misp-modules 3.0.7__tar.gz → 3.0.8__tar.gz

{misp_modules-3.0.7 → misp_modules-3.0.8}/PKG-INFO

@@ -1,12 +1,12 @@
 Metadata-Version: 2.4
 Name: misp-modules
-Version: 3.0.7
+Version: 3.0.8
 Summary: MISP modules are autonomous modules that can be used for expansion and other services in MISP
 License-Expression: AGPL-3.0-only
 License-File: LICENSE
 Author: Alexandre Dulaunoy
 Author-email: alexandre.dulaunoy@circl.lu
-Requires-Python: >=3.9,<3.13
+Requires-Python: >=3.10,<4.0
 Classifier: License :: OSI Approved :: GNU Affero General Public License v3
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Environment :: Console
@@ -15,7 +15,7 @@ Classifier: Programming Language :: Python :: 3
 Classifier: Topic :: Security
 Provides-Extra: all
 Provides-Extra: minimal
-Requires-Dist: anyrun-sdk (>=1.10.10,<2.0.0)
+Requires-Dist: anyrun-sdk (>=1.10.10,<2.0.0) ; extra == "all"
 Requires-Dist: apiosintds ; extra == "all"
 Requires-Dist: assemblyline_client ; extra == "all"
 Requires-Dist: backscatter ; extra == "all"
@@ -27,6 +27,7 @@ Requires-Dist: censys (==2.0.9) ; extra == "all"
 Requires-Dist: censys (==2.0.9) ; extra == "minimal"
 Requires-Dist: clamd ; extra == "all"
 Requires-Dist: clamd ; extra == "minimal"
+Requires-Dist: click (==8.1.8)
 Requires-Dist: crowdstrike-falconpy ; extra == "all"
 Requires-Dist: crowdstrike-falconpy ; extra == "minimal"
 Requires-Dist: dnsdb2 ; extra == "all"
@@ -40,6 +41,8 @@ Requires-Dist: greynoise ; extra == "minimal"
 Requires-Dist: jbxapi ; extra == "all"
 Requires-Dist: jbxapi ; extra == "minimal"
 Requires-Dist: jinja2
+Requires-Dist: lief (>=0.17.6) ; extra == "all"
+Requires-Dist: lxml (>=6.1.1) ; extra == "all"
 Requires-Dist: maclookup ; extra == "all"
 Requires-Dist: maclookup ; extra == "minimal"
 Requires-Dist: markdownify
@@ -47,19 +50,17 @@ Requires-Dist: matplotlib ; extra == "all"
 Requires-Dist: matplotlib ; extra == "minimal"
 Requires-Dist: mattermostdriver ; extra == "all"
 Requires-Dist: mattermostdriver ; extra == "minimal"
-Requires-Dist: misp-lib-stix2 (>=3.0.1.2) ; extra == "all"
-Requires-Dist: misp-stix (>=2025.1.10) ; extra == "all"
+Requires-Dist: misp-stix (>=2026.6.1) ; extra == "all"
 Requires-Dist: mwdblib ; extra == "all"
 Requires-Dist: ndjson ; extra == "all"
 Requires-Dist: ndjson ; extra == "minimal"
-Requires-Dist: np ; extra == "all"
-Requires-Dist: numpy (>=1.26.4,<2.0.0) ; extra == "all"
+Requires-Dist: numpy (>=2.0.0) ; extra == "all"
 Requires-Dist: oauth2 ; extra == "all"
 Requires-Dist: oauth2 ; extra == "minimal"
 Requires-Dist: opencv-python ; extra == "all"
 Requires-Dist: openpyxl ; extra == "all"
-Requires-Dist: orjson
-Requires-Dist: pandas (>=2.0.0) ; extra == "all"
+Requires-Dist: orjson (>=3.11.9)
+Requires-Dist: pandas (>=2.0.0,<3.0.0) ; extra == "all"
 Requires-Dist: pandas_ods_reader (>=1.0.0) ; extra == "all"
 Requires-Dist: pandoc ; extra == "all"
 Requires-Dist: passivetotal ; extra == "all"
@@ -79,8 +80,8 @@ Requires-Dist: pyintel471 ; extra == "all"
 Requires-Dist: pyintel471 ; extra == "minimal"
 Requires-Dist: pyipasnhistory ; extra == "all"
 Requires-Dist: pyipasnhistory ; extra == "minimal"
-Requires-Dist: pymisp
-Requires-Dist: pymisp[email,fileobjects,openioc,pdfexport] ; extra == "all"
+Requires-Dist: pymisp (>=2.5.34.1)
+Requires-Dist: pymisp[email,fileobjects,openioc,pdfexport] (>=2.5.34.1) ; extra == "all"
 Requires-Dist: pypdns ; extra == "all"
 Requires-Dist: pypdns ; extra == "minimal"
 Requires-Dist: pypssl ; extra == "all"
@@ -135,7 +136,7 @@ Description-Content-Type: text/markdown
 
 MISP modules are autonomous modules that can be used to extend [MISP](https://github.com/MISP/MISP) for new services such as expansion, import, export and workflow action.
 
