Merge pull request #919 from MISP/feat/modat-magnify-enrichment

Add MODAT Magnify infrastructure enrichment module

Author: adulau

documentation/expansion/modat-attribute-coverage.csv

@@ -0,0 +1,24 @@
+MODAT field,MISP object,Object relation,MISP attribute type
+fqdn,modat-dns-record,fqdn,domain
+rrtype,modat-dns-record,rrtype,text
+ttl,modat-dns-record,ttl,integer
+created_at,modat-dns-record,created-at,datetime
+deleted_at,modat-dns-record,deleted-at,datetime
+ip,modat-dns-record,ip,ip-dst
+cname,modat-dns-record,cname,domain
+host,modat-dns-record,host,hostname
+ns,modat-dns-record,ns,hostname
+priority,modat-dns-record,priority,integer
+target,modat-dns-record,target,text
+params,modat-dns-record,params,text
+mname,modat-dns-record,mname,hostname
+rname,modat-dns-record,rname,text
+serial,modat-dns-record,serial,integer
+refresh,modat-dns-record,refresh,integer
+retry,modat-dns-record,retry,integer
+expire,modat-dns-record,expire,integer
+minimum,modat-dns-record,minimum,integer
+weight,modat-dns-record,weight,integer
+port,modat-dns-record,port,port
+value,modat-dns-record,value,text
+raw-json,modat-dns-record,raw-json,attachment

