-
Notifications
You must be signed in to change notification settings - Fork 281
Expand file tree
/
Copy pathjoe_import.py
More file actions
80 lines (67 loc) · 2.21 KB
/
Copy pathjoe_import.py
File metadata and controls
80 lines (67 loc) · 2.21 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
# -*- coding: utf-8 -*-
import base64
import json
from joe_parser import JoeParser
misperrors = {"error": "Error"}
userConfig = {
"Import Executable": {
"type": "Boolean",
"message": "Import Executable Information (PE, elf or apk for instance)",
},
"Mitre Att&ck": {
"type": "Boolean",
"message": "Import Mitre Att&ck techniques",
},
}
inputSource = ["file"]
moduleinfo = {
"version": "0.2",
"author": "Christian Studer",
"description": "A module to import data from a Joe Sandbox analysis json report.",
"module-type": ["import"],
"name": "Joe Sandbox Import",
"logo": "joesandbox.png",
"requirements": [],
"features": (
"Module using the new format of modules able to return attributes and objects.\n\nThe module returns the same"
" results as the expansion module"
" [joesandbox_query](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/expansion/joesandbox_query.py)"
" using the submission link of the analysis to get the json report."
),
"references": ["https://www.joesecurity.org", "https://www.joesandbox.com/"],
"input": "Json report of a Joe Sandbox analysis.",
"output": "MISP attributes & objects parsed from the analysis report.",
}
moduleconfig = []
def handler(q=False):
if q is False:
return False
q = json.loads(q)
config = {
"import_executable": bool(int(q["config"]["Import Executable"])),
"mitre_attack": bool(int(q["config"]["Mitre Att&ck"])),
}
data = base64.b64decode(q.get("data")).decode("utf-8")
if not data:
return json.dumps({"success": 0})
joe_parser = JoeParser(config)
joe_parser.parse_data(json.loads(data)["analysis"])
joe_parser.finalize_results()
return {"results": joe_parser.results}
def introspection():
modulesetup = {}
try:
userConfig
modulesetup["userConfig"] = userConfig
except NameError:
pass
try:
inputSource
modulesetup["inputSource"] = inputSource
except NameError:
pass
modulesetup["format"] = "misp_standard"
return modulesetup
def version():
moduleinfo["config"] = moduleconfig
return moduleinfo