diff --git a/cs_misp_import/intel_client.py b/cs_misp_import/intel_client.py index 6b4f3b9..b67fa4f 100644 --- a/cs_misp_import/intel_client.py +++ b/cs_misp_import/intel_client.py @@ -52,7 +52,11 @@ def __init__(self, self.valid_report_types = [x.name.lower() for x in ReportType] self.request_size_limit = api_request_max self.log = logger - + + def get_report_pdf(self, report_id): + return self.falcon.get_report_pdf(report_id) + + def get_reports(self, start_time, report_filter: str = None): """Get all the reports that were updated after a certain moment in time (UNIX). diff --git a/cs_misp_import/report_type.py b/cs_misp_import/report_type.py index 9009d7e..9dc75d4 100644 --- a/cs_misp_import/report_type.py +++ b/cs_misp_import/report_type.py @@ -15,6 +15,8 @@ class ReportType(Enum): CSMR = "Monthly Report" CSTA = "Threat Assessment" CSWR = "Weekly Report" + CSECR = "Courtesy Report" + CSID = "Intrusion Digest" NOTICE = "Notice" GTAC = "Unmapped" TEST = "Test Report" diff --git a/cs_misp_import/reports.py b/cs_misp_import/reports.py index b097c83..e97f9f1 100644 --- a/cs_misp_import/reports.py +++ b/cs_misp_import/reports.py @@ -15,6 +15,7 @@ from logging import Logger import os import time +from io import BytesIO import concurrent.futures try: from pymisp import MISPObject, MISPEvent, MISPAttribute, ExpandedPyMISP, PyMISPError @@ -523,22 +524,34 @@ def add_victim_detail(self, report: dict, event: MISPEvent) -> MISPEvent: return event def add_report_content(self, report: dict, event: MISPEvent, details: dict, report_id: str, seen: dict) -> MISPEvent: - attributes: list[MISPAttribute] = [] rpt_cat = "Internal reference" short_desc = details.get("short_description") if not short_desc: short_desc = report.get("short_description") - if short_desc: - rpt = MISPObject("report") - if report_id: - attributes.append(rpt.add_attribute("case-number", report_id, category=rpt_cat, disable_correlation=True, **seen)) - attributes.append(rpt.add_attribute("type", "Report", category=rpt_cat, disable_correlation=True, **seen)) - attributes.append(rpt.add_attribute("summary", short_desc, category=rpt_cat, disable_correlation=True, **seen)) - attributes.append(rpt.add_attribute("link", report.get("url"), disable_correlation=True, **seen)) - if details.get("attachments"): - for attachment in details.get("attachments"): - attributes.append(rpt.add_attribute("report-file", attachment.get("url"), disable_correlation=True, **seen)) - event.add_object(rpt) + + rpt = MISPObject("report") + rpt.add_attribute("case-number", report_id, category=rpt_cat, disable_correlation=True, **seen) + rpt.add_attribute("type", "Report", category=rpt_cat, disable_correlation=True, **seen) + rpt.add_attribute("summary", short_desc, category=rpt_cat, disable_correlation=True, **seen) + rpt.add_attribute("link", report.get("url"), disable_correlation=True, **seen) + + pdfreport = self.intel_api_client.get_report_pdf(report.get('id')) + + attachments = details.get("attachments",[]) #CSA CSIT + if not attachments: + attachments = report.get("attachments",[]) #CSECR CSDR CSID + + if len(attachments) == 1: + pdfreport = self.intel_api_client.get_report_pdf(report.get('id')) + if isinstance(pdfreport, bytes): + rpt.add_attribute("report-file", attachments[0].get("url"), data=BytesIO(pdfreport), disable_correlation=True, **seen) + else: + self.log.error("Failed to download attachment for report id: %s", report.get('id')) + else: + for attachment in details.get("attachments", []): + rpt.add_attribute("report-file", attachment.get("url"), disable_correlation=True, **seen) + + event.add_object(rpt) # Report Annotation and full text rich_desc = details.get("rich_text_description", None) @@ -547,15 +560,14 @@ def add_report_content(self, report: dict, event: MISPEvent, details: dict, repo if long_desc or rich_desc: # Moving over to just using the event report for the MD formatted content if rich_desc: - rich_desc = rich_desc - md_version = markdownify(rich_desc) + md_version = markdownify(rich_desc) if not md_version: md_version = long_desc if not md_version: md_version = reg_desc md_version = md_version.replace("\t", "").replace(" ", "").replace(" ", "") - + event.add_event_report(report.get("name"), md_version) return event @@ -615,4 +627,4 @@ def create_event_from_report(self, report, report_details, indicator_list) -> MI else: self.log.warning("Report %s missing name field.", report.get('id')) - return event \ No newline at end of file + return event