-
Notifications
You must be signed in to change notification settings - Fork 19
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Second take on minemeld integration. Found a lot I missed from the previous push. - Added lookup functions for domain and ip list. - Added documentation. - Modified the ThreatIntelPluginConfig for the spaumhaus plugin to rename from tor_enabled to spaumhaus_enabled. - Modified the content pack to include minemeld.
- Loading branch information
Chris Forsythe
committed
May 9, 2018
1 parent
5564e12
commit 8019b62
Showing
14 changed files
with
360 additions
and
3 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
69 changes: 69 additions & 0 deletions
69
...java/org/graylog/plugins/threatintel/functions/minemeld/MineMeldDomainLookupFunction.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,69 @@ | ||
| package org.graylog.plugins.threatintel.functions.minemeld; | ||
|
|
||
| import org.graylog.plugins.pipelineprocessor.EvaluationContext; | ||
| import org.graylog.plugins.pipelineprocessor.ast.functions.FunctionArgs; | ||
| import org.graylog.plugins.pipelineprocessor.ast.functions.FunctionDescriptor; | ||
| import org.graylog.plugins.pipelineprocessor.ast.functions.ParameterDescriptor; | ||
| import org.graylog.plugins.threatintel.functions.misc.LookupTableFunction; | ||
| import org.graylog.plugins.threatintel.functions.GenericLookupResult; | ||
| import org.graylog.plugins.threatintel.tools.Domain; | ||
| import org.graylog2.lookup.LookupTableService; | ||
| import org.graylog2.plugin.lookup.LookupResult; | ||
| import org.slf4j.Logger; | ||
| import org.slf4j.LoggerFactory; | ||
|
|
||
| import javax.inject.Inject; | ||
|
|
||
| public class MineMeldDomainLookupFunction extends LookupTableFunction<GenericLookupResult> { | ||
|
|
||
| private static final Logger LOG = LoggerFactory.getLogger(MineMeldDomainLookupFunction.class); | ||
|
|
||
| public static final String NAME = "minemeld_lookup_domain"; | ||
| private static final String VALUE = "domain_name"; | ||
| private static final String LOOKUP_TABLE_NAME = "minemeld-domains"; | ||
|
|
||
| private final ParameterDescriptor<String, String> valueParam = ParameterDescriptor.string(VALUE).description("The domain to look up. Example: foo.example.org (A trailing dot ('.') will be ignored.)").build(); | ||
|
|
||
| private final LookupTableService.Function lookupFunction; | ||
|
|
||
| @Inject | ||
| public MineMeldDomainLookupFunction(final LookupTableService lookupTableService) { | ||
| this.lookupFunction = lookupTableService.newBuilder().lookupTable(LOOKUP_TABLE_NAME).build(); | ||
| } | ||
|
|
||
| @Override | ||
| public GenericLookupResult evaluate(FunctionArgs args, EvaluationContext context) { | ||
| String domain = valueParam.required(args, context); | ||
| if (domain == null) { | ||
| LOG.error("NULL parameter passed to abuse.ch Ransomware domain lookup."); | ||
| return null; | ||
| } | ||
|
|
||
| domain = Domain.prepareDomain(domain); | ||
|
|
||
| LOG.debug("Running abuse.ch Ransomware lookup for domain [{}].", domain); | ||
|
|
||
| final LookupResult lookupResult = this.lookupFunction.lookup(domain.trim()); | ||
| if (lookupResult != null && !lookupResult.isEmpty() && lookupResult.singleValue() != null) { | ||
| if (lookupResult.singleValue() instanceof Boolean) { | ||
| return (Boolean)lookupResult.singleValue() ? GenericLookupResult.TRUE : GenericLookupResult.FALSE; | ||
| } | ||
| if (lookupResult.singleValue() instanceof String) { | ||
| return Boolean.valueOf((String) lookupResult.singleValue()) ? GenericLookupResult.TRUE : GenericLookupResult.FALSE; | ||
| } | ||
| } | ||
|
|
||
| return GenericLookupResult.FALSE; | ||
| } | ||
|
|
||
| @Override | ||
