Skip to content

Commit 2207616

Browse files
julienloizeletjulienloizelet
authored
feat(*): Use misp-objects template and check IP before API call (#2)
* feat(*): Add missing moduleinfo fields * feat(*): Use crowdsec-ip-context template from misp-objects fix(*): Check if IP is valid before CTI call
1 parent 1f840f3 commit 2207616

File tree

6 files changed

+249
-205
lines changed

6 files changed

+249
-205
lines changed

‎CHANGELOG.md‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,16 @@ The [public API](https://semver.org/spec/v2.0.0.html#spec-item-1) for this proj
99

1010
---
1111

12+
## [2.1.1](https://github.com/crowdsecurity/cs-misp-module/releases/tag/v2.1.1) - 2024-08-23
13+
[_Compare with previous release_](https://github.com/crowdsecurity/cs-misp-module/compare/v2.1.0...v2.1.1)
14+
15+
### Fixed
16+
17+
- Check if the IP is valid before calling CrowdSec API
18+
- Use `crowdsec-ip-context` template from [MISP objects repository](https://github.com/MISP/misp-objects/tree/main/objects/crowdsec-ip-context)
19+
20+
---
21+
1222

1323
## [2.1.0](https://github.com/crowdsecurity/cs-misp-module/releases/tag/v2.1.0) - 2024-08-22
1424
[_Compare with previous release_](https://github.com/crowdsecurity/cs-misp-module/compare/v2.0.0...v2.1.0)

‎dev/crowdsec-ip-context-definition.json‎

Lines changed: 183 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,183 @@
1+
{
2+
"attributes": {
3+
"as-name": {
4+
"categories": [
5+
"Network activity",
6+
"External analysis"
7+
],
8+
"description": "Autonomous system name",
9+
"disable_correlation": true,
10+
"misp-attribute": "text",
11+
"multiple": true,
12+
"ui-priority": 0
13+
},
14+
"as-num": {
15+
"categories": [
16+
"Network activity",
17+
"External analysis"
18+
],
19+
"description": "Autonomous system number",
20+
"disable_correlation": true,
21+
"misp-attribute": "AS",
22+
"multiple": true,
23+
"ui-priority": 0
24+
},
25+
"attack-details": {
26+
"description": "Triggered scenarios",
27+
"disable_correlation": true,
28+
"misp-attribute": "text",
29+
"ui-priority": 1
30+
},
31+
"background-noise": {
32+
"description": "High background noise scores highlight untargeted, mild threat mass-attacks",
33+
"disable_correlation": true,
34+
"misp-attribute": "float",
35+
"ui-priority": 1
36+
},
37+
"behaviors": {
38+
"description": "Attack categories",
39+
"disable_correlation": true,
40+
"misp-attribute": "text",
41+
"multiple": true,
42+
"ui-priority": 1
43+
},
44+
"city": {
45+
"description": "City of origin",
46+
"disable_correlation": true,
47+
"misp-attribute": "text",
48+
"ui-priority": 1
49+
},
50+
"classifications": {
51+
"description": "Classification category of the IP address",
52+
"disable_correlation": true,
53+
"misp-attribute": "text",
54+
"multiple": true,
55+
"ui-priority": 1
56+
},
57+
"country": {
58+
"description": "Country of origin",
59+
"disable_correlation": true,
60+
"misp-attribute": "text",
61+
"ui-priority": 1
62+
},
63+
"country-code": {
64+
"description": "Country Code",
65+
"disable_correlation": true,
66+
"misp-attribute": "text",
67+
"ui-priority": 0
68+
},
69+
"cves": {
70+
"description": "CVEs exploited by the observed IP",
71+
"disable_correlation": true,
72+
"misp-attribute": "text",
73+
"multiple": true,
74+
"ui-priority": 1
75+
},
76+
"dst-port": {
77+
"categories": [
78+
"Network activity",
79+
"External analysis"
80+
],
81+
"description": "Destination port",
82+
"disable_correlation": true,
83+
"misp-attribute": "port",
84+
"multiple": true,
85+
"ui-priority": 1
86+
},
87+
"false-positives": {
88+
"description": "False positive category of the IP address",
89+
"disable_correlation": true,
90+
"misp-attribute": "text",
91+
"multiple": true,
92+
"ui-priority": 1
93+
},
94+
"ip": {
95+
"categories": [
96+
"Network activity",
97+
"External analysis"
98+
],
99+
"description": "IP Address",
100+
"misp-attribute": "ip-src",
101+
"ui-priority": 1
102+
},
103+
"ip-range": {
104+
"categories": [
105+
"Network activity",
106+
"External analysis"
107+
],
108+
"description": "destination IP address",
109+
"misp-attribute": "ip-src",
110+
"ui-priority": 1
111+
},
112+
"ip-range-score": {
113+
"categories": [
114+
"Network activity",
115+
"External analysis"
116+
],
117+
"description": "destination IP address",
118+
"disable_correlation": true,
119+
"misp-attribute": "float",
120+
"ui-priority": 1
121+
},
122+
"latitude": {
123+
"description": "Latitude of origin",
124+
"disable_correlation": true,
125+
"misp-attribute": "float",
126+
"ui-priority": 1
127+
},
128+
"longitude": {
129+
"description": "Longitude of origin",
130+
"disable_correlation": true,
131+
"misp-attribute": "float",
132+
"ui-priority": 1
133+
},
134+
"mitre-techniques": {
135+
"description": "MITRE ATT&CK techniques used by the observed IP",
136+
"disable_correlation": true,
137+
"misp-attribute": "text",
138+
"multiple": true,
139+
"ui-priority": 1
140+
},
141+
"reputation": {
142+
"description": "Real-time, actionable IP reputation score derived from trusted reports and consensus-validated data in CrowdSec CTI",
143+
"disable_correlation": true,
144+
"misp-attribute": "text",
145+
"ui-priority": 1
146+
},
147+
"reverse-dns": {
148+
"categories": [
149+
"Network activity",
150+
"External analysis"
151+
],
152+
"description": "Reverse DNS name",
153+
"misp-attribute": "hostname",
154+
"ui-priority": 1
155+
},
156+
"scores": {
157+
"description": "Scores",
158+
"disable_correlation": true,
159+
"misp-attribute": "text",
160+
"ui-priority": 1
161+
},
162+
"target-countries": {
163+
"description": "Target countries (top 10)",
164+
"disable_correlation": true,
165+
"misp-attribute": "text",
166+
"ui-priority": 1
167+
},
168+
"trust": {
169+
"description": "Trust level",
170+
"disable_correlation": true,
171+
"misp-attribute": "float",
172+
"ui-priority": 1
173+
}
174+
},
175+
"description": "CrowdSec Threat Intelligence - IP CTI search",
176+
"meta-category": "network",
177+
"name": "crowdsec-ip-context",
178+
"requiredOneOf": [
179+
"ip"
180+
],
181+
"uuid": "0f0a6def-a351-4d3b-9868-d732f6f4666f",
182+
"version": 4
183+
}

