from Validin's historic internet intelligence dataset.
 * [VARIoT db Lookup](https://misp.github.io/misp-modules/expansion/#variot-db-lookup) - An expansion module to query the VARIoT db API for more information about a vulnerability.
 * [VirusTotal v3 Lookup](https://misp.github.io/misp-modules/expansion/#virustotal-v3-lookup) - Enrich observables with the VirusTotal v3 API
 * [VirusTotal Public API Lookup](https://misp.github.io/misp-modules/expansion/#virustotal-public-api-lookup) - Enrich observables with the VirusTotal v3 public API
@@ -158,7 +161,7 @@ For further Information see the [license file](https://misp.github.io/misp-modul
 * [YARA Syntax Validator](https://misp.github.io/misp-modules/expansion/#yara-syntax-validator) - An expansion hover module to perform a syntax check on if yara rules are valid or not.
 * [Yeti Lookup](https://misp.github.io/misp-modules/expansion/#yeti-lookup) - Module to process a query on Yeti.
 
-## Export Modules
+### Export Modules
 * [CEF Export](https://misp.github.io/misp-modules/export_mod/#cef-export) - Module to export a MISP event in CEF format.
 * [Cisco fireSIGHT blockrule Export](https://misp.github.io/misp-modules/export_mod/#cisco-firesight-blockrule-export) - Module to export malicious network activity attributes to Cisco fireSIGHT manager block rules.
 * [Microsoft Defender for Endpoint KQL Export](https://misp.github.io/misp-modules/export_mod/#microsoft-defender-for-endpoint-kql-export) - Defender for Endpoint KQL hunting query export module
@@ -175,7 +178,7 @@ For further Information see the [license file](https://misp.github.io/misp-modul
 * [VirusTotal Graph Export](https://misp.github.io/misp-modules/export_mod/#virustotal-graph-export) - This module is used to create a VirusTotal Graph from a MISP event.
 * [YARA Rule Export](https://misp.github.io/misp-modules/export_mod/#yara-rule-export) - This module is used to export MISP events to YARA.
 
-## Import Modules
+### Import Modules
 * [ANYRUN Sandbox Import](https://misp.github.io/misp-modules/import_mod/#anyrun-sandbox-import) - A module designed to retrieve an analysis report from the ANY.RUN Sandbox by its unique ID and extract results (such as verdict, malware tags, and IOCs), converting them into MISP attributes within your event.
 * [PDNS COF Importer](https://misp.github.io/misp-modules/import_mod/#pdns-cof-importer) - Passive DNS Common Output Format (COF) MISP importer
 * [CSV Import](https://misp.github.io/misp-modules/import_mod/#csv-import) - Module to import MISP attributes from a csv file.
@@ -195,10 +198,12 @@ For further Information see the [license file](https://misp.github.io/misp-modul
 * [VMRay API Import](https://misp.github.io/misp-modules/import_mod/#vmray-api-import) - Module to import VMRay (VTI) results.
 * [VMRay Summary JSON Import](https://misp.github.io/misp-modules/import_mod/#vmray-summary-json-import) - Import a VMRay Summary JSON report.
 
-## Action Modules
+### Action Modules
+* [Export to Sentinel or Defender](https://misp.github.io/misp-modules/action_mod/#export-to-sentinel-or-defender) - Export indicators to Microsoft Sentinel or Microsoft Defender. Requires an existing installation of MISP2Sentinel or MISP2Defender.
 * [Mattermost](https://misp.github.io/misp-modules/action_mod/#mattermost) - Simplistic module to send message to a Mattermost channel.
 * [Nextcloud talk](https://misp.github.io/misp-modules/action_mod/#nextcloud-talk) - Simplistic module to send a message to a Nextcloud talk conversation.
 * [Slack](https://misp.github.io/misp-modules/action_mod/#slack) - Simplistic module to send messages to a Slack channel.
 * [Test action](https://misp.github.io/misp-modules/action_mod/#test-action) - This module is merely a test, always returning true. Triggers on event publishing.
 
