Skip to content

Commit 93d8e35

Browse files
mokaddemmokaddem
committed
Merge remote-tracking branch 'origin/main'
2 parents 44a915f + 625bc68 commit 93d8e35

File tree

15 files changed

+908
-2663
lines changed

15 files changed

+908
-2663
lines changed

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,7 @@ For further Information see the [license file](https://misp.github.io/misp-modul
9999
* [OCR Enrich](https://misp.github.io/misp-modules/expansion/#ocr-enrich) - Module to process some optical character recognition on pictures.
100100
* [ODS Enrich](https://misp.github.io/misp-modules/expansion/#ods-enrich) - Module to extract freetext from a .ods document.
101101
* [ODT Enrich](https://misp.github.io/misp-modules/expansion/#odt-enrich) - Module to extract freetext from a .odt document.
102+
* [Onion Lookup](https://misp.github.io/misp-modules/expansion/#onion-lookup) - MISP module using the MISP standard. Uses the onion-lookup service to get information about an onion.
102103
* [Onyphe Lookup](https://misp.github.io/misp-modules/expansion/#onyphe-lookup) - Module to process a query on Onyphe.
103104
* [Onyphe Full Lookup](https://misp.github.io/misp-modules/expansion/#onyphe-full-lookup) - Module to process a full query on Onyphe.
104105
* [AlienVault OTX Lookup](https://misp.github.io/misp-modules/expansion/#alienvault-otx-lookup) - Module to get information from AlienVault OTX.

‎documentation/README.md‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1740,6 +1740,18 @@ Module to extract freetext from a .odt document.
17401740

17411741
-----
17421742

1743+
#### [Onion Lookup](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/expansion/onion_lookup.py)
1744+
1745+
<img src=logos/onion.png height=60>
1746+
1747+
MISP module using the MISP standard. Uses the onion-lookup service to get information about an onion.
1748+
[[source code](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/expansion/onion_lookup.py)]
1749+
1750+
- **references**:
1751+
>https://onion.ail-project.org/
1752+
1753+
-----
1754+
17431755
#### [Onyphe Lookup](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/expansion/onyphe.py)
17441756

17451757
<img src=logos/onyphe.jpg height=60>

‎documentation/logos/onion.png‎

8.77 KB
Loading

‎documentation/mkdocs/expansion.md‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1737,6 +1737,18 @@ Module to extract freetext from a .odt document.
17371737

17381738
-----
17391739

1740+
#### [Onion Lookup](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/expansion/onion_lookup.py)
1741+
1742+
<img src=../logos/onion.png height=60>
1743+
1744+
MISP module using the MISP standard. Uses the onion-lookup service to get information about an onion.
1745+
[[source code](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/expansion/onion_lookup.py)]
1746+
1747+
- **references**:
1748+
>https://onion.ail-project.org/
1749+
1750+
-----
1751+
17401752
#### [Onyphe Lookup](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/expansion/onyphe.py)
17411753

17421754
<img src=../logos/onyphe.jpg height=60>

‎documentation/mkdocs/index.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,7 @@ For more information: [Extending MISP with Python modules](https://www.misp-proj
7878
* [OCR Enrich](https://misp.github.io/misp-modules/expansion/#ocr-enrich) - Module to process some optical character recognition on pictures.
7979
* [ODS Enrich](https://misp.github.io/misp-modules/expansion/#ods-enrich) - Module to extract freetext from a .ods document.
8080
* [ODT Enrich](https://misp.github.io/misp-modules/expansion/#odt-enrich) - Module to extract freetext from a .odt document.
81+
* [Onion Lookup](https://misp.github.io/misp-modules/expansion/#onion-lookup) - MISP module using the MISP standard. Uses the onion-lookup service to get information about an onion.
8182
* [Onyphe Lookup](https://misp.github.io/misp-modules/expansion/#onyphe-lookup) - Module to process a query on Onyphe.
8283
* [Onyphe Full Lookup](https://misp.github.io/misp-modules/expansion/#onyphe-full-lookup) - Module to process a full query on Onyphe.
8384
* [AlienVault OTX Lookup](https://misp.github.io/misp-modules/expansion/#alienvault-otx-lookup) - Module to get information from AlienVault OTX.

‎misp_modules/lib/stix2misp.py‎

Lines changed: 0 additions & 2080 deletions
This file was deleted.

‎misp_modules/lib/stix2misp_mapping.py‎

Lines changed: 0 additions & 460 deletions
This file was deleted.