‎dev/docker-compose.override.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,3 +2,7 @@ services:
22
misp-modules:
33
volumes:
44
- ../cs-misp-module/src/misp_modules/modules/expansion/crowdsec.py:/usr/local/lib/python3.12/site-packages/misp_modules/modules/expansion/crowdsec.py
5+
- ../cs-misp-module/dev/crowdsec-ip-context-definition.json:/usr/local/lib/python3.12/site-packages/pymisp/data/misp-objects/objects/crowdsec-ip-context/definition.json
6+
7+
8+

‎docs/DEVELOPER.md‎

Lines changed: 27 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,10 @@ git clone git@github.com:misp/misp-docker.git
7575
Before running the docker environment, we need to create a volume so that our local sources are mounted in the misp-modules container.
7676

7777
**Warning**: The python version that is hard-coded in the `docker-compose.override.yml` may change: it should be same version that is used by the misp-modules container.
78-
Please look the `python_version` value at the end of the `misp-modules/Pipfile` file.
78+
79+
**Warning 2**: You can comment `the crowdsec-ip-context-definition.json` if you want to use the definition coming from
80+
the [MISP Objects repository](https://github.com/MISP/misp-objects/blob/main/objects/crowdsec-ip-context/definition.json).
81+
If you need to modify the definition during the development, you can uncomment it and modify the`cs-misp-module/dev/crowdsec-ip-context-definition.json` file.
7982

8083
```bash
8184
cp cs-misp-module/dev/docker-compose.override.yml misp-docker/
@@ -212,18 +215,20 @@ Before creating a release, ensure to format correctly the `CHANGELOG.md` file an
212215

213216
Then, you can use the [Create Release action](https://github.com/crowdsecurity/cs-misp-module/actions/workflows/release.yml).
214217

218+
For the rest of the process, we will use the release version `vX.Y.Z` as an example.
219+
215220
#### Retrieve zip for release
216221

217222
At the end of the Create Release action run, you can download a zip containing the relevant files.
218223

219224
#### Create a branch for the Pull Request
220225

221-
If your release is `vX.Y.Z`, you can create a `feat/release-X.Y.Z` branch:
226+
If your release `vX.Y.Z` has been published on `YYYY-MM-DD`, you can create a `feat/release-YYYYMMDD` branch:
222227

223228
```shell
224229
cd misp-modules
225230
git checkout amin
226-
git checkout -b feat/release-X.Y.Z
231+
git checkout -b feat/release-YYYYMMDD
227232
```
228233

229234
#### Update sources
@@ -239,7 +244,6 @@ Then, unzip the `crowdsec-misp-module-X.Y.Z.zip` archive and copy files in the r
239244
- `src/misp_modules/modules/expansion/crowdsec.py` -> `misp_modules/modules/expansion/crowdsec.py`
240245

241246

242-
243247
Now, you can verify the diff.
244248

245249
Once all seems fine, add and commit your modifications:
@@ -258,7 +262,7 @@ Change
258262
services:
259263
misp-modules:
260264
volumes:
261-
- ../cs-misp-module/src/misp_modules/modules/expansion/crowdsec.py:/usr/local/lib/python?.??/site-packages/misp_modules/modules/expansion/crowdsec.py
265+
- ../cs-misp-module/src/misp_modules/modules/expansion/crowdsec.py:/usr/local/lib/python3.12/site-packages/misp_modules/modules/expansion/crowdsec.py
262266
263267
```
264268