documentation/expansion/modat-dns-field-mapping.csv

@@ -0,0 +1,131 @@
+MODAT field,MISP object,Object relation,MISP attribute type
+transport,modat-service,transport,text
+ports,modat-service,ports,port
+last_scanned_port,modat-service,last-scanned-port,port
+protocol,modat-service,protocol,text
+scanned_at,modat-service,scanned-at,datetime
+discovered_at,modat-service,discovered-at,datetime
+is_match,modat-service,is-match,boolean
+banner,modat-service,banner,text
+banner_hex,modat-service,banner-hex,text
+banner_sha1,modat-service,banner-sha1,sha1
+banner_sha256,modat-service,banner-sha256,sha256
+banner_mmh3,modat-service,banner-mmh3,integer
+ssh.hassh,modat-service,ssh-hassh,hasshserver-md5
+ssh.server_id,modat-service,ssh-server-id,text
+ssh.server_key_exchange.cookie,modat-service,ssh-server-key-exchange-cookie,text
+ssh.server_key_exchange.kex_algorithms,modat-service,ssh-server-key-exchange-kex-algorithms,text
+ssh.server_key_exchange.host_key_algorithms,modat-service,ssh-server-key-exchange-host-key-algorithms,text
+ssh.server_key_exchange.client_to_server_ciphers,modat-service,ssh-server-key-exchange-client-to-server-ciphers,text
+ssh.server_key_exchange.server_to_client_ciphers,modat-service,ssh-server-key-exchange-server-to-client-ciphers,text
+ssh.server_key_exchange.client_to_server_macs,modat-service,ssh-server-key-exchange-client-to-server-macs,text
+ssh.server_key_exchange.server_to_client_macs,modat-service,ssh-server-key-exchange-server-to-client-macs,text
+ssh.server_key_exchange.client_to_server_compression,modat-service,ssh-server-key-exchange-client-to-server-compression,text
+ssh.server_key_exchange.server_to_client_compression,modat-service,ssh-server-key-exchange-server-to-client-compression,text
+ssh.server_key_exchange.first_kex_follows,modat-service,ssh-server-key-exchange-first-kex-follows,boolean
+ssh.server_key_exchange.reserved,modat-service,ssh-server-key-exchange-reserved,integer
+ssh.algorithm_selection.dh_kex_algorithm,modat-service,ssh-algorithm-selection-dh-kex-algorithm,text
+ssh.algorithm_selection.host_key_algorithm,modat-service,ssh-algorithm-selection-host-key-algorithm,text
+ssh.algorithm_selection.client_to_server_alg_group.cipher,modat-service,ssh-algorithm-selection-client-to-server-alg-group-cipher,text
+ssh.algorithm_selection.client_to_server_alg_group.mac,modat-service,ssh-algorithm-selection-client-to-server-alg-group-mac,text
+ssh.algorithm_selection.client_to_server_alg_group.compression,modat-service,ssh-algorithm-selection-client-to-server-alg-group-compression,text
+ssh.algorithm_selection.server_to_client_alg_group.cipher,modat-service,ssh-algorithm-selection-server-to-client-alg-group-cipher,text
+ssh.algorithm_selection.server_to_client_alg_group.mac,modat-service,ssh-algorithm-selection-server-to-client-alg-group-mac,text
+ssh.algorithm_selection.server_to_client_alg_group.compression,modat-service,ssh-algorithm-selection-server-to-client-alg-group-compression,text
+ssh.key_exchange.curve25519_sha256_params.server_public,modat-service,ssh-key-exchange-curve25519-sha256-params-server-public,text
+ssh.key_exchange.server_signature.parsed.algorithm,modat-service,ssh-key-exchange-server-signature-parsed-algorithm,text
+ssh.key_exchange.server_signature.parsed.value,modat-service,ssh-key-exchange-server-signature-parsed-value,text
+ssh.key_exchange.server_signature.raw,modat-service,ssh-key-exchange-server-signature-raw,text
+ssh.key_exchange.server_signature.h,modat-service,ssh-key-exchange-server-signature-h,text
+ssh.key_exchange.server_host_key.rsa_public_key.exponent,modat-service,ssh-key-exchange-server-host-key-rsa-public-key-exponent,integer
+ssh.key_exchange.server_host_key.rsa_public_key.modulus,modat-service,ssh-key-exchange-server-host-key-rsa-public-key-modulus,text
+ssh.key_exchange.server_host_key.rsa_public_key.length,modat-service,ssh-key-exchange-server-host-key-rsa-public-key-length,integer
+ssh.key_exchange.server_host_key.ecdsa_public_key.b,modat-service,ssh-key-exchange-server-host-key-ecdsa-public-key-b,text
+ssh.key_exchange.server_host_key.ecdsa_public_key.curve,modat-service,ssh-key-exchange-server-host-key-ecdsa-public-key-curve,text
+ssh.key_exchange.server_host_key.ecdsa_public_key.gx,modat-service,ssh-key-exchange-server-host-key-ecdsa-public-key-gx,text
+ssh.key_exchange.server_host_key.ecdsa_public_key.gy,modat-service,ssh-key-exchange-server-host-key-ecdsa-public-key-gy,text
+ssh.key_exchange.server_host_key.ecdsa_public_key.length,modat-service,ssh-key-exchange-server-host-key-ecdsa-public-key-length,integer
+ssh.key_exchange.server_host_key.ecdsa_public_key.n,modat-service,ssh-key-exchange-server-host-key-ecdsa-public-key-n,text
+ssh.key_exchange.server_host_key.ecdsa_public_key.p,modat-service,ssh-key-exchange-server-host-key-ecdsa-public-key-p,text
+ssh.key_exchange.server_host_key.ecdsa_public_key.x,modat-service,ssh-key-exchange-server-host-key-ecdsa-public-key-x,text
+ssh.key_exchange.server_host_key.ecdsa_public_key.y,modat-service,ssh-key-exchange-server-host-key-ecdsa-public-key-y,text
+ssh.key_exchange.server_host_key.raw,modat-service,ssh-key-exchange-server-host-key-raw,text
+ssh.key_exchange.server_host_key.algorithm,modat-service,ssh-key-exchange-server-host-key-algorithm,text