| public FunctionDescriptor<GenericLookupResult> descriptor() { | ||
| return FunctionDescriptor.<GenericLookupResult>builder() | ||
| .name(NAME) | ||
| .description("Match a domain name against the abuse.ch Ransomware Domain Blocklist. (RW_DOMBL)") | ||
| .params(valueParam) | ||
| .returnType(GenericLookupResult.class) | ||
| .build(); | ||
| } | ||
|
|
||
| } |
66 changes: 66 additions & 0 deletions
66
...ain/java/org/graylog/plugins/threatintel/functions/minemeld/MineMeldIpLookupFunction.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,66 @@ | ||
| package org.graylog.plugins.threatintel.functions.minemeld; | ||
|
|
||
| import org.graylog.plugins.pipelineprocessor.EvaluationContext; | ||
| import org.graylog.plugins.pipelineprocessor.ast.functions.FunctionArgs; | ||
| import org.graylog.plugins.pipelineprocessor.ast.functions.FunctionDescriptor; | ||
| import org.graylog.plugins.pipelineprocessor.ast.functions.ParameterDescriptor; | ||
| import org.graylog.plugins.threatintel.functions.misc.LookupTableFunction; | ||
| import org.graylog.plugins.threatintel.functions.GenericLookupResult; | ||
| import org.graylog2.lookup.LookupTableService; | ||
| import org.graylog2.plugin.lookup.LookupResult; | ||
| import org.slf4j.Logger; | ||
| import org.slf4j.LoggerFactory; | ||
|
|
||
| import javax.inject.Inject; | ||
|
|
||
| public class MineMeldIpLookupFunction extends LookupTableFunction<GenericLookupResult> { | ||
|
|
||
| private static final Logger LOG = LoggerFactory.getLogger(MineMeldIpLookupFunction.class); | ||
|
|
||
| public static final String NAME = "minemeld_lookup_ip"; | ||
| private static final String VALUE = "ip_address"; | ||
| private static final String LOOKUP_TABLE_NAME = "minemeld-ip"; | ||
|
|
||
| private final ParameterDescriptor<String, String> valueParam = ParameterDescriptor.string(VALUE).description("The IPv4 or IPv6 address to look up. Example: 198.51.100.1 or 2001:0db8:85a3:0000:0000:8a2e:0370:7334").build(); | ||
|
|
||
| private final LookupTableService.Function lookupFunction; | ||
|
|
||
| @Inject | ||
| public MineMeldmIpLookupFunction(final LookupTableService lookupTableService) { | ||
| this.lookupFunction = lookupTableService.newBuilder().lookupTable(LOOKUP_TABLE_NAME).build(); | ||
| } | ||
|
|
||
| @Override | ||
| public GenericLookupResult evaluate(FunctionArgs args, EvaluationContext context) { | ||
| String ip = valueParam.required(args, context); | ||
| if (ip == null) { | ||
| LOG.error("NULL parameter passed to abuse.ch Ransomware IP lookup."); | ||
| return null; | ||
| } | ||
|
|
||
| LOG.debug("Running abuse.ch Ransomware lookup for IP [{}].", ip); | ||
|
|
||
| final LookupResult lookupResult = this.lookupFunction.lookup(ip.trim()); | ||
| if (lookupResult != null && !lookupResult.isEmpty() && lookupResult.singleValue() != null) { | ||
| if (lookupResult.singleValue() instanceof Boolean) { | ||
| return (Boolean)lookupResult.singleValue() ? GenericLookupResult.TRUE : GenericLookupResult.FALSE; | ||
| } | ||
| if (lookupResult.singleValue() instanceof String) { | ||
| return Boolean.valueOf((String) lookupResult.singleValue()) ? GenericLookupResult.TRUE : GenericLookupResult.FALSE; | ||
| } | ||
| } | ||
|
|
||
| return GenericLookupResult.FALSE; | ||
| } | ||
|
|
||
| @Override | ||
| public FunctionDescriptor<GenericLookupResult> descriptor() { | ||
| return FunctionDescriptor.<GenericLookupResult>builder() | ||
| .name(NAME) | ||
| .description("Match a IPv4 or IPv6 address against the abuse.ch Ransomware IP Blocklist. (RW_IPBL)") | ||
| .params(valueParam) | ||
| .returnType(GenericLookupResult.class) | ||
| .build(); | ||
| } | ||
|
|
||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.