‎misp_modules/modules/expansion/__init__.py‎

Lines changed: 114 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -3,27 +3,120 @@
33

44
sys.path.append('{}/lib'.format('/'.join((os.path.realpath(__file__)).split('/')[:-3])))
55

6-
__all__ = ['cuckoo_submit', 'vmray_submit', 'circl_passivedns', 'circl_passivessl',
7-
'cluster25_expand', 'countrycode', 'cve', 'cve_advanced', 'cpe', 'dns', 'btc_steroids', 'domaintools',
8-
'eupi', 'eql', 'farsight_passivedns', 'ipasn', 'passivetotal', 'sourcecache', 'virustotal',
9-
'shodan', 'reversedns', 'geoip_asn', 'geoip_city', 'geoip_country', 'wiki', 'iprep',
10-
'threatminer', 'otx', 'threatcrowd', 'vulndb', 'crowdstrike_falcon',
11-
'yara_syntax_validator', 'hashdd', 'onyphe', 'onyphe_full', 'rbl',
12-
'xforceexchange', 'sigma_syntax_validator', 'stix2_pattern_syntax_validator',
13-
'sigma_queries', 'dbl_spamhaus', 'vulners', 'yara_query', 'macaddress_io',
14-
'intel471', 'backscatter_io', 'btc_scam_check', 'hibp', 'greynoise', 'macvendors',
15-
'qrcode', 'ocr_enrich', 'pdf_enrich', 'docx_enrich', 'xlsx_enrich', 'pptx_enrich',
16-
'ods_enrich', 'odt_enrich', 'joesandbox_submit', 'joesandbox_query', 'urlhaus',
17-
'virustotal_public', 'apiosintds', 'urlscan', 'securitytrails', 'apivoid',
18-
'assemblyline_submit', 'assemblyline_query', 'ransomcoindb', 'malwarebazaar',
19-
'lastline_query', 'lastline_submit', 'sophoslabs_intelix', 'cytomic_orion', 'censys_enrich',
20-
'trustar_enrich', 'recordedfuture', 'html_to_markdown', 'socialscan', 'passive_ssh',
21-
'qintel_qsentry', 'mwdb', 'hashlookup', 'mmdb_lookup', 'ipqs_fraud_and_risk_scoring',
22-
'clamav', 'jinja_template_rendering', 'hyasinsight', 'variotdbs', 'crowdsec',
23-
'extract_url_components', 'ipinfo', 'whoisfreaks', 'ip2locationio', 'stairwell',
24-
'google_threat_intelligence', 'vulnerability_lookup', 'vysion', 'mcafee_insights_enrich',
25-
'threatfox', 'yeti', 'abuseipdb', 'vmware_nsx', 'sigmf_expand', 'google_safe_browsing',
26-
'google_search', 'whois', 'triage_submit', 'virustotal_upload', 'malshare_upload', 'convert_markdown_to_pdf' ]
6+
__all__ = [
7+
'cuckoo_submit',
8+
'vmray_submit',
9+
'circl_passivedns',
10+
'circl_passivessl',
11+
'cluster25_expand',
12+
'countrycode',
13+
'cve',
14+
'cve_advanced',
15+
'cpe',
16+
'dns',
17+
'btc_steroids',
18+
'domaintools',
19+
'eupi',
20+
'eql',
21+
'farsight_passivedns',
22+
'ipasn',
23+
'passivetotal',
24+
'sourcecache',
25+
'virustotal',
26+
'shodan',
27+
'reversedns',
28+
'geoip_asn',
29+
'geoip_city',
30+
'geoip_country',
31+
'wiki',
32+
'iprep',
33+
'threatminer',
34+
'otx',
35+
'threatcrowd',
36+
'vulndb',
37+
'crowdstrike_falcon',
38+
'yara_syntax_validator',
39+
'hashdd',
40+
'onyphe',
41+
'onyphe_full',
42+
'rbl',
43+
'xforceexchange',
44+
'sigma_syntax_validator',
45+
'stix2_pattern_syntax_validator',
46+
'sigma_queries',
47+
'dbl_spamhaus',
48+
'vulners',
49+
'yara_query',
50+
'macaddress_io',
51+
'intel471',
52+
'backscatter_io',
53+
'btc_scam_check',
54+
'hibp',
55+
'greynoise',
56+
'macvendors',
57+
'qrcode',
58+
'ocr_enrich',
59+
'pdf_enrich',
60+
'docx_enrich',
61+
'xlsx_enrich',
62+
'pptx_enrich',
63+
'ods_enrich',
64+
'odt_enrich',
65+
'joesandbox_submit',
66+
'joesandbox_query',
67+
'urlhaus',
68+
'virustotal_public',
69+
'apiosintds',
70+
'urlscan',
71+
'securitytrails',
72+
'apivoid',
73+
'assemblyline_submit',
74+
'assemblyline_query',
75+
'ransomcoindb',
76+
'malwarebazaar',
77+
'lastline_query',
78+
'lastline_submit',
79+
'sophoslabs_intelix',
80+
'cytomic_orion',
81+
'censys_enrich',
82+
'trustar_enrich',
83+
'recordedfuture',
84+
'html_to_markdown',
85+
'socialscan',
86+
'passive_ssh',
87+
'qintel_qsentry',
88+
'mwdb',
89+
'hashlookup',
90+
'mmdb_lookup',
91+
'ipqs_fraud_and_risk_scoring',
92+
'clamav',
93+
'jinja_template_rendering',
94+
'hyasinsight',
95+
'variotdbs',
96+
'crowdsec',
97+
'extract_url_components',
98+
'ipinfo',
99+
'whoisfreaks',
100+
'ip2locationio',
101+
'stairwell',
102+
'google_threat_intelligence',
103+
'vulnerability_lookup',
104+
'vysion',
105+
'mcafee_insights_enrich',
106+
'threatfox',
107+
'yeti',
108+
'abuseipdb',
109+
'vmware_nsx',
110+
'sigmf_expand',
111+
'google_safe_browsing',
112+
'google_search',
113+
'whois',
114+
'triage_submit',
115+
'virustotal_upload',
116+
'malshare_upload',
117+
'convert_markdown_to_pdf',
118+
'onion_lookup',
119+
]
27120

