Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Merging next to main for release 2.2.2 #13

Merged
merged 5 commits into from
Aug 20, 2024
Merged

Merging next to main for release 2.2.2 #13

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
5c129bd
PAPP-34531 MISP: Feature - Tags Allowance Added for Event Create and …
grokas-splunk Aug 19, 2024
53514cf
Bumped up the version of misp from 2.2.1 to 2.2.2
Aug 19, 2024
d62a812
Release notes for version 2.2.2
Aug 19, 2024
2402cdb
Release notes for version 2.2.2
Aug 19, 2024
48f1aa2
[maint] update min phantom version (#14)
grokas-splunk Aug 19, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 8 additions & 2 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,11 +2,11 @@
# MISP

Publisher: Splunk
Connector Version: 2.2.1
Connector Version: 2.2.2
Product Vendor: MISP
Product Name: MISP
Product Version Supported (regex): ".\*"
Minimum Product Version: 5.2.0
Minimum Product Version: 6.2.1

Take action with Malware Information Sharing Platform

Expand Down Expand Up @@ -156,6 +156,7 @@ PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
**source_emails** | optional | Source email addresses to be added as attributes | string | `email`
**dest_emails** | optional | Destination email addresses to be added as attributes | string | `email`
**urls** | optional | URLs to be added as attributes | string | `url`
**tags** | optional | Comma separated list of tags | string |
**json** | optional | JSON key value list of attributes | string |

#### Action Output
Expand All @@ -175,6 +176,7 @@ action_result.parameter.source_ips | string | `ip` | 122.122.122.122
action_result.parameter.threat_level_id | string | | undefined
action_result.parameter.to_ids | boolean | | True False
action_result.parameter.urls | string | `url` | https://test.com
action_result.parameter.tags | string | | test_1,test_2
action_result.data.\*.Org.id | string | | 1
action_result.data.\*.Org.local | boolean | | True False
action_result.data.\*.Org.name | string | | ORGNAME
Expand Down Expand Up @@ -236,6 +238,8 @@ PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
**source_emails** | optional | Source email addresses to be added as attributes | string | `email`
**dest_emails** | optional | Destination email addresses to be added as attributes | string | `email`
**urls** | optional | URLs to be added as attributes | string | `url`
**tags** | optional | Comma separated list of tags (append to existing tags default) | string |
**replace_tags** | optional | Replace tags with new provided tags | boolean |
**json** | optional | JSON key value list of attributes | string |

#### Action Output
Expand All @@ -246,6 +250,8 @@ action_result.parameter.dest_emails | string | `email` | [email protected]
action_result.parameter.dest_ips | string | `ip` | 122.122.122.122
action_result.parameter.domains | string | `domain` | www.test.com
action_result.parameter.event_id | numeric | `misp event id` | 686
action_result.parameter.tags | string | | test_1,test2
action_result.parameter.replace_tags | boolean | | True False
action_result.parameter.json | string | | {"comment":["email_1,email11","email_2"], "soufds":"jflkl"}
action_result.parameter.source_emails | string | `email` | [email protected]
action_result.parameter.source_ips | string | `ip` | 122.122.122.122
Expand Down
50 changes: 44 additions & 6 deletions misp.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,12 +7,12 @@
"type": "threat intel",
"license": "Copyright (c) 2017-2024 Splunk Inc.",
"main_module": "misp_connector.py",
"app_version": "2.2.1",
"utctime_updated": "2022-02-03T21:33:46.000000Z",
"app_version": "2.2.2",
"utctime_updated": "2024-08-19T20:43:28.000000Z",
"product_vendor": "MISP",
"product_name": "MISP",
"product_version_regex": ".*",
"min_phantom_version": "5.2.0",
"min_phantom_version": "6.2.1",
"fips_compliant": true,
"python_version": "3",
"latest_tested_versions": [
Expand Down Expand Up @@ -238,10 +238,15 @@
"order": 11,
"primary": true
},
"tags": {
"description": "Comma separated list of tags",
"data_type": "string",
"order": 12
},
"json": {
"description": "JSON key value list of attributes",
"data_type": "string",
"order": 12
"order": 13
}
},
"render": {
Expand Down Expand Up @@ -370,6 +375,13 @@
"https://test.com"
]
},
{
"data_path": "action_result.parameter.tags",
"data_type": "string",
"example_values": [
"test_1,test_2"
]
},
{
"data_path": "action_result.data.*.Org.id",
"data_type": "string",
Expand Down Expand Up @@ -750,10 +762,21 @@
"order": 7,
"primary": true
},
"tags": {
"description": "Comma separated list of tags (append to existing tags default)",
"data_type": "string",
"order": 8
},
"replace_tags": {
"description": "Replace tags with new provided tags",
"data_type": "boolean",
"default": false,
"order": 9
},
"json": {
"description": "JSON key value list of attributes",
"data_type": "string",
"order": 8
"order": 10
}
},
"render": {
Expand Down Expand Up @@ -811,6 +834,21 @@
686
]
},
{
"data_path": "action_result.parameter.tags",
"data_type": "string",
"example_values": [
"test_1,test2"
]
},
{
"data_path": "action_result.parameter.replace_tags",
"data_type": "boolean",
"example_values": [
true,
false
]
},
{
"data_path": "action_result.parameter.json",
"data_type": "string",
Expand Down Expand Up @@ -2422,4 +2460,4 @@
}
]
}
}
}
26 changes: 26 additions & 0 deletions misp_connector.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -296,6 +296,16 @@ def _create_event(self, param):

action_result.set_summary({"message": "Event created with id: {0}".format(self._event.id)})

tags = param.get("tags", "")
tag_list = [tag.strip() for tag in tags.split(",")] if tags else []
if tag_list:
try:
for tag in tag_list:
self._misp.tag(self._event, tag)
except Exception as e:
error_message = self._get_error_message_from_exception(e)
return action_result.set_status(phantom.APP_ERROR, "Failed to add tags to MISP event:{0}".format(error_message))

addAttributes = param.get("add_attributes", True)
if addAttributes:
ret_val = self._perform_adds(param, action_result, add_data=True)
Expand Down Expand Up @@ -483,6 +493,22 @@ def _add_attributes(self, param):
for attribute in attributes:
action_result.add_data(attribute)

tags = param.get("tags", "")
replace_tags = param.get("replace_tags", False)
tag_list = [tag.strip() for tag in tags.split(",")] if tags else []
if tag_list:
try:
if replace_tags:
existing_tags = self._event.tags
for tag in existing_tags:
self._misp.untag(self._event, tag.name)

for tag in tag_list:
self._misp.tag(self._event, tag)
except Exception as e:
error_message = self._get_error_message_from_exception(e)
return action_result.set_status(phantom.APP_ERROR, "Failed to add tags to MISP event:{0}".format(error_message))

if hasattr(self._event, "id"):
summary = {}
summary["message"] = "Attributes added to event: {0}".format(self._event.id)
Expand Down
1 change: 1 addition & 0 deletions release_notes/2.2.2.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
* Tags can now be added during an event create or update [PAPP-34531]
Loading