|
| 1 | +import json |
| 2 | +import pymisp |
| 3 | +from pymisp import MISPAttribute, MISPEvent, MISPObject |
| 4 | +from trustar import TruStar |
| 5 | + |
| 6 | +misperrors = {'error': "Error"} |
| 7 | +mispattributes = { |
| 8 | + 'input': ["btc", "domain", "email-src", "filename", "hostname", "ip-src", "ip-dst", "malware-type", "md5", "sha1", |
| 9 | + "sha256", "url"], 'format': 'misp_standard'} |
| 10 | + |
| 11 | +moduleinfo = {'version': "0.1", 'author': "Jesse Hedden", |
| 12 | + 'description': "Enrich data with TruSTAR", |
| 13 | + 'module-type': ["hover", "expansion"]} |
| 14 | + |
| 15 | +moduleconfig = ["user_api_key", "user_api_secret", "enclave_ids"] |
| 16 | + |
| 17 | +MAX_PAGE_SIZE = 100 # Max allowable page size returned from /1.3/indicators/summaries endpoint |
| 18 | + |
| 19 | + |
| 20 | +class TruSTARParser: |
| 21 | + ENTITY_TYPE_MAPPINGS = { |
| 22 | + 'BITCOIN_ADDRESS': "btc", |
| 23 | + 'CIDR_BLOCK': "ip-src", |
| 24 | + 'CVE': "vulnerability", |
| 25 | + 'URL': "url", |
| 26 | + 'EMAIL_ADDRESS': "email-src", |
| 27 | + 'SOFTWARE': "filename", |
| 28 | + 'IP': "ip-src", |
| 29 | + 'MALWARE': "malware-type", |
| 30 | + 'MD5': "md5", |
| 31 | + 'REGISTRY_KEY': "regkey", |
| 32 | + 'SHA1': "sha1", |
| 33 | + 'SHA256': "sha256" |
| 34 | + } |
| 35 | + |
| 36 | + REPORT_BASE_URL = "https://station.trustar.co/constellation/reports/{}" |
| 37 | + |
| 38 | + CLIENT_METATAG = "MISP-{}".format(pymisp.__version__) |
| 39 | + |
| 40 | + def __init__(self, attribute, config): |
| 41 | + config['enclave_ids'] = config.get('enclave_ids', "").strip().split(',') |
| 42 | + config['client_metatag'] = self.CLIENT_METATAG |
| 43 | + self.ts_client = TruStar(config=config) |
| 44 | + |
| 45 | + self.misp_event = MISPEvent() |
| 46 | + self.misp_attribute = MISPAttribute() |
| 47 | + self.misp_attribute.from_dict(**attribute) |
| 48 | + self.misp_event.add_attribute(**self.misp_attribute) |
| 49 | + |
| 50 | + def get_results(self): |
| 51 | + """ |
| 52 | + Returns the MISP Event enriched with TruSTAR indicator summary data. |
| 53 | + """ |
| 54 | + event = json.loads(self.misp_event.to_json()) |
| 55 | + results = {key: event[key] for key in ('Attribute', 'Object') if (key in event and event[key])} |
| 56 | + return {'results': results} |
| 57 | + |
| 58 | + def generate_trustar_links(self, entity_value): |
| 59 | + """ |
| 60 | + Generates links to TruSTAR reports if they exist. |
| 61 | +
|
| 62 | + :param entity_value: <str> Value of entity. |
| 63 | + """ |
| 64 | + report_links = list() |
| 65 | + trustar_reports = self.ts_client.search_reports(entity_value) |
| 66 | + for report in trustar_reports: |
| 67 | + report_links.append(self.REPORT_BASE_URL.format(report.id)) |
| 68 | + |
| 69 | + return report_links |
| 70 | + |
| 71 | + def parse_indicator_summary(self, summaries): |
| 72 | + """ |
| 73 | + Converts a response from the TruSTAR /1.3/indicators/summaries endpoint |
| 74 | + a MISP trustar_report object and adds the summary data and links as attributes. |
| 75 | +
|
| 76 | + :param summaries: <generator> A TruSTAR Python SDK Page.generator object for generating |
| 77 | + indicator summaries pages. |
| 78 | + """ |
| 79 | + |
| 80 | + for summary in summaries: |
| 81 | + trustar_obj = MISPObject('trustar_report') |
| 82 | + indicator_type = summary.indicator_type |
| 83 | + indicator_value = summary.value |
| 84 | + if indicator_type in self.ENTITY_TYPE_MAPPINGS: |
| 85 | + trustar_obj.add_attribute(indicator_type, attribute_type=self.ENTITY_TYPE_MAPPINGS[indicator_type], |
| 86 | + value=indicator_value) |
| 87 | + trustar_obj.add_attribute("INDICATOR_SUMMARY", attribute_type="text", |
| 88 | + value=json.dumps(summary.to_dict(), sort_keys=True, indent=4)) |
| 89 | + report_links = self.generate_trustar_links(indicator_value) |
| 90 | + for link in report_links: |
| 91 | + trustar_obj.add_attribute("REPORT_LINK", attribute_type="link", value=link) |
| 92 | + self.misp_event.add_object(**trustar_obj) |
| 93 | + |
| 94 | + |
| 95 | +def handler(q=False): |
| 96 | + """ |
| 97 | + MISP handler function. A user's API key and secret will be retrieved from the MISP |
| 98 | + request and used to create a TruSTAR API client. If enclave IDs are provided, only |
| 99 | + those enclaves will be queried for data. Otherwise, all of the enclaves a user has |
| 100 | + access to will be queried. |
| 101 | + """ |
| 102 | + |
| 103 | + if q is False: |
| 104 | + return False |
| 105 | + |
| 106 | + request = json.loads(q) |
| 107 | + |
| 108 | + config = request.get('config', {}) |
| 109 | + if not config.get('user_api_key') or not config.get('user_api_secret'): |
| 110 | + misperrors['error'] = "Your TruSTAR API key and secret are required for indicator enrichment." |
| 111 | + return misperrors |
| 112 | + |
| 113 | + attribute = request['attribute'] |
| 114 | + trustar_parser = TruSTARParser(attribute, config) |
| 115 | + |
| 116 | + try: |
| 117 | + summaries = list( |
| 118 | + trustar_parser.ts_client.get_indicator_summaries([attribute['value']], page_size=MAX_PAGE_SIZE)) |
| 119 | + except Exception as e: |
| 120 | + misperrors['error'] = "Unable to retrieve TruSTAR summary data: {}".format(e) |
| 121 | + return misperrors |
| 122 | + |
| 123 | + trustar_parser.parse_indicator_summary(summaries) |
| 124 | + return trustar_parser.get_results() |
| 125 | + |
| 126 | + |
| 127 | +def introspection(): |
| 128 | + return mispattributes |
| 129 | + |
| 130 | + |
| 131 | +def version(): |
| 132 | + moduleinfo['config'] = moduleconfig |
| 133 | + return moduleinfo |
0 commit comments