CalvinBackup/mvt
1
0
Fork 0
mirror of https://github.com/mvt-project/mvt.git synced 2026-05-17 22:24:47 +02:00
Code Issues Packages Projects Releases Wiki Activity

Added counter for loaded indicators

Browse Source
This commit is contained in:
Nex
2021-08-18 13:18:34 +02:00
parent f2b1311ff7
commit 27847bf16c
2 changed files with 17 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mvt/common/indicators.py
+14 -10
View File
@@ -23,6 +23,12 @@ class Indicators:
self.ioc_processes = []
self.ioc_emails = []
self.ioc_files = []
self.ioc_count = 0
def _add_indicator(self, ioc, iocs_list):
if ioc not in iocs_list:
iocs_list.append(ioc)
self.ioc_count += 1
def parse_stix2(self, file_path):
"""Extract indicators from a STIX2 file.
@@ -45,20 +51,18 @@ class Indicators:
if key == "domain-name:value":
# We force domain names to lower case.
value = value.lower()
if value not in self.ioc_domains:
self.ioc_domains.append(value)
self._add_indicator(ioc=value.lower(),
iocs_list=self.ioc_domains)
elif key == "process:name":
if value not in self.ioc_processes:
self.ioc_processes.append(value)
self._add_indicator(ioc=value,
iocs_list=self.ioc_processes)
elif key == "email-addr:value":
# We force email addresses to lower case.
value = value.lower()
if value not in self.ioc_emails:
self.ioc_emails.append(value)
self._add_indicator(ioc=value.lower(),
iocs_list=self.ioc_emails)
elif key == "file:name":
if value not in self.ioc_files:
self.ioc_files.append(value)
self._add_indicator(ioc=value,
iocs_list=self.ioc_files)
def check_domain(self, url):
# TODO: If the IOC domain contains a subdomain, it is not currently
mvt/ios/cli.py
+3
View File
@@ -153,6 +153,7 @@ def check_backup(ctx, iocs, output, fast, backup_path, list_modules, module):
except IndicatorsFileBadFormat as e:
log.critical(e)
ctx.exit(1)
log.info("Loaded a total of %d indicators", indicators.ioc_count)
timeline = []
timeline_detected = []
@@ -215,6 +216,7 @@ def check_fs(ctx, iocs, output, fast, dump_path, list_modules, module):
except IndicatorsFileBadFormat as e:
log.critical(e)
ctx.exit(1)
log.info("Loaded a total of %d indicators", indicators.ioc_count)
timeline = []
timeline_detected = []
@@ -274,6 +276,7 @@ def check_iocs(ctx, iocs, list_modules, module, folder):
except IndicatorsFileBadFormat as e:
log.critical(e)
ctx.exit(1)
log.info("Loaded a total of %d indicators", indicators.ioc_count)
for file_name in os.listdir(folder):
name_only, ext = os.path.splitext(file_name)