Skip to content

Commit

Permalink
#28 Initialize MISP modules at Cortex startup in a separate thread
Browse files Browse the repository at this point in the history
  • Loading branch information
To-om committed May 22, 2017
1 parent f5be8e2 commit 4dcb6b9
Showing 1 changed file with 31 additions and 26 deletions.
57 changes: 31 additions & 26 deletions app/services/MispSrv.scala
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,8 @@ import play.api.libs.json.{ Json, _ }
import play.api.{ Configuration, Logger }

import scala.collection.JavaConverters._
import scala.concurrent.{ ExecutionContext, Future }
import scala.concurrent.{ Await, ExecutionContext, Future }
import scala.concurrent.duration._
import scala.sys.process._
import scala.util.{ Failure, Success, Try }

Expand Down Expand Up @@ -42,25 +43,32 @@ class MispSrv(

logger.info(s"MISP modules is ${if (mispModulesEnabled) "enabled" else "disabled"}, loader is $loaderCommand")

lazy val list: Seq[MispModule] = if (mispModulesEnabled) {
Json.parse(s"$loaderCommand --list".!!)
.as[Seq[String]]
.map { moduleName
moduleName (for {
moduleInfo Try(Json.parse(s"$loaderCommand --info $moduleName".!!))
module Try(moduleInfo.as[MispModule](reads(loaderCommand, mispModuleConfig)))
} yield module)
}
.flatMap {
case (moduleName, Failure(error))
logger.warn(s"Load MISP module $moduleName fails", error)
private[MispSrv] val futureList: Future[Seq[MispModule]] = Future {
if (mispModulesEnabled) {
Json.parse(s"$loaderCommand --list".!!)
.asOpt[Seq[String]]
.getOrElse {
logger.warn("MISP modules loader returns invalid data")
Nil
case (_, Success(module))
logger.info(s"Register MISP module ${module.name} ${module.version}")
Seq(module)
}
}
else Nil
}
.map { moduleName
moduleName (for {
moduleInfo Try(Json.parse(s"$loaderCommand --info $moduleName".!!))
module Try(moduleInfo.as[MispModule](reads(loaderCommand, mispModuleConfig)))
} yield module)
}
.flatMap {
case (moduleName, Failure(error))
logger.warn(s"Load MISP module $moduleName fails: ${error.getMessage}")
Nil
case (_, Success(module))
logger.info(s"Register MISP module ${module.name} ${module.version}")
Seq(module)
}
}
else Nil
}(analyzeExecutionContext)
lazy val list: Seq[MispModule] = Await.result(futureList, 5.minutes)

def get(moduleName: String): Option[MispModule] = list.find(_.name == moduleName)

Expand Down Expand Up @@ -149,7 +157,7 @@ class MispSrv(

private def toArtifact(mispType: String, data: String): Artifact = {
mispType2dataType(mispType) match {
case "file" if mispType == "malware-sample" ???
case "file" if mispType == "malware-sample" ??? // TODO
case "file" FileArtifact(Base64.decodeBase64(data), Json.obj(
"tlp" 1,
"dataType" "file"))
Expand Down Expand Up @@ -188,8 +196,7 @@ class MispSrv(
Json.obj(
"types" dataType2mispType(artifact.dataType),
"values" Json.arr(artifact.data))
case artifact: FileArtifact
??? // TODO
case artifact: FileArtifact ??? // TODO
}
val cortexAttribute = Json.obj(
"types" Seq("cortex"),
Expand Down Expand Up @@ -229,10 +236,8 @@ class MispSrv(
requiredConfig (__ \ "config").read[Set[String]]
missingConfig = requiredConfig -- config.keys
_ if (missingConfig.nonEmpty) {
val message = s"MISP module $name is disabled because the following configuration " +
s"item${if (missingConfig.size > 1) "s are" else " is"} missing: ${missingConfig.mkString(", ")}"
logger.warn(message)
Reads[Unit](_ JsError(message))
Reads[Unit](_ JsError(s"MISP module $name is disabled because the following configuration " +
s"item${if (missingConfig.size > 1) "s are" else " is"} missing: ${missingConfig.mkString(", ")}"))
}
else {
Reads[Unit](_ JsSuccess(()))
Expand Down

0 comments on commit 4dcb6b9

Please sign in to comment.