-MISP modules can be also installed and used without [MISP](https://misp-project.org/) as a [standalone tool accessible via a convenient web interface](./website).
+MISP modules can be also installed and used without [MISP](https://misp-project.org/) as a [standalone tool accessible via a convenient web interface](./website) or using a [cli tool](https://github.com/MISP/misp-modules-cli).
 
 The modules are written in Python 3 following a simple API interface. The objective is to ease the extensions of MISP functionalities without modifying core components. The API is available via a simple REST API which is independent from MISP installation or configuration and can be used with other tools. The API is also documented automatically via an OpenAPI end-point or a swagger file.
 

{misp_modules-3.0.7 → misp_modules-3.0.8}/README.md

@@ -7,7 +7,7 @@
 
 MISP modules are autonomous modules that can be used to extend [MISP](https://github.com/MISP/MISP) for new services such as expansion, import, export and workflow action.
 
-MISP modules can be also installed and used without [MISP](https://misp-project.org/) as a [standalone tool accessible via a convenient web interface](./website).
+MISP modules can be also installed and used without [MISP](https://misp-project.org/) as a [standalone tool accessible via a convenient web interface](./website) or using a [cli tool](https://github.com/MISP/misp-modules-cli).
 
 The modules are written in Python 3 following a simple API interface. The objective is to ease the extensions of MISP functionalities without modifying core components. The API is available via a simple REST API which is independent from MISP installation or configuration and can be used with other tools. The API is also documented automatically via an OpenAPI end-point or a swagger file.
 

{misp_modules-3.0.7 → misp_modules-3.0.8}/misp_modules/__main__.py

@@ -355,7 +355,7 @@ def main():
         ioloop.IOLoop.instance().start()
     finally:
         ioloop.IOLoop.instance().stop()
-        return 0
+    return 0
 
 
 if __name__ == "__main__":

{misp_modules-3.0.7 → misp_modules-3.0.8}/misp_modules/modules/expansion/docx_enrich.py

@@ -3,7 +3,7 @@ import io
 import json
 
 import docx
-import np
+import numpy as np
 
 misperrors = {"error": "Error"}
 mispattributes = {"input": ["attachment"], "output": ["freetext", "text"]}

