Skip to content

Commit 2696ebc

Browse files
aleksejsvaleksejsv
committed
MISP plugin added
1 parent f1f7dd1 commit 2696ebc

17 files changed

+1522
-58
lines changed

‎.gitignore

+2-4
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,5 @@
1-
certs/graph.*
2-
certs/graph-*
3-
certs/certca2.crt
4-
certs/cluster.crt
1+
certs/*
2+
!certs/graphoscope.*
53
definitions/*.yaml
64
!definitions/sources/*.example
75
!definitions/processors/*.example

‎Dockerfile.example

+2-1
Original file line numberDiff line numberDiff line change
@@ -29,11 +29,12 @@ RUN go build -buildmode=plugin -ldflags="-w" -o /go/plugins/sources/elasticsearc
2929
RUN go build -buildmode=plugin -ldflags="-w" -o /go/plugins/sources/http.so plugins/src/http/*.go
3030
RUN go build -buildmode=plugin -ldflags="-w" -o /go/plugins/sources/rest.so plugins/src/rest/*.go
3131
RUN go build -buildmode=plugin -ldflags="-w" -o /go/plugins/sources/mongodb.so plugins/src/mongodb/*.go
32-
RUN go build -buildmode=plugin -ldflags="-w" -o /go/plugins/sources/pastelyzer.so plugins/src/pastelyzer/*.go
3332
RUN go build -buildmode=plugin -ldflags="-w" -o /go/plugins/sources/postgresql.so plugins/src/postgresql/*.go
3433
RUN go build -buildmode=plugin -ldflags="-w" -o /go/plugins/sources/redis.so plugins/src/redis/*.go
3534
RUN go build -buildmode=plugin -ldflags="-w" -o /go/plugins/sources/mysql.so plugins/src/mysql/*.go
3635
RUN go build -buildmode=plugin -ldflags="-w" -o /go/plugins/sources/file-csv.so plugins/src/file/csv/*.go
36+
RUN go build -buildmode=plugin -ldflags="-w" -o /go/plugins/sources/misp.so plugins/src/misp/*.go
37+
RUN go build -buildmode=plugin -ldflags="-w" -o /go/plugins/sources/pastelyzer.so plugins/src/pastelyzer/*.go
3738
RUN go build -buildmode=plugin -ldflags="-w" -o /go/plugins/sources/abuseipdb.so plugins/src/abuseipdb/*.go
3839
RUN go build -buildmode=plugin -ldflags="-w" -o /go/plugins/sources/hashlookup.so plugins/src/hashlookup/*.go
3940
RUN go build -buildmode=plugin -ldflags="-w" -o /go/plugins/sources/circl_passive_ssl.so plugins/src/circl_passive_ssl/*.go

‎Makefile.example

+18-15
Original file line numberDiff line numberDiff line change
@@ -170,22 +170,23 @@ uninstall-remote:
170170

171171
# Build plugins locally, mainly for development
172172
plugins-local:
173-
go build -buildmode=plugin -ldflags="-w" -o plugins/sources/elasticsearch.v7.so plugins/src/elasticsearch.v7/*.go
174-
go build -buildmode=plugin -ldflags="-w" -o plugins/sources/http.so plugins/src/http/*.go
175-
go build -buildmode=plugin -ldflags="-w" -o plugins/sources/rest.so plugins/src/rest/*.go
176-
go build -buildmode=plugin -ldflags="-w" -o plugins/sources/mongodb.so plugins/src/mongodb/*.go
177-
go build -buildmode=plugin -ldflags="-w" -o plugins/sources/pastelyzer.so plugins/src/pastelyzer/*.go
178-
go build -buildmode=plugin -ldflags="-w" -o plugins/sources/postgresql.so plugins/src/postgresql/*.go
179-
go build -buildmode=plugin -ldflags="-w" -o plugins/sources/redis.so plugins/src/redis/*.go
180-
go build -buildmode=plugin -ldflags="-w" -o plugins/sources/mysql.so plugins/src/mysql/*.go
181-
go build -buildmode=plugin -ldflags="-w" -o plugins/sources/file-csv.so plugins/src/file/csv/*.go
182-
go build -buildmode=plugin -ldflags="-w" -o plugins/sources/abuseipdb.so plugins/src/abuseipdb/*.go
183-
go build -buildmode=plugin -ldflags="-w" -o plugins/sources/hashlookup.so plugins/src/hashlookup/*.go
173+
go build -buildmode=plugin -ldflags="-w" -o plugins/sources/elasticsearch.v7.so plugins/src/elasticsearch.v7/*.go
174+
go build -buildmode=plugin -ldflags="-w" -o plugins/sources/http.so plugins/src/http/*.go
175+
go build -buildmode=plugin -ldflags="-w" -o plugins/sources/rest.so plugins/src/rest/*.go
176+
go build -buildmode=plugin -ldflags="-w" -o plugins/sources/mongodb.so plugins/src/mongodb/*.go
177+
go build -buildmode=plugin -ldflags="-w" -o plugins/sources/postgresql.so plugins/src/postgresql/*.go
178+
go build -buildmode=plugin -ldflags="-w" -o plugins/sources/redis.so plugins/src/redis/*.go
179+
go build -buildmode=plugin -ldflags="-w" -o plugins/sources/mysql.so plugins/src/mysql/*.go
180+
go build -buildmode=plugin -ldflags="-w" -o plugins/sources/file-csv.so plugins/src/file/csv/*.go
181+
go build -buildmode=plugin -ldflags="-w" -o plugins/sources/misp.so plugins/src/misp/*.go
182+
go build -buildmode=plugin -ldflags="-w" -o plugins/sources/pastelyzer.so plugins/src/pastelyzer/*.go
183+
go build -buildmode=plugin -ldflags="-w" -o plugins/sources/abuseipdb.so plugins/src/abuseipdb/*.go
184+
go build -buildmode=plugin -ldflags="-w" -o plugins/sources/hashlookup.so plugins/src/hashlookup/*.go
184185
go build -buildmode=plugin -ldflags="-w" -o plugins/sources/circl_passive_ssl.so plugins/src/circl_passive_ssl/*.go
185186
CGO_CFLAGS="-g -O2 -Wno-return-local-addr" go build -buildmode=plugin -ldflags="-w" -o plugins/sources/sqlite.so plugins/src/sqlite/*.go
186187

