intelmq.bots.parsers.misp package — intelmq 2.3.3.alpha1 documentation

# intelmq.bots.parsers.misp package

## Submodules

## intelmq.bots.parsers.misp.parser module

`intelmq.bots.parsers.misp.parser.` `BOT`

  alias of `intelmq.bots.parsers.misp.parser.MISPParserBot`

class `intelmq.bots.parsers.misp.parser.` `MISPParserBot`(bot_id: str, start: bool = False, sighup_event=None, disable_multithreading: Optional[bool] = None)

  Bases: `intelmq.lib.bot.Bot`

  `MISP_TAXONOMY_MAPPING` = {'ecsirt:abusive-content="spam"': 'spam', 'ecsirt:availability="ddos"': 'ddos', 'ecsirt:fraud="phishing"': 'phishing', 'ecsirt:information-content-security="dropzone"': 'dropzone', 'ecsirt:information-gathering="scanner"': 'scanner', 'ecsirt:intrusion-attempts="brute-force"': 'brute-force', 'ecsirt:intrusion-attempts="exploit"': 'exploit', 'ecsirt:intrusion-attempts="ids-alert"': 'ids-alert', 'ecsirt:intrusions="backdoor"': 'backdoor', 'ecsirt:intrusions="compromised"': 'compromised', 'ecsirt:intrusions="defacement"': 'defacement', 'ecsirt:malicious-code="botnet-drone"': 'infected-system', 'ecsirt:malicious-code="c2server"': 'c2server', 'ecsirt:malicious-code="malware"': 'malware', 'ecsirt:malicious-code="malware-configuration"': 'malware-configuration', 'ecsirt:malicious-code="ransomware"': 'ransomware', 'ecsirt:other="blacklist"': 'blacklist', 'ecsirt:other="unknown"': 'unknown', 'ecsirt:test="test"': 'test', 'ecsirt:vulnerable="vulnerable-service"': 'vulnerable service'}
  `MISP_TYPE_MAPPING` = {'domain': 'source.fqdn', 'email-src': 'source.account', 'hostname': 'source.fqdn', 'ip-dst': 'source.ip', 'ip-src': 'source.ip', 'md5': 'malware.hash.md5', 'sha1': 'malware.hash.sha1', 'url': 'source.url'}
  `SUPPORTED_MISP_CATEGORIES` = ['Payload delivery', 'Artifacts dropped', 'Payload installation', 'Network activity']
  `process`()

## Module contents