AIL/ail-framework
7
0
Fork 0
mirror of https://github.com/ail-project/ail-framework.git synced 2024-11-27 00:07:16 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

feature: try to send data to MISP if keys are provided, else do nothing

Browse source
This commit is contained in:
Sami Mokaddem 2017-11-23 13:47:02 +01:00
parent 2a967c4d92
commit a0d07b1098
1 changed files with 23 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

33
bin/alertHandler.py
View file

@ -24,7 +24,12 @@ from pymisp import PyMISP
import ailleakObject import ailleakObject
import sys import sys
sys.path.append('../') sys.path.append('../')
from mispKEYS import misp_url, misp_key, misp_verifycert try:
from mispKEYS import misp_url, misp_key, misp_verifycert
flag_misp = True
except:
print('Misp keys not present')
flag_misp = False
if __name__ == "__main__": if __name__ == "__main__":
publisher.port = 6380 publisher.port = 6380
@ -33,9 +38,16 @@ if __name__ == "__main__":
config_section = 'alertHandler' config_section = 'alertHandler'
p = Process(config_section) p = Process(config_section)
pymisp = PyMISP(misp_url, misp_key, misp_verifycert) if flag_misp:
print('Connected to MISP:', misp_url) try:
wrapper = ailleakObject.ObjectWrapper(pymisp) pymisp = PyMISP(misp_url, misp_key, misp_verifycert)
print('Connected to MISP:', misp_url)
except:
flag_misp = False
print('Not connected to MISP')
if flag_misp:
wrapper = ailleakObject.ObjectWrapper(pymisp)
# port generated automatically depending on the date # port generated automatically depending on the date
curYear = datetime.now().year curYear = datetime.now().year
@ -66,9 +78,10 @@ if __name__ == "__main__":
publisher.info('Saved warning paste {}'.format(p_path)) publisher.info('Saved warning paste {}'.format(p_path))
# Create MISP AIL-leak object and push it # Create MISP AIL-leak object and push it
allowed_modules = ['credential', 'phone', 'creditcards'] if flag_misp:
if module_name in allowed_modules: allowed_modules = ['credential', 'phone', 'creditcards']
wrapper.add_new_object(module_name, p_path) if module_name in allowed_modules:
wrapper.pushToMISP() wrapper.add_new_object(module_name, p_path)
else: wrapper.pushToMISP()
print('not pushing to MISP:', module_name, p_path) else:
print('not pushing to MISP:', module_name, p_path)