Skip to content

Commit 98c9574

Browse files
adulauadulau
committed
chg: [doc] updated
1 parent eb06433 commit 98c9574

2 files changed

Lines changed: 112 additions & 32 deletions

File tree

‎README.md‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,7 @@ For further Information see the [license file](https://misp.github.io/misp-modul
4343

4444
## Expansion Modules
4545
* [Abuse IPDB](https://misp.github.io/misp-modules/expansion/#abuse-ipdb) - AbuseIPDB MISP expansion module
46+
* [ANYRUN Sandbox Submit](https://misp.github.io/misp-modules/expansion/#anyrun-sandbox-submit) - A module designed to submit URLs or files to the ANY.RUN Sandbox for analysis and return the unique analysis link and ID.
4647
* [OSINT DigitalSide](https://misp.github.io/misp-modules/expansion/#osint-digitalside) - On demand query API for OSINT.digitalside.it project.
4748
* [APIVoid](https://misp.github.io/misp-modules/expansion/#apivoid) - Module to query APIVoid with some domain attributes.
4849
* [AssemblyLine Query](https://misp.github.io/misp-modules/expansion/#assemblyline-query) - A module tu query the AssemblyLine API with a submission ID to get the submission report and parse it.
@@ -115,7 +116,7 @@ For further Information see the [license file](https://misp.github.io/misp-modul
115116
* [Qintel QSentry Lookup](https://misp.github.io/misp-modules/expansion/#qintel-qsentry-lookup) - A hover and expansion module which queries Qintel QSentry for ip reputation data
116117
* [QR Code Decode](https://misp.github.io/misp-modules/expansion/#qr-code-decode) - Module to decode QR codes.
117118
* [RandomcoinDB Lookup](https://misp.github.io/misp-modules/expansion/#randomcoindb-lookup) - Module to access the ransomcoinDB (see https://ransomcoindb.concinnity-risks.com)
118-
* [Rapid7 AttackerKB](https://misp.github.io/misp-modules/expansion/#/documentation#rapid7-attackerkb-lookup) - Module to query Rapid7 AttackerKB vulnerability intelligence - https://attackerkb.com/
119+
* [r7_akb](https://misp.github.io/misp-modules/expansion/#r7_akb) - Enrich CVEs via AttackerKB and return structured MISP events. Handles rate limits, regex CVE detection, and markdown cleanup.
119120
* [Real-time Blackhost Lists Lookup](https://misp.github.io/misp-modules/expansion/#real-time-blackhost-lists-lookup) - Module to check an IPv4 address against known RBLs.
120121
* [Recorded Future Enrich](https://misp.github.io/misp-modules/expansion/#recorded-future-enrich) - Module to enrich attributes with threat intelligence from Recorded Future.
121122
* [Reverse DNS](https://misp.github.io/misp-modules/expansion/#reverse-dns) - Simple Reverse DNS expansion service to resolve reverse DNS from MISP attributes.
@@ -173,6 +174,7 @@ For further Information see the [license file](https://misp.github.io/misp-modul
173174
* [YARA Rule Export](https://misp.github.io/misp-modules/export_mod/#yara-rule-export) - This module is used to export MISP events to YARA.
174175

175176
## Import Modules
177+
* [ANYRUN Sandbox Import](https://misp.github.io/misp-modules/import_mod/#anyrun-sandbox-import) - A module designed to retrieve an analysis report from the ANY.RUN Sandbox by its unique ID and extract results (such as verdict, malware tags, and IOCs), converting them into MISP attributes within your event.
176178
* [PDNS COF Importer](https://misp.github.io/misp-modules/import_mod/#pdns-cof-importer) - Passive DNS Common Output Format (COF) MISP importer
177179
* [CSV Import](https://misp.github.io/misp-modules/import_mod/#csv-import) - Module to import MISP attributes from a csv file.
178180
* [Cuckoo Sandbox Import](https://misp.github.io/misp-modules/import_mod/#cuckoo-sandbox-import) - Module to import Cuckoo JSON.
@@ -193,6 +195,7 @@ For further Information see the [license file](https://misp.github.io/misp-modul
193195

194196
## Action Modules
195197
* [Mattermost](https://misp.github.io/misp-modules/action_mod/#mattermost) - Simplistic module to send message to a Mattermost channel.
198+
* [Nextcloud talk](https://misp.github.io/misp-modules/action_mod/#nextcloud-talk) - Simplistic module to send a message to a Nextcloud talk conversation.
196199
* [Slack](https://misp.github.io/misp-modules/action_mod/#slack) - Simplistic module to send messages to a Slack channel.
197200
* [Test action](https://misp.github.io/misp-modules/action_mod/#test-action) - This module is merely a test, always returning true. Triggers on event publishing.
198201

