def generateTTP(incident, attribute, ttps, eventTags):
ttp = TTP(timestamp=getDateFromTimestamp(int(attribute["timestamp"])))
ttp.id_= namespace[1] + ":ttp-" + attribute["uuid"]
setTLP(ttp, attribute["distribution"], mergeTags(eventTags, attribute["AttributeTag"]))
ttp.title = attribute["category"] + ": " + attribute["value"] + " (MISP Attribute #" + attribute["id"] + ")"
if attribute["type"] == "vulnerability":
vulnerability = Vulnerability()
vulnerability.cve_id = attribute["value"]
et = ExploitTarget(timestamp=getDateFromTimestamp(int(attribute["timestamp"])))
et.id_= namespace[1] + ":et-" + attribute["uuid"]
if attribute["comment"] != "" and attribute["comment"] != "Imported via the freetext import.":
et.title = attribute["comment"]
else:
et.title = "Vulnerability " + attribute["value"]
et.add_vulnerability(vulnerability)
ttp.exploit_targets.append(et)
else:
malware = MalwareInstance()
malware.add_name(attribute["value"])
ttp.behavior = Behavior()
ttp.behavior.add_malware_instance(malware)
if attribute["comment"] != "":
ttp.description = attribute["comment"]
ttps.append(ttp)
rttp = TTP(idref=ttp.id_, timestamp=ttp.timestamp)
relatedTTP = RelatedTTP(rttp, relationship=attribute["category"])
incident.leveraged_ttps.append(relatedTTP)
def generate_vulnerability(self, incident, tags, attribute):
ttp = self.create_ttp(tags, attribute)
vulnerability = Vulnerability()
vulnerability.cve_id = attribute.value
ET = ExploitTarget(timestamp=attribute.timestamp)
ET.id_ = "{}:et-{}".format(namespace[1], attribute.uuid)
if attribute.comment and attribute.comment != "Imported via the freetext import.":
ET.title = attribute.comment
else:
ET.title = "Vulnerability {}".format(attribute.value)
ET.add_vulnerability(vulnerability)
ttp.exploit_targets.append(ET)
self.append_ttp(incident, attribute, ttp)