Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

WIP: CybOX #107

Closed
wants to merge 6 commits into from
Closed

WIP: CybOX #107

Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
70a00b6
PEP8 readability fixes
Jan 8, 2015
889c7f7
Dependency and shim
Jan 8, 2015
054625d
Initial naive implementation of CybOX for IPv4
Jan 8, 2015
d1ffc8b
Ignore our growing collection of data files
Jan 8, 2015
daff83c
Fix merge conflicts from 0.1.2
Jan 8, 2015
f6abd8b
Fix merge conflict
Jan 9, 2015
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 27 additions & 3 deletions baler.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,9 @@
import unicodecsv
import threading
from logger import get_logger

from cybox.core import Observable
from cybox.objects.address_object import Address
from Queue import Queue

logger = get_logger('baler')
Expand Down Expand Up @@ -136,7 +139,8 @@ def bale_CRITs_indicator(base_url, data, indicator_que):
if not res.status_code in [201, 200, 400]:
logger.info("Issues with adding: %s" % data['domain'])
else:
logger.info("don't yet know what to do with: %s[%s]" % (indicator[1], indicator[0]))
logger.info("don't yet know what to do with: %s[%s]" % (indicator[1],
indicator[0]))


def bale_CRITs(harvest, filename):
Expand Down Expand Up @@ -198,6 +202,22 @@ def bale_CRITs(harvest, filename):
(total_iocs, maxThreads, time.time() - start_time))


def bale_cybox(harvest, filename):
logger.info('Output regular data as CybOX to %s' % filename)
for indicator in harvest:
if indicator[1] == "IPv4":
addr = Address()
addr.address_value = indicator[0]
addr.category = 'ipv4-addr'
if indicator[2] == 'inbound':
addr.is_source = True
else:
addr.is_destination = True
obs = Observable(addr)
with open(filename, 'a') as f:
f.write(obs.to_xml(include_namespaces=False))


def bale(input_file, output_file, output_format, is_regular):
config = ConfigParser.SafeConfigParser()
cfg_success = config.read('combine.cfg')
Expand All @@ -212,9 +232,13 @@ def bale(input_file, output_file, output_format, is_regular):

# TODO: also need plugins here (cf. #23)
if is_regular:
format_funcs = {'csv': bale_reg_csv, 'crits': bale_CRITs}
format_funcs = {'csv': bale_reg_csv,
'cybox': bale_cybox,
'crits': bale_CRITs}
else:
format_funcs = {'csv': bale_enr_csv, 'crits': bale_CRITs}
format_funcs = {'csv': bale_enr_csv,
'cybox': bale_cybox,
'crits': bale_CRITs}
format_funcs[output_format](harvest, output_file)

if __name__ == "__main__":
Expand Down