187-
go build -buildmode=plugin -ldflags="-w" -o plugins/processors/taxonomy.so plugins/src/taxonomy/*.go
188-
go build -buildmode=plugin -ldflags="-w" -o plugins/processors/modify.so plugins/src/modify/*.go
188+
go build -buildmode=plugin -ldflags="-w" -o plugins/processors/taxonomy.so plugins/src/taxonomy/*.go
189+
go build -buildmode=plugin -ldflags="-w" -o plugins/processors/modify.so plugins/src/modify/*.go
189190

190191
go build -buildmode=plugin -ldflags="-w" -o /dev/null plugins/src/template/*.go
191192

@@ -195,21 +196,23 @@ test:
195196
go test plugins/src/http/*.go
196197
go test plugins/src/rest/*.go
197198
go test plugins/src/mongodb/*.go
198-
go test plugins/src/pastelyzer/*.go
199199
go test plugins/src/postgresql/*.go
200200
go test plugins/src/redis/*.go
201201
go test plugins/src/mysql/*.go
202202
go test plugins/src/file/csv/*.go
203+
go test plugins/src/misp/*.go
204+
go test plugins/src/pastelyzer/*.go
203205
go test plugins/src/abuseipdb/*.go
204206
go test plugins/src/hashlookup/*.go
205207
go test plugins/src/circl_passive_ssl/*.go
206208
CGO_CFLAGS="-g -O2 -Wno-return-local-addr" go test plugins/src/sqlite/*.go
207209

208210
go test plugins/src/taxonomy/*.go
211+
go test plugins/src/modify/*.go
209212

210213
# Check for Golang errors & inefficient code. Install with:
211214
# curl -sfL https://install.goreleaser.com/github.com/golangci/golangci-lint.sh | sh
212215
# mv bin/golangci-lint "$GOPATH/bin/" && rm -rf bin
213216
lint:
214-
golangci-lint run --enable=golint --enable=gosec --enable=maligned --enable=prealloc --skip-dirs "(ideas)" ./...
217+
golangci-lint run --timeout=2m --enable=revive --enable=gosec --enable=govet --enable=prealloc --exclude-dirs "(ideas)" ./...
215218
# golint .

‎README.md

+2-1
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,7 @@ Available plugins are in [plugins/src](plugins/src):
8888
- AbuseIPDB
8989
- Hashlookup
9090
- CIRCL Passive SSL
91+
- MISP
9192

9293
3rd party compiled `*.so` plugins should be placed in [plugins/sources](plugins/sources) directory.
9394

@@ -199,14 +200,14 @@ Response example for the first query:
199200
- [ ] Implement other SQL features, like `NOT BETWEEN`
200201
- [ ] Filters `Edit` button doesn't work if data source is not available any more
201202
- [ ] API can return an image instead of JSON
203+
- [ ] Use the official package for the Elasticsearch plugin
202204
- [ ] Data source plugins:
203205
- [ ] RTIR
204206
- [ ] MS SQL
205207
- [ ] Oracle SQL
206208
- [ ] Apache Cassandra
207209
- [ ] Genji
208210
- [ ] Presto
209-
- [ ] MISP
210211
- [ ] VirusTotal
211212
- [ ] Shodan
212213
- [ ] General TCP

‎VERSION

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
2.5.7
1+
2.5.8

‎assets/js/graph.js

+6-1
Original file line numberDiff line numberDiff line change
@@ -572,8 +572,13 @@ class Graph {
572572