+ssh.key_exchange.server_host_key.fingerprint_sha256,modat-service,ssh-key-exchange-server-host-key-fingerprint-sha256,ssh-fingerprint
+tcp.window_size,modat-service,tcp-window-size,integer
+tls.is_self_signed,modat-service,tls-is-self-signed,boolean
+tls.is_trusted,modat-service,tls-is-trusted,boolean
+tls.valid_from,modat-service,tls-valid-from,datetime
+tls.expires_at,modat-service,tls-expires-at,datetime
+tls.validity_seconds,modat-service,tls-validity-seconds,integer
+tls.supported_versions,modat-service,tls-supported-versions,text
+tls.fingerprint_sha256,modat-service,tls-fingerprint-sha256,x509-fingerprint-sha256
+tls.fingerprint_sha1,modat-service,tls-fingerprint-sha1,x509-fingerprint-sha1
+tls.jarm,modat-service,tls-jarm,jarm-fingerprint
+tls.ja3s,modat-service,tls-ja3s,text
+tls.ja4s,modat-service,tls-ja4s,text
+tls.ja4x,modat-service,tls-ja4x,text
+tls.ja4scan_tls,modat-service,tls-ja4scan-tls,text
+tls.serial_number,modat-service,tls-serial-number,text
+tls.issuer.common_name,modat-service,tls-issuer-common-name,text
+tls.issuer.country,modat-service,tls-issuer-country,text
+tls.issuer.organization,modat-service,tls-issuer-organization,text
+tls.issuer.organizational_unit,modat-service,tls-issuer-organizational-unit,text
+tls.issuer.province,modat-service,tls-issuer-province,text
+tls.issuer.locality,modat-service,tls-issuer-locality,text
+tls.issuer.email_address,modat-service,tls-issuer-email-address,email
+tls.subject.common_name,modat-service,tls-subject-common-name,text
+tls.subject.country,modat-service,tls-subject-country,text
+tls.subject.organization,modat-service,tls-subject-organization,text
+tls.subject.organizational_unit,modat-service,tls-subject-organizational-unit,text
+tls.subject.province,modat-service,tls-subject-province,text
+tls.subject.locality,modat-service,tls-subject-locality,text
+tls.subject.email_address,modat-service,tls-subject-email-address,email
+tls.extensions.subject_alt_name.dns,modat-service,tls-extensions-subject-alt-name-dns,domain
+tls.extensions.subject_alt_name.ipv4,modat-service,tls-extensions-subject-alt-name-ipv4,ip-dst
+tls.extensions.subject_alt_name.ipv6,modat-service,tls-extensions-subject-alt-name-ipv6,ip-dst
+tls.extensions.subject_alt_name.email,modat-service,tls-extensions-subject-alt-name-email,email
+tls.extensions.subject_alt_name.uri,modat-service,tls-extensions-subject-alt-name-uri,uri
+tls.extensions.subject_alt_name.directory,modat-service,tls-extensions-subject-alt-name-directory,text
+tls.extensions.subject_alt_name.other_names.id,modat-service,tls-extensions-subject-alt-name-other-names-id,text
+tls.extensions.subject_alt_name.other_names.value,modat-service,tls-extensions-subject-alt-name-other-names-value,text
+tls.extensions.issuer_alt_name.dns,modat-service,tls-extensions-issuer-alt-name-dns,domain
+tls.extensions.issuer_alt_name.ipv4,modat-service,tls-extensions-issuer-alt-name-ipv4,ip-dst
+tls.extensions.issuer_alt_name.ipv6,modat-service,tls-extensions-issuer-alt-name-ipv6,ip-dst
+tls.extensions.issuer_alt_name.email,modat-service,tls-extensions-issuer-alt-name-email,email
+tls.extensions.issuer_alt_name.uri,modat-service,tls-extensions-issuer-alt-name-uri,uri
+tls.extensions.issuer_alt_name.directory,modat-service,tls-extensions-issuer-alt-name-directory,text
+tls.extensions.issuer_alt_name.other_names.id,modat-service,tls-extensions-issuer-alt-name-other-names-id,text
+tls.extensions.issuer_alt_name.other_names.value,modat-service,tls-extensions-issuer-alt-name-other-names-value,text
+tls.raw,modat-service,tls-raw,text
+tls.is_valid,modat-service,tls-is-valid,boolean
+fingerprints.os.product,modat-service,fingerprints-os-product,text
+fingerprints.os.version,modat-service,fingerprints-os-version,text
+fingerprints.os.arch,modat-service,fingerprints-os-arch,text
+fingerprints.os.icon_url,modat-service,fingerprints-os-icon-url,link
+fingerprints.service.product,modat-service,fingerprints-service-product,text
+fingerprints.service.version,modat-service,fingerprints-service-version,text
+fingerprints.service.icon_url,modat-service,fingerprints-service-icon-url,link
+fingerprints.technologies.name,modat-service,fingerprints-technologies-name,text
+fingerprints.technologies.version,modat-service,fingerprints-technologies-version,text
+fingerprints.technologies.icon_url,modat-service,fingerprints-technologies-icon-url,link
+fingerprints.tags,modat-service,fingerprints-tags,text
+http.title,modat-service,http-title,text
+http.status_code,modat-service,http-status-code,integer
+http.headers,modat-service,http-headers,text
+http.headers_sha256,modat-service,http-headers-sha256,sha256
+http.body,modat-service,http-body,text
+http.body_mmh3,modat-service,http-body-mmh3,integer
+http.body_sha1,modat-service,http-body-sha1,sha1
+http.body_sha256,modat-service,http-body-sha256,sha256
+http.css_mmh3,modat-service,http-css-mmh3,integer
+http.js_mmh3,modat-service,http-js-mmh3,integer
+http.files.path,modat-service,http-files-path,text
+http.files.category,modat-service,http-files-category,text
+http.files.sha256,modat-service,http-files-sha256,sha256
+http.files.sha1,modat-service,http-files-sha1,sha1
+http.files.mmh3,modat-service,http-files-mmh3,favicon-mmh3
+cves.id,modat-service,cves-id,text
+cves.cvss,modat-service,cves-cvss,float
+cves.is_kev,modat-service,cves-is-kev,boolean
+port (service search),modat-service,ports,port