‎documentation/README.md‎

Lines changed: 108 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,52 @@ AbuseIPDB MISP expansion module
1717
1818
-----
1919

20+
#### [ANYRUN Sandbox Submit](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/expansion/anyrun_sandbox_submit.py)
21+
22+
A module designed to submit URLs or files to the ANY.RUN Sandbox for analysis and return the unique analysis link and ID.
23+
[[source code](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/expansion/anyrun_sandbox_submit.py)]
24+
25+
- **features**:
26+
>Supports submission of URLs and files via the ANY.RUN API; requires an API key for authentication; returns the task ID and permanent URL for tracking analysis progress; integrates seamlessly with MISP events by enriching attributes with submission results.
27+
28+
- **config**:
29+
> - api_key
30+
> - os_type
31+
> - opt_timeout
32+
> - opt_network_connect
33+
> - opt_network_fakenet
34+
> - opt_network_tor
35+
> - opt_network_geo
36+
> - opt_network_mitm
37+
> - opt_network_residential_proxy
38+
> - opt_network_residential_proxy_geo
39+
> - opt_privacy_type
40+
> - obj_ext_extension
41+
> - obj_ext_browser
42+
> - env_locale
43+
> - env_version
44+
> - env_bitness
45+
> - env_type
46+
> - obj_ext_startfolder
47+
> - obj_ext_cmd
48+
> - obj_force_elevation
49+
> - run_as_root
50+
51+
- **input**:
52+
>Attachment, malware-sample or url to submit to ANY.RUN Sandbox.
53+
54+
- **output**:
55+
>ANY.RUN Sandbox analysis URL and UUID.
56+
57+
- **references**:
58+
>https://any.run
59+
60+
- **requirements**:
61+
> - anyrun-sdk: ANY.RUN API python3 library
62+
> - ANY.RUN Sandbox API-KEY
63+
64+
-----
65+
2066
#### [OSINT DigitalSide](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/expansion/apiosintds.py)
2167

2268
On demand query API for OSINT.digitalside.it project.
@@ -110,9 +156,6 @@ A module tu query the AssemblyLine API with a submission ID to get the submissio
110156
- **references**:
111157
>https://www.cyber.gc.ca/en/assemblyline
112158
113-
- **requirements**:
114-
>assemblyline_client: Python library to query the AssemblyLine rest API.
115-
116159
-----
117160

118161
#### [AssemblyLine Submit](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/expansion/assemblyline_submit.py)
@@ -143,9 +186,6 @@ A module to submit samples and URLs to AssemblyLine for advanced analysis, and r
143186
- **references**:
144187
>https://www.cyber.gc.ca/en/assemblyline
145188
146-
- **requirements**:
147-
>assemblyline_client: Python library to query the AssemblyLine rest API.
148-
149189
-----
150190

151191
#### [Backscatter.io](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/expansion/backscatter_io.py)
@@ -1575,6 +1615,9 @@ Query Malware Bazaar to get additional information about the input hash.
15751615
>
15761616
>The module is using the new format of modules able to return object since the result is one or multiple MISP object(s).
15771617
1618+
- **config**:
1619+
>auth_key
1620+
15781621
- **input**:
15791622
>A hash attribute (md5, sha1 or sha256).
15801623
@@ -2031,37 +2074,23 @@ Module to access the ransomcoinDB (see https://ransomcoindb.concinnity-risks.com
20312074

20322075
-----
20332076

2034-
#### [Rapid7 AttackerKB lookup](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/expansion/rapid7_attackerkb.py)
2035-
2036-
<img src=logos/rapid7.png height=45>
2077+
#### [r7_akb](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/expansion/rapid7_attackerkb.py)
20372078

2038-
Module to lookup CVE attributes in **Rapid7 AttackerKB**.
2079+
Enrich CVEs via AttackerKB and return structured MISP events. Handles rate limits, regex CVE detection, and markdown cleanup.
20392080
[[source code](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/expansion/rapid7_attackerkb.py)]
20402081

2041-
- **features**:
2042-
>The module takes a CVE attribute and queries Rapid7 AttackerKB to retrieve information about the vulnerability.
2043-
>It returns details such as the CVSS score, exploitability, attacker value, available references, Rapid7 analysis, and community assessments.
2044-
2045-
- **config**:
2046-
> api_key
2047-
2048-
- **input**:
2049-
>A vulnerability attribute containing a CVE ID, or a comment that includes one or more CVEs.
2082+
- **config**:
2083+
>api_key
20502084

2051-
- **output**:
2052-
> Enriched information about the CVE, including:
2053-
> - Vulnerability description and link to Rapid7 AttackerKB topic
2054-
> - CVSS base score
2055-
> - Attacker value and exploitability ratings
2056-
> - External references related to the CVE
2057-
> - Rapid7’s analysis (if available)
2058-
> - Community assessments with contributor names, scores, and notes
2085+
- **input**:
2086+
>Vulnerability attribute (CVE ID or comment containing CVE).
20592087

