AIL/ail-framework
7
0
Fork 0
mirror of https://github.com/ail-project/ail-framework.git synced 2024-09-20 07:58:29 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

feature: try to send data to MISP if keys are provided, else do nothing

Browse source
This commit is contained in:
Sami Mokaddem 2017-11-23 13:47:02 +01:00
parent 2a967c4d92
commit a0d07b1098
1 changed files with 23 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
bin/alertHandler.py
View file

@ -24,7 +24,12 @@ from pymisp import PyMISP
import ailleakObject import ailleakObject
import sys import sys
sys.path.append('../') sys.path.append('../')
try:
from mispKEYS import misp_url, misp_key, misp_verifycert from mispKEYS import misp_url, misp_key, misp_verifycert
flag_misp = True
except:
print('Misp keys not present')
flag_misp = False
if __name__ == "__main__": if __name__ == "__main__":
publisher.port = 6380 publisher.port = 6380
@ -33,8 +38,15 @@ if __name__ == "__main__":
config_section = 'alertHandler' config_section = 'alertHandler'
p = Process(config_section) p = Process(config_section)
if flag_misp:
try:
pymisp = PyMISP(misp_url, misp_key, misp_verifycert) pymisp = PyMISP(misp_url, misp_key, misp_verifycert)
print('Connected to MISP:', misp_url) print('Connected to MISP:', misp_url)
except:
flag_misp = False
print('Not connected to MISP')
if flag_misp:
wrapper = ailleakObject.ObjectWrapper(pymisp) wrapper = ailleakObject.ObjectWrapper(pymisp)
# port generated automatically depending on the date # port generated automatically depending on the date
@ -66,6 +78,7 @@ if __name__ == "__main__":
publisher.info('Saved warning paste {}'.format(p_path)) publisher.info('Saved warning paste {}'.format(p_path))
# Create MISP AIL-leak object and push it # Create MISP AIL-leak object and push it
if flag_misp:
allowed_modules = ['credential', 'phone', 'creditcards'] allowed_modules = ['credential', 'phone', 'creditcards']
if module_name in allowed_modules: if module_name in allowed_modules:
wrapper.add_new_object(module_name, p_path) wrapper.add_new_object(module_name, p_path)