 
+

{misp_modules-3.0.6 → misp_modules-3.0.8}/misp_modules/__main__.py

@@ -355,7 +355,7 @@ def main():
         ioloop.IOLoop.instance().start()
     finally:
         ioloop.IOLoop.instance().stop()
-        return 0
+    return 0
 
 
 if __name__ == "__main__":

misp_modules-3.0.8/misp_modules/modules/expansion/alphaMountain.py

@@ -0,0 +1,232 @@
+import json
+import requests
+
+misperrors = {'error': 'Error'}
+mispattributes = {
+    'input': ['ip', 'ip-src', 'ip-dst', 'ip-src|port', 'ip-dst|port', 'domain', 'hostname', 'url', 'uri', 'link'],
+    'output': ['text', 'comment'],
+    'format': 'misp_standard',
+}
+
+userConfig = {
+    "license": {
+        "type": "String",
+        "errorMessage": "alphaMountain license key is required",
+        "message": "Your alphaMountain API license key",
+        "required": True,
+    },
+    "scan_depth": {
+        "type": "String",
+        "message": "Scan depth: low, medium, or high (default: medium)",
+        "default": "medium",
+        "required": False,
+    },
+    "partner_type": {
+        "type": "String",
+        "message": "Partner type (default: partner.info)",
+        "default": "partner.info",
+        "required": False,
+    },
+}
+
+moduleconfig = list(userConfig.keys())
+
+moduleinfo = {
+    'version': '1.0',
+    'author': 'alphaMountain',
+    'description': (
+        'alphaMountain threat intelligence lookup for IPs, domains, hostnames, and URLs - adds risk score tags'
+    ),
+    'module-type': ['expansion', 'hover'],
+    'name': 'alphaMountain_risk',
+    'logo': '',
+    'requirements': [],
+    'features': '',
+    'references': [],
+}
+
+
+def handler(q=False):
+    """Main handler function called by MISP"""
+
+    if q is False:
+        return False
+
+    try:
+        request = json.loads(q)
+    except Exception as e:
+        return {'error': f'Invalid JSON input: {str(e)}'}
+
+    if not request.get('config'):
+        return {'error': 'Configuration required'}
+
+    config = request['config']
+    if 'license' not in config:
+        return {'error': 'License key required in module configuration'}
+
+    attribute = request.get('attribute')
+    if not attribute:
+        return {'error': 'No attribute provided'}
+
+    # Check for required fields for MISP modules
+    required_fields = ['type', 'value', 'uuid']
+    if not all(field in attribute for field in required_fields):
+        return {'error': f'Invalid attribute format, missing fields: {required_fields}'}
+
+    # Validate attribute type is supported
+    if attribute['type'] not in mispattributes['input']:
+        return {'error': f'Unsupported attribute type: {attribute["type"]}'}
+
+    license_key = config['license']
+    api_url = 'https://api.alphamountain.ai/threat/uri'
+    scan_depth = config.get('scan_depth', 'medium')
+    partner_type = config.get('partner_type', 'partner.info')
+
+    # Map MISP attribute type to alphaMountain API category and extract value
+    ioc_value = get_ioc_value(attribute)
+
+    try:
+        threat_data = query_alphamountain_api(api_url, license_key, ioc_value, scan_depth, partner_type)
+
+        if not threat_data:
+            return {'error': 'No data returned from alphaMountain API'}
+
+        # Create results dictionary - DO NOT include the original attribute
+        results = {'Attribute': []}
+
+        # Process the response and create attributes with tags
+        process_threat_response(threat_data, results, attribute)
+
+        return {'results': results}
+
+    except requests.RequestException as e:
+        return {'error': f'API request failed: {str(e)}'}
+    except Exception as e:
+        return {'error': f'Processing error: {str(e)}'}
+
+
+def get_ioc_value(attribute):
+    """Extract IOC value from attribute, handling IPs with ports"""
+    attr_type = attribute['type']
+    attr_value = attribute['value']
+
+    # For IP addresses with ports, strip the port (alphaMountain API doesn't support ports)
+    if attr_type in ['ip-src|port', 'ip-dst|port']:
+        return attr_value.split('|')[0]
+
+    return attr_value
+
+
+def query_alphamountain_api(api_url, license_key, ioc_value, scan_depth, partner_type):
+    """Query the alphaMountain API for threat intelligence"""