2060-
- **references**:
2061-
> https://attackerkb.com/
2088+
- **output**:
2089+
>Structured MISP Objects.
20622090

2063-
- **requirements**:
2064-
> A valid public Rapid7 AttackerKB API key https://api.attackerkb.com/v1/api-docs/docs
2091+
- **requirements**:
2092+
> - pymisp
2093+
> - requests
20652094

20662095
-----
20672096

@@ -2316,6 +2345,7 @@ An expansion module to query the Sophoslabs intelix API to get additional inform
23162345
- **config**:
23172346
> - client_id
23182347
> - client_secret
2348+
> - region
23192349
23202350
- **input**:
23212351
>An ip address, url, domain or sha256 attribute.
@@ -2460,6 +2490,9 @@ Module to search for an IOC on ThreatFox by abuse.ch.
24602490
- **features**:
24612491
>
24622492

2493+
- **config**:
2494+
>auth_key
2495+
24632496
-----
24642497

24652498
#### [ThreatMiner Lookup](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/expansion/threatminer.py)
@@ -2569,6 +2602,9 @@ Query of the URLhaus API to get additional information about the input attribute
25692602
>
25702603
>The module takes one of the attribute type specified as input, and query the URLhaus API with it. If any result is returned by the API, attributes and objects are created accordingly.
25712604

2605+
- **config**:
2606+
>auth_key
2607+
25722608
- **input**:
25732609
>A domain, hostname, url, ip, md5 or sha256 attribute.
25742610

@@ -3565,6 +3601,34 @@ This module is used to export MISP events to YARA.
35653601
35663602
## Import Modules
35673603
3604+
#### [ANYRUN Sandbox Import](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/import_mod/anyrun_sandbox_import.py)
3605+
3606+
<img src=logos/anyrun.png height=60>
3607+
3608+
A module designed to retrieve an analysis report from the ANY.RUN Sandbox by its unique ID and extract results (such as verdict, malware tags, and IOCs), converting them into MISP attributes within your event.
3609+
[[source code](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/import_mod/anyrun_sandbox_import.py)]
3610+
3611+
- **features**:
3612+
>Fetches detailed JSON reports using the ANY.RUN API; parses key elements like verdict, extracted IOCs (hashes, IPs, URLs), malware tags; maps data to MISP attributes and galaxies (e.g., malware family or MITRE ATT&CK Techniques).
3613+
3614+
- **config**:
3615+
>api_key
3616+
3617+
- **input**:
3618+
>ANY.RUN Sandbox analysis UUID.
3619+
3620+
- **output**:
3621+
>Analysis external references, verdict, IOCs (hashes, IPs, URLs), malware tags, MITRE ATT&CK Techniques
3622+
3623+
- **references**:
3624+
>https://any.run
3625+
3626+
- **requirements**:
3627+
> - anyrun-sdk: ANY.RUN API python3 library
3628+
> - ANY.RUN Sandbox API-KEY
3629+
3630+
-----
3631+
35683632
#### [PDNS COF Importer](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/import_mod/cof2misp.py)
35693633
35703634
Passive DNS Common Output Format (COF) MISP importer
@@ -3917,6 +3981,19 @@ Simplistic module to send message to a Mattermost channel.
39173981

39183982
-----
39193983

3984+
#### [Nextcloud talk](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/action_mod/nextcloud_talk.py)
3985+
3986+
Simplistic module to send a message to a Nextcloud talk conversation.
3987+
[[source code](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/action_mod/nextcloud_talk.py)]
3988+
3989+
- **features**:
3990+
>
3991+
3992+
- **config**:
3993+
>{'params': {'nextcloud_baseurl': {'type': 'string', 'description': 'The Nexctloud domain or URL', 'value': 'https://example.nextcloud.org:443'}, 'nextcloud_app_uuid_login': {'type': 'string', 'description': 'The nextcloud username'}, 'app_access_token': {'type': 'string', 'description': 'The nextcloud application token'}, 'nextcloud_conversation_token': {'type': 'string', 'description': 'The token of the conversation the message should be sent to'}, 'message_template': {'type': 'large_string', 'description': 'The template to be used to generate the message to be posted', 'value': 'The **template** will be rendered using *Jinja2*!', 'jinja_supported': True}}, 'blocking': False, 'support_filters': True, 'expect_misp_core_format': False}
3994+
3995+
-----
3996+
39203997
#### [Slack](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/action_mod/slack.py)
39213998

39223999
Simplistic module to send messages to a Slack channel.

0 commit comments

Comments
 (0)