diff --git a/analyzers/MISP/misp.py b/analyzers/MISP/misp.py index 93eba751e..35c208d95 100755 --- a/analyzers/MISP/misp.py +++ b/analyzers/MISP/misp.py @@ -8,10 +8,16 @@ class MISPAnalyzer(Analyzer): def __init__(self): Analyzer.__init__(self) + + # Fixes #94. Instead of None, the string Unnamed should be passed to MISPClient constructor + name = self.getParam('config.name', None) + if not name: + name = 'Unnamed' + self.misp = MISPClient(url=self.getParam('config.url', None, 'No MISP url given.'), key=self.getParam('config.key', None, 'No MISP api key given.'), ssl=self.getParam('config.certpath', True), - name=self.getParam('config.name', None)) + name=name) def summary(self, raw): taxonomies = [] @@ -27,7 +33,7 @@ def summary(self, raw): data.append(res['uuid']) # return number of unique events - if data == []: + if not data: value = "\"0 event\"" taxonomies.append(self.build_taxonomy(level, namespace, predicate, value)) else: @@ -36,8 +42,6 @@ def summary(self, raw): return {"taxonomies": taxonomies} - - def run(self): if self.data_type == 'hash': response = self.misp.search_hash(self.getData()) @@ -58,5 +62,6 @@ def run(self): self.report({'results': response}) + if __name__ == '__main__': MISPAnalyzer().run() diff --git a/analyzers/MISP/mispclient.py b/analyzers/MISP/mispclient.py index 8d9c08510..60dda63f6 100755 --- a/analyzers/MISP/mispclient.py +++ b/analyzers/MISP/mispclient.py @@ -132,14 +132,14 @@ def __clean_relatedevent(self, related_events): response = [] for event in related_events: - ev = {} - ev['info'] = event['Event']['info'] - ev['id'] = event['Event']['id'] + ev = { + 'info': event['Event']['info'], + 'id': event['Event']['id'] + } response.append(ev) return response - def __clean_event(self, misp_event): """ Strip event data for lighter output. Analyer report only contains useful data. @@ -171,7 +171,6 @@ def __clean_event(self, misp_event): if 'RelatedEvent' in misp_event: misp_event['RelatedEvent'] = self.__clean_relatedevent(misp_event['RelatedEvent']) - return misp_event def __clean(self, misp_response): @@ -200,8 +199,15 @@ def __search(self, value, type_attribute): raise EmptySearchtermError for idx, connection in enumerate(self.misp_connections): misp_response = connection.search(type_attribute=type_attribute, values=value) + + # Fixes #94 + if isinstance(self.misp_name, list): + name = self.misp_name[idx] + else: + name = self.misp_name + results.append({'url': connection.root_url, - 'name': self.misp_name[idx], + 'name': name, 'result': self.__clean(misp_response)}) return results