misp_modules-3.0.8/misp_modules/modules/expansion/email_security_check.py

@@ -0,0 +1,224 @@
+import json
+
+try:
+    import dns.resolver
+
+    resolver = dns.resolver.Resolver()
+    resolver.timeout = 2
+    resolver.lifetime = 2
+except ImportError:
+    print("dnspython is missing, use 'pip install dnspython' to install it.")
+
+from pymisp import MISPAttribute, MISPEvent, MISPObject
+
+misperrors = {"error": "Error"}
+mispattributes = {"input": ["domain", "hostname"], "format": "misp_standard"}
+moduleinfo = {
+    "version": "0.2",
+    "author": "Mihai Saveanu",
+    "description": "Check email security posture (SPF, DKIM, DMARC, MTA-STS) for a domain.",
+    "module-type": ["expansion", "hover"],
+    "name": "Email Security Check",
+    "logo": "",
+    "requirements": ["dnspython"],
+    "features": (
+        "The module takes a domain or hostname attribute as input and queries DNS"
+        " for email security records: SPF (TXT), DMARC (_dmarc), DKIM (common selectors),"
+        " and MTA-STS (_mta-sts). Returns structured MISP attributes with a domain-ip"
+        " object linking the findings to the queried domain."
+    ),
+    "references": [
+        "https://tools.ietf.org/html/rfc7208",
+        "https://tools.ietf.org/html/rfc7489",
+    ],
+    "input": "A domain or hostname attribute.",
+    "output": "Domain-ip MISP object with email security assessment attributes.",
+}
+moduleconfig = ["custom_resolver"]
+
+DKIM_SELECTORS = [
+    "default",
+    "google",
+    "selector1",
+    "selector2",
+    "k1",
+    "mandrill",
+    "everlytickey1",
+    "everlytickey2",
+    "dkim",
+    "s1",
+    "s2",
+    "mailo",
+]
+
+
+def _query_txt(domain):
+    try:
+        answers = resolver.resolve(domain, "TXT")
+        return [str(rdata).strip('"') for rdata in answers]
+    except Exception:
+        return []
+
+
+def _check_spf(domain):
+    records = _query_txt(domain)
+    spf = [r for r in records if r.startswith("v=spf1")]
+    if spf:
+        return {"status": "FOUND", "record": spf[0]}
+    return {"status": "MISSING", "record": None}
+
+
+def _check_dmarc(domain):
+    records = _query_txt(f"_dmarc.{domain}")
+    dmarc = [r for r in records if r.startswith("v=DMARC1")]
+    if dmarc:
+        policy = "none"
+        for part in dmarc[0].split(";"):
+            part = part.strip()
+            if part.startswith("p="):
+                policy = part[2:]
+        return {"status": "FOUND", "record": dmarc[0], "policy": policy}
+    return {"status": "MISSING", "record": None, "policy": None}
+
+
+def _check_dkim(domain):
+    found = []
+    for selector in DKIM_SELECTORS:
+        records = _query_txt(f"{selector}._domainkey.{domain}")
+        dkim = [r for r in records if "DKIM1" in r or "k=" in r or "p=" in r]
+        if dkim:
+            found.append({"selector": selector, "record": dkim[0]})
+    return found
+
+
+def _check_mta_sts(domain):
+    records = _query_txt(f"_mta-sts.{domain}")
+    sts = [r for r in records if r.startswith("v=STSv1")]
+    if sts:
+        return {"status": "FOUND", "record": sts[0]}
+    return {"status": "MISSING", "record": None}
+
+
+def handler(q=False):
+    if q is False:
+        return False
+
+    request = json.loads(q)
+
+    if not request.get("attribute") or not request["attribute"].get("type"):
+        return {"error": "Missing or invalid attribute."}
+
+    attribute = request["attribute"]
+    if attribute["type"] not in mispattributes["input"]:
+        return {"error": f"Unsupported attribute type: {attribute['type']}"}
+
+    domain = attribute["value"]
+
+    if request.get("config", {}).get("custom_resolver"):
+        resolver.nameservers = [request["config"]["custom_resolver"]]
+
+    spf = _check_spf(domain)
+    dmarc = _check_dmarc(domain)
+    dkim = _check_dkim(domain)
+    mta_sts = _check_mta_sts(domain)
+
+    event = MISPEvent()
+    initial_attribute = MISPAttribute()
+    initial_attribute.from_dict(**attribute)
+    event.add_attribute(**initial_attribute)
+
+    domain_obj = MISPObject("domain-ip")
+    domain_obj.add_attribute("domain", **{"type": "domain", "value": domain})
+
+    score = 0
+
+    if spf["status"] == "FOUND":
+        score += 1
+        domain_obj.add_attribute(
+            "text",
+            **{"type": "text", "value": f"SPF: {spf['record']}", "comment": "SPF record", "disable_correlation": True},
+        )
+    else:
+        domain_obj.add_attribute(
+            "text",
+            **{"type": "text", "value": "SPF: MISSING", "comment": "SPF record", "disable_correlation": True},
+        )
+
+    if dmarc["status"] == "FOUND":
+        score += 1
+        if dmarc["policy"] in ("reject", "quarantine"):
+            score += 1
+        domain_obj.add_attribute(
+            "text",
+            **{
+                "type": "text",
+                "value": f"DMARC: {dmarc['policy']} — {dmarc['record']}",
+                "comment": "DMARC record and policy",
+                "disable_correlation": True,
+            },
+        )
+    else:
+        domain_obj.add_attribute(
+            "text",
+            **{"type": "text", "value": "DMARC: MISSING", "comment": "DMARC record", "disable_correlation": True},
+        )
+
+    if dkim:
+        score += 1
+        selectors = ", ".join(d["selector"] for d in dkim)
+        domain_obj.add_attribute(
+            "text",
+            **{
+                "type": "text",
+                "value": f"DKIM: FOUND ({len(dkim)} selector(s): {selectors})",
+                "comment": "DKIM selectors found",
+                "disable_correlation": True,
+            },
+        )
+    else:
+        domain_obj.add_attribute(
+            "text",
+            **{
+                "type": "text",
+                "value": "DKIM: NOT FOUND (tested common selectors)",
+                "comment": "DKIM check",
+                "disable_correlation": True,
+            },
+        )
+
+    if mta_sts["status"] == "FOUND":
+        score += 1
+        domain_obj.add_attribute(
+            "text",
+            **{"type": "text", "value": f"MTA-STS: {mta_sts['record']}", "comment": "MTA-STS record", "disable_correlation": True},
+        )
+    else:
+        domain_obj.add_attribute(
+            "text",
+            **{"type": "text", "value": "MTA-STS: MISSING", "comment": "MTA-STS record", "disable_correlation": True},
+        )
+
+    domain_obj.add_attribute(
+        "text",
+        **{
+            "type": "text",
+            "value": f"Email Security Score: {score}/5",
+            "comment": "Overall email security posture score",
+            "disable_correlation": True,
+        },
+    )
+
+    domain_obj.add_reference(initial_attribute.uuid, "related-to")
+    event.add_object(**domain_obj)
+
+    ev = json.loads(event.to_json())
+    results = {key: ev[key] for key in ("Attribute", "Object") if key in ev and ev[key]}
+    return {"results": results}
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    return moduleinfo