def do_transform(self, request, response, config): response += check_update(config) # skip some Entities skip = ['properties.mispevent'] for i in skip: if i in request.entity.fields: return response if 'ipv4-range' in request.entity.fields: # placeholder for https://github.com/MISP/MISP-maltego/issues/11 pass misp = get_misp_connection(config, request.parameters) # from Galaxy if 'properties.mispgalaxy' in request.entity.fields: tag_name = get_entity_property(request.entity, 'tag_name') if not tag_name: tag_name = request.entity.value events_json = misp.search(controller='events', tags=tag_name, with_attachments=False) for e in events_json: response += event_to_entity(e, link_direction=LinkDirection.OutputToInput) return response # from Object elif 'properties.mispobject' in request.entity.fields: if request.entity.fields.get('event_id'): events_json = misp.search(controller='events', eventid=request.entity.fields.get('event_id').value, with_attachments=False) for e in events_json: response += event_to_entity(e, link_direction=LinkDirection.OutputToInput) return response else: return response # from Hashtag elif 'properties.temp' in request.entity.fields: tag_name = get_entity_property(request.entity, 'Temp') if not tag_name: tag_name = request.entity.value events_json = misp.search(controller='events', tags=tag_name, with_attachments=False) for e in events_json: response += event_to_entity(e, link_direction=LinkDirection.OutputToInput) return response # standard Entities (normal attributes) else: events_json = misp.search(controller='events', value=request.entity.value, with_attachments=False) # return the MISPEvent or MISPObject of the attribute for e in events_json: # find the value as attribute attr = get_attribute_in_event(e, request.entity.value) if attr: response += event_to_entity(e, link_direction=LinkDirection.OutputToInput) # find the value as object if 'Object' in e['Event']: for o in e['Event']['Object']: if get_attribute_in_object(o, attribute_value=request.entity.value).get('value'): response += object_to_entity(o, link_direction=LinkDirection.OutputToInput) return response
def do_transform(self, request, response, config): # skip some Entities skip = ['properties.mispevent', 'properties.mispobject'] for i in skip: if i in request.entity.fields: return response if 'ipv4-range' in request.entity.fields: # placeholder for https://github.com/MISP/MISP-maltego/issues/11 pass misp = get_misp_connection(config) if 'properties.mispgalaxy' in request.entity.fields: tag_name = get_entity_property(request.entity, 'tag_name') if not tag_name: tag_name = request.entity.value events_json = misp.search(controller='events', tags=tag_name, withAttachments=False) else: events_json = misp.search(controller='events', values=request.entity.value, withAttachments=False) in_misp = False for e in events_json['response']: in_misp = True response += event_to_entity(e) # find the object again, and bookmark it green # we need to do really rebuild the Entity from scratch as request.entity is of type Unknown if in_misp: for e in events_json['response']: attr = get_attribute_in_event(e, request.entity.value) if attr: for item in attribute_to_entity(attr, only_self=True): response += item return response
def do_transform(self, request, response, config): response += check_update(config) link_label = 'Search result' if 'properties.mispevent' in request.entity.fields: conn = MISPConnection(config, request.parameters) # if event_id try: if request.entity.value == '0': return response eventid = int(request.entity.value) events_json = conn.misp.search(controller='events', eventid=eventid, with_attachments=False) for e in events_json: response += event_to_entity( e, link_label=link_label, link_direction=LinkDirection.OutputToInput) return response except ValueError: pass # if event_info string as value events_json = conn.misp.search(controller='events', eventinfo=request.entity.value, with_attachments=False) for e in events_json: response += event_to_entity( e, link_label=link_label, link_direction=LinkDirection.OutputToInput) return response # From galaxy or Hashtag if 'properties.mispgalaxy' in request.entity.fields or 'properties.temp' in request.entity.fields or 'twitter.hashtag' in request.entity.fields: if request.entity.value == '-': return response # First search in galaxies keyword = get_entity_property(request.entity, 'Temp') if not keyword: keyword = request.entity.value # assume the user is searching for a cluster based on a substring. # Search in the list for those that match and return galaxy entities' potential_clusters = search_galaxy_cluster(keyword) # LATER check if duplicates are possible if potential_clusters: for potential_cluster in potential_clusters: new_entity = galaxycluster_to_entity(potential_cluster, link_label=link_label) # LATER support the type_filter - unfortunately this is not possible, we need Canari to tell us the original entity type if isinstance(new_entity, MISPGalaxy): response += new_entity # from Hashtag search also in tags if 'properties.temp' in request.entity.fields or 'twitter.hashtag' in request.entity.fields: keyword = get_entity_property(request.entity, 'Temp') if not keyword: keyword = request.entity.value conn = MISPConnection(config, request.parameters) result = conn.misp.direct_call('tags/search', {'name': keyword}) for t in result: # skip misp-galaxies as we have processed them earlier on if t['Tag']['name'].startswith('misp-galaxy'): continue # In this case we do not filter away those we add as notes, as people might want to pivot on it explicitly. response += Hashtag(t['Tag']['name'], link_label=link_label, bookmark=Bookmark.Green) return response # for all other normal entities conn = MISPConnection(config, request.parameters) events_json = conn.misp.search(controller='events', value=request.entity.value, with_attachments=False) # we need to do really rebuild the Entity from scratch as request.entity is of type Unknown for e in events_json: # find the value as attribute attr = get_attribute_in_event(e, request.entity.value, substring=True) if attr: for item in attribute_to_entity(attr, only_self=True): response += item # find the value as object, and return the object if 'Object' in e['Event']: for o in e['Event']['Object']: if get_attribute_in_object( o, attribute_value=request.entity.value, substring=True).get('value'): response += conn.object_to_entity( o, link_label=link_label) return response