573573
for (var i = 0; i < selected.length; i++) {
574574
const node = this.application.graph.network.body.nodes[selected[i]];
575-
this.application.search.query('FROM ' + source + ' WHERE ' + node.options.search + '=\'' + node.options.attributes[node.options.group] + '\'');
576575

576+
if (node.options.search === '') {
577+
this.application.modal.error('Can not expand graph!', 'Search for this node type is not supported yet!');
578+
return;
579+
}
580+
581+
this.application.search.query('FROM ' + source + ' WHERE ' + node.options.search + '=\'' + node.options.attributes[node.options.group] + '\'');
577582
console.log('Expanding by', node.options.search, '=', node.id, 'from', source);
578583
}
579584
}

‎assets/js/sql-autocomplete.js

+3-3
Original file line numberDiff line numberDiff line change
@@ -78,15 +78,15 @@ class SQLAutocomplete {
7878
option.innerHTML = '<strong>' + field.substr(0, word.length) + '</strong>';
7979
option.innerHTML += field.substr(word.length);
8080

81-
// Insert a data attribute that will hold the current array item's value
81+
// Insert data attribute that will hold current array item's value
8282
option.dataset.field = field;
8383

8484
// Execute a function when someone clicks on the item value (DIV element)
8585
option.addEventListener('click', (e) => {
8686
let value = option.dataset.field;
8787

88-
// If field contains "-" character - backticks mush be added
89-
if (value.includes('-'))
88+
// If field name contains special characters - backticks must be added
89+
if (value.includes('-') || value.includes('|') || value.includes('/'))
9090
value = '`' + value + '`';
9191

9292
// Insert the value for the autocomplete text field

‎go.mod

+10-10
Original file line numberDiff line numberDiff line change
@@ -5,25 +5,26 @@ go 1.22
55
toolchain go1.22.2
66

77
require (
8+
github.com/0xrawsec/golang-utils v1.1.8
89
github.com/Jeffail/gabs/v2 v2.7.0
910
github.com/blastrain/vitess-sqlparser v0.0.0-20201030050434-a139afbb1aba
1011
github.com/georgysavva/scany v1.2.1
1112
github.com/go-sql-driver/mysql v1.7.1
1213
github.com/google/uuid v1.6.0
1314
github.com/gorilla/securecookie v1.1.2
14-
github.com/gorilla/sessions v1.2.2
15-
github.com/gorilla/websocket v1.5.1
15+
github.com/gorilla/sessions v1.3.0
16+
github.com/gorilla/websocket v1.5.3
1617
github.com/jackc/pgx/v4 v4.18.1
1718
github.com/mattn/go-sqlite3 v1.14.20
1819
github.com/mithrandie/csvq-driver v1.7.0
1920
github.com/olekukonko/tablewriter v0.0.5
2021
github.com/olivere/elastic/v7 v7.0.32
2122
github.com/redis/go-redis/v9 v9.4.0
22-
github.com/rs/zerolog v1.32.0
23+
github.com/rs/zerolog v1.33.0
2324
github.com/umpc/go-sortedmap v0.0.0-20180422175548-64ab94c482f4
2425
github.com/yukithm/json2csv v0.1.2
25-
go.mongodb.org/mongo-driver v1.15.0
26-
golang.org/x/crypto v0.22.0
26+
go.mongodb.org/mongo-driver v1.15.1
27+
golang.org/x/crypto v0.24.0
2728
golang.org/x/sync v0.7.0
2829
gopkg.in/natefinch/lumberjack.v2 v2.2.1
2930
gopkg.in/yaml.v3 v3.0.1
@@ -43,7 +44,7 @@ require (
4344
github.com/jackc/puddle v1.3.0 // indirect
4445
github.com/josharian/intern v1.0.0 // indirect
4546
github.com/juju/errors v1.0.0 // indirect
46-
github.com/klauspost/compress v1.17.8 // indirect
47+
github.com/klauspost/compress v1.17.9 // indirect
4748
github.com/mailru/easyjson v0.7.7 // indirect
4849
github.com/mattn/go-colorable v0.1.13 // indirect
4950
github.com/mattn/go-isatty v0.0.20 // indirect
@@ -60,8 +61,7 @@ require (
6061
github.com/xdg-go/scram v1.1.2 // indirect
6162
github.com/xdg-go/stringprep v1.0.4 // indirect
6263
github.com/youmark/pkcs8 v0.0.0-20240424034433-3c2c7870ae76 // indirect
63-
golang.org/x/net v0.24.0 // indirect
64-
golang.org/x/sys v0.19.0 // indirect
65-
golang.org/x/term v0.19.0 // indirect
66-
golang.org/x/text v0.14.0 // indirect
64+
golang.org/x/sys v0.21.0 // indirect
65+
golang.org/x/term v0.21.0 // indirect
66+
golang.org/x/text v0.16.0 // indirect
6767
)

0 commit comments

Comments
 (0)