28121

29122
minimum_required_fields = ('type', 'uuid', 'value')

‎misp_modules/modules/expansion/onion_lookup.py‎

Lines changed: 14 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -14,22 +14,25 @@
1414
# 'url',
1515
# Any other Attribute type...
1616
],
17-
'format': 'misp_standard'
17+
'format': 'misp_standard',
1818
}
1919

2020
moduleinfo = {
2121
'version': '1',
22+
'author': 'Sami Mokaddem',
23+
'name': 'Onion Lookup',
2224
'author': 'MISP',
23-
'description': 'MISP module using the MISP standard. Uses the onion-lookup service to get information about an onion',
25+
'description': 'MISP module using the MISP standard. Uses the onion-lookup service to get information about an onion.',
2426
'module-type': [ # possible module-types: 'expansion', 'hover' or both
2527
'expansion',
26-
'hover'
27-
]
28+
'hover',
29+
],
30+
'references': ['https://onion.ail-project.org/'],
31+
'logo': 'onion.png'
2832
}
2933

3034
# config fields that your code expects from the site admin
31-
moduleconfig = [
32-
]
35+
moduleconfig = []
3336

3437

3538
def getDetails(onion_address):
@@ -47,6 +50,8 @@ def getDetails(onion_address):
4750
],
4851
}
4952
'''
53+
54+
5055
def createObject(onion_details):
5156
misp_object = MISPObject('tor-hiddenservice')
5257
misp_object.comment = 'custom-comment2'
@@ -62,7 +67,6 @@ def createObject(onion_details):
6267
return misp_object
6368

6469

65-
6670
def enrichOnion(misp_event, attribute):
6771
onion_address = attribute['value']
6872
onion_details = getDetails(onion_address)
@@ -85,7 +89,9 @@ def handler(q=False):
8589

8690
# Input sanity check
8791
if not request.get('attribute') or not check_input_attribute(request['attribute']):
88-
return {'error': f'{standard_error_message}, which should contain at least a type, a value and an uuid.'}
92+
return {
93+
'error': f'{standard_error_message}, which should contain at least a type, a value and an uuid.'
94+
}
8995
attribute = request['attribute']
9096

9197
# Make sure the Attribute's type is one of the expected type
@@ -112,4 +118,3 @@ def introspection():
112118
def version():
113119
moduleinfo['config'] = moduleconfig
114120
return moduleinfo
115-

‎misp_modules/modules/import_mod/lastline_import.py‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,8 +17,9 @@
1717
"analysis_link": {
1818
"type": "String",
1919
"errorMessage": "Expected analysis link",
20-
"message": "The link to a Lastline analysis"
21-
},
20+
"message": "The link to a Lastline analysis",
21+
"required": True
22+
}
2223
}
2324

2425
inputSource = []

0 commit comments

Comments
 (0)