mirror of
https://github.com/ail-project/ail-framework.git
synced 2024-11-10 08:38:28 +00:00
79 lines
2.5 KiB
Python
Executable file
79 lines
2.5 KiB
Python
Executable file
#!/usr/bin/env python2
|
|
# -*-coding:UTF-8 -*
|
|
|
|
"""
|
|
The Browse_warning_paste module
|
|
====================
|
|
|
|
This module saved signaled paste (logged as 'warning') in redis for further usage
|
|
like browsing by category
|
|
|
|
Its input comes from other modules, namely:
|
|
Credential, CreditCard, SQLinjection, CVE, Keys, Mail and Phone
|
|
|
|
"""
|
|
|
|
import redis
|
|
import time
|
|
from datetime import datetime, timedelta
|
|
from packages import Paste
|
|
from pubsublogger import publisher
|
|
from Helper import Process
|
|
|
|
from pymisp import PyMISP
|
|
import ailleakObject
|
|
import sys
|
|
sys.path.append('../')
|
|
from mispKEYS import misp_url, misp_key, misp_verifycert
|
|
|
|
if __name__ == "__main__":
|
|
publisher.port = 6380
|
|
publisher.channel = "Script"
|
|
|
|
config_section = 'alertHandler'
|
|
|
|
p = Process(config_section)
|
|
pymisp = PyMISP(misp_url, misp_key, misp_verifycert)
|
|
eventID = "9356"
|
|
mispTYPE = 'ail-leak'
|
|
|
|
# port generated automatically depending on the date
|
|
curYear = datetime.now().year
|
|
server = redis.StrictRedis(
|
|
host=p.config.get("Redis_Level_DB", "host"),
|
|
port=curYear,
|
|
db=p.config.get("Redis_Level_DB", "db"))
|
|
|
|
# FUNCTIONS #
|
|
publisher.info("Script duplicate started")
|
|
|
|
while True:
|
|
message = p.get_from_set()
|
|
if message is not None:
|
|
module_name, p_path = message.split(';')
|
|
#PST = Paste.Paste(p_path)
|
|
else:
|
|
publisher.debug("Script Attribute is idling 10s")
|
|
time.sleep(10)
|
|
continue
|
|
|
|
# Add in redis for browseWarningPaste
|
|
# Format in set: WARNING_moduleName -> p_path
|
|
key = "WARNING_" + module_name
|
|
server.sadd(key, p_path)
|
|
|
|
publisher.info('Saved warning paste {}'.format(p_path))
|
|
|
|
# Create MISP AIL-leak object
|
|
misp_object = AilleakObject(moduleName, path)
|
|
print('validate mispobj', misp_object._validate())
|
|
print(misp_object)
|
|
|
|
# Publish object to MISP
|
|
try:
|
|
templateID = [x['ObjectTemplate']['id'] for x in pymisp.get_object_templates_list() if x['ObjectTemplate']['name'] == mispTYPE][0]
|
|
except IndexError:
|
|
valid_types = ", ".join([x['ObjectTemplate']['name'] for x in pymisp.get_object_templates_list()])
|
|
print ("Template for type %s not found! Valid types are: %s" % (mispTYPE, valid_types))
|
|
continue
|
|
#r = pymisp.add_object(eventID, templateID, misp_object)
|