+
+    headers = {'Content-Type': 'application/json'}
+    payload = {'uri': ioc_value, 'license': license_key, 'version': 1, 'type': partner_type, 'scan_depth': scan_depth}
+
+    try:
+        response = requests.post(api_url, json=payload, headers=headers, timeout=30)
+        response.raise_for_status()
+
+        return response.json()
+
+    except requests.exceptions.HTTPError as e:
+        status = response.status_code if response else "No status"
+        body = response.text[:500] if response else "No response body"
+        raise ValueError(f"HTTP {status}: {body} - {str(e)}")
+
+    except requests.exceptions.RequestException as e:
+        raise ValueError(f"Request failed: {str(e)}")
+
+    except Exception as e:
+        raise ValueError(f"Unexpected error: {str(e)}")
+
+
+def process_threat_response(threat_data, results, original_attribute):
+    """Process the API response and apply risk score tag to the original attribute"""
+
+    # Create tags list - only risk score
+    tags = []
+
+    if not isinstance(threat_data, dict):
+        # Add error tag
+        tags.append({'name': 'alphaMountain:error', 'colour': '#ff0000'})
+    else:
+        status = threat_data.get('status', {})
+        if status.get('threat') != 'Success':
+            tags.append({'name': 'alphaMountain:api-error', 'colour': '#ff0000'})
+        else:
+            threat_info = threat_data.get('threat', {})
+
+            if isinstance(threat_info, dict) and threat_info:
+                score = threat_info.get('score', 'N/A')
+
+                # Add risk score tag
+                if score != 'N/A':
+                    try:
+                        score_float = round(float(score), 2)
+                        risk_level = get_risk_level(score_float)
+                        risk_color = get_risk_color(risk_level)
+
+                        # Add specific score tag with full precision
+                        tags.append({'name': f'alphaMountain:risk-score="{score_float}"', 'colour': risk_color})
+
+                    except (ValueError, TypeError):
+                        # If score is not a valid number, add a generic tag
+                        tags.append({'name': 'alphaMountain:risk-score="unknown"', 'colour': '#ffa500'})
+
+    # If no tags were added, add a no-data tag
+    if not tags:
+        tags.append({'name': 'alphaMountain:no-data', 'colour': '#ffa500'})
+
+    # Create enriched attribute with only risk score tag
+    enriched_attribute = {
+        'type': original_attribute['type'],
+        'value': original_attribute['value'],
+        'category': original_attribute.get('category', 'Network activity'),
+        'to_ids': original_attribute.get('to_ids', False),
+        'disable_correlation': original_attribute.get('disable_correlation', False),
+        'comment': 'alphaMountain threat intelligence analysis',
+        'Tag': tags,
+    }
+
+    results['Attribute'].append(enriched_attribute)
+
+
+def get_risk_level(score):
+    """Determine risk level based on score"""
+    int_score = int(score)
+    if int_score >= 8:
+        return 'high'
+    elif int_score >= 7:
+        return 'medium'
+    elif int_score >= 6:
+        return 'low'
+    else:
+        return 'minimal'
+
+
+def get_risk_color(risk_level):
+    """Get color code for risk level"""
+    color_map = {
+        'high': '#ff0000',  # Red
+        'medium': '#ffa500',  # Orange
+        'low': '#ffff00',  # Yellow
+        'minimal': '#00cc00',  # Green
+    }
+    return color_map.get(risk_level, '#cccccc')
+
+
+def introspection():
+    """Return module metadata for MISP"""
+    modulesetup = {}
+    modulesetup['userConfig'] = userConfig
+    modulesetup['input'] = mispattributes['input']
+    modulesetup['output'] = mispattributes['output']
+    modulesetup['format'] = 'misp_standard'
+    return modulesetup
+
+
+def version():
+    """Return module version"""
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo

{misp_modules-3.0.6 → misp_modules-3.0.8}/misp_modules/modules/expansion/docx_enrich.py

@@ -3,7 +3,7 @@ import io
 import json
 
 import docx
-import np
+import numpy as np
 
 misperrors = {"error": "Error"}
 mispattributes = {"input": ["attachment"], "output": ["freetext", "text"]}