@@ -268,78 +272,64 @@ to
268272
services:
269273
misp-modules:
270274
volumes:
271-
- ../misp-modules/misp_modules/modules/expansion/crowdsec.py:/usr/local/lib/python?.??/site-packages/misp_modules/modules/expansion/crowdsec.py
275+
- ../misp-modules/misp_modules/modules/expansion/crowdsec.py:/usr/local/lib/python3.12/site-packages/misp_modules/modules/expansion/crowdsec.py
272276
273277
```
274278

279+
**Beware**: The python version that is hard-coded in the `docker-compose.override.yml` may change: it should be same version that is used by the misp-modules container.
280+
275281

276282
#### Open a Pull request
277283

278284
Push your modification
279285

280286
```shell
281-
git push origin feat/release-X.Y.Z
287+
git push origin feat/release-YYYYMMDD
282288
```
283289

284-
Now you can use the `feat/release-X.Y.Z` branch to open a pull request in the MISP modules repository.
290+
Now you can use the `feat/release-YYYYMMDD` branch to open a pull request in the MISP modules repository.
285291
For the pull request description, you could use the release version description that you wrote in the `CHANGELOG.md` file.
286292

287293

288-
289294
### During the pull request review
290295

291-
As long as the pull request is in review state, we should not create a new release.
292-
If there are modifications to do, we can do it directly on the `feat/release-X.Y.Z`.
293-
All changes made to pass the pull request review must be back ported to a `feat/pr-review-X.Y.Z` branch created in this repository:
296+
If there are modifications to do, we use the `feat/pr-<pr-number>-ongoing` branch to do them:
294297

295298
```shell
296299
cd cs-misp-module
297300
git checkout main
298-
git checkout -b feat/pr-review-X.Y.Z
301+
git checkout -b feat/pr-<pr-number>-ongoing
299302
```
300303

301-
### Once pull request is merged
304+
We have to update `feat/release-YYYYMMDD` and `feat/pr-<pr-number>-ongoing` branches simultaneously.
302305

303-
If pull request has been merged without any modification, there is nothing more to do.
306+
If modifications are related to the public API of the module (defined at the top of `CHANGELOG.md`), a new release (patch, minor or major depending on the changes)
307+
should be created. The release zip archive will be used to update once again the `feat/release-YYYYMMDD` in `misp-modules` fork, updating automatically the current pull request.
304308

305-
If there were modifications, we need to update the sources anc create a patch release.
309+
If modifications are not related to the public API, the `feat/release-YYYYMMDD` and `feat/pr-<pr-number>-ongoing` branches should be updated directly.
306310

307-
#### Sync fork with upstream
308311

309-
First, sync the connector fork like we did [here](#sync-fork-with-upstream).
312+
### Once pull request is merged
310313

311-
#### Retrieve last version
314+
Pull Request should have been merged without any modification related to the public API of the module (defined at the top of `CHANGELOG.md`).
312315

313-
After this, you should have the last version of the CrowdSec module in `misp_modules/modules/expansion/crowdsec.py`.
316+
Thus, it should be unnecessary to create a new release.
314317

315-
You need to retrieve it and commit the differences.
318+
To backport remaining modifications (test files, documentation, etc.) to the `main` branch, we can merge the `feat/pr-<pr-number>-ongoing` branch into `main`:
316319

317320
```shell
318321
cd cs-misp-module
319-
git checkout feat/pr-review-X.Y.Z
320-
```
321-
322-
Delete `src/misp_modules/modules/expansion/crowdsec.py`.
323-
324-
Copy all files from the modules fork:
325-
326-
```
327-
cp -r ../misp-modules/misp_modules/modules/expansion/crowdsec.py ./src/misp_modules/modules/expansion/crowdsec.py
322+
git checkout main
323+
git merge feat/pr-<pr-number>-ongoing
324+
git push origin main
328325
```
329326

330-
Add and commit the result. Push the `feat/pr-review-X.Y.Z` and merge it into `main` with a pull request.
331327

332328

333-
#### Create a new minor release
334329

335-
Once the `main` branch is updated, you can create a new minor `X.Y.Z+1` release with the following CHANGELOG content:
336330

337-
```
338-
## Changed
339331

340-
- Synchronize content with MISP modules release [A.B.C](https://github.com/MISP/misp-modules/releases/tag/A.B.C)
341332

342-
```
343333

344334

345335

0 commit comments

Comments
 (0)