Node-RED Flow: Add Hash Sightings to MISP Event using MAR

chrissmith added a new solution:

Quote

When a MISP event is published, the flow examines the event to determine if it contains hash-based attributes. If it does, a MAR search is performed to determine if any active endpoints contain the hashes. For each endpoint containing a hash, a sighting is added to the MISP event in addition to a comment that includes the associated endpoint information.

Prerequisites

• The Node-RED DXL client configuration step has been completed (see Client Configuration).
• A McAfee Active Response (MAR) service is available on the DXL fabric.
• The Node-RED DXL client is authorized to perform MAR searches (see Authorize Client to Perform MAR Search).
• The MISP DXL Service is running and connected to the DXL fabric.
  • The service is configured to connect to ZeroMQ (zeroMqPort) and the notification topic misp_json is being forwarded.
  • The service exposes the sighting API
• The following Node-RED modules have been installed:
  • Node-RED config node (included in OpenDXL Node-RED Docker image)
  • DXL Node-RED nodes (included in OpenDXL Node-RED Docker image)
  • McAfee Active Response (MAR) DXL nodes for Node-RED

The Node-RED flow content for this solution:

Code: Node-RED Flow

1. [
2. {
3. "id": "3bcf37ef.a9d108",
4. "type": "tab",
5. "label": "Add Hash Sightings to MISP Event using MAR",
6. "disabled": false,
7. "info": "This flow utilizes McAfee Active Response (MAR) to adds sightings to MISP \r\npublished events containing hash-based attributes.\r\n\r\nWhen a MISP event is published, the flow examines the event to determine if \r\nit contains hash-based attributes. If it does, a MAR search is performed \r\nto determine if any active endpoints contain the hashes. For each endpoint\r\ncontaining a hash, a sighting is added to the MISP event in addition to a \r\ncomment that includes the associated endpoint information.\r\n\r\n### Prerequisites\r\n\r\n* The Node-RED DXL client configuration step has been completed (see\r\n [Client Configuration](https://opendxl.github.io/node-red-contrib-dxl/jsdoc/tutorial-configuration.html)).\r\n* A McAfee Active Response (MAR) service is available on the DXL fabric.\r\n* The Node-RED DXL client is authorized to perform MAR searches\r\n (see [Authorize Client to Perform MAR Search](https://opendxl.github.io/opendxl-client-python/pydoc/marsendauth.html)).\r\n* The [MISP DXL Service](https://github.com/opendxl/opendxl-misp-service-python) is running and connected to the DXL fabric.\r\n * The service is configured to connect to ZeroMQ (`zeroMqPort`) and the notification topic `misp_json` is being forwarded.\r\n * The service exposes the `sighting` API \r\n* The following Node-RED modules have been installed:\r\n * [Node-RED config node](https://flows.nodered.org/node/node-red-contrib-config) (included in OpenDXL Node-RED Docker image)\r\n * [DXL Node-RED nodes](https://flows.nodered.org/node/@opendxl/node-red-contrib-dxl) (included in OpenDXL Node-RED Docker image)\r\n * [McAfee Active Response (MAR) DXL nodes for Node-RED](https://flows.nodered.org/node/@opendxl/node-red-contrib-dxl-mar-client)\r\n \r\n"
8. },
9. {
10. "id": "3d363a67.a36dd6",
11. "type": "dxl-core-event in",
12. "z": "3bcf37ef.a9d108",
13. "name": "Receive MISP Event Publish Notifications",
14. "topic": "/opendxl-misp/event/zeromq-notifications/misp_json",
15. "client": "cc766472.7a4b28",
16. "payloadType": "obj",
17. "x": 180,
18. "y": 60,
19. "wires": [
20. [
21. "9e6420fb.a4d33",
22. "945c3d8c.86648"
23. ]
24. ]
25. },
26. {
27. "id": "5fb31223.b5578c",
28. "type": "debug",
29. "z": "3bcf37ef.a9d108",
30. "name": "Debug: Sighting Request",
31. "active": true,
32. "tosidebar": true,
33. "console": false,
34. "tostatus": false,
35. "complete": "payload",
36. "x": 770,
37. "y": 414,
38. "wires": []
39. },
40. {
41. "id": "9e6420fb.a4d33",
42. "type": "function",
43. "z": "3bcf37ef.a9d108",
44. "name": "Extract Hash-based Attributes",
45. "func": "var output = []\n\nif(msg.payload && \n msg.payload.Event &&\n msg.payload.Event.Attribute) {\n var attribs = msg.payload.Event.Attribute\n attribs.forEach(function(entry) {\n if(entry.type == \"md5\" ||\n entry.type == \"sha1\" ||\n entry.type == \"sha256\") {\n output.push({\n \"uuid\": entry.uuid,\n \"type\": entry.type,\n \"value\": entry.value\n });\n }\n });\n}\nmsg.payload = output;\nreturn msg;",
46. "outputs": 1,
47. "noerr": 0,
48. "x": 210,
49. "y": 140,
50. "wires": [
51. [
52. "28fb53c3.5229cc"
53. ]
54. ]
55. },
56. {
57. "id": "8e254ff0.db295",
58. "type": "function",
59. "z": "3bcf37ef.a9d108",
60. "name": "Extract Found Host IP Addresses",
61. "func": "msg.payload = \n msg.payload.map(function (processEntry) {\n return processEntry.output[\"HostInfo|ip_address\"]\n })\nreturn msg",
62. "outputs": 1,
63. "noerr": 0,
64. "x": 360,
65. "y": 294,
66. "wires": [
67. [
68. "cbbd0543.94c9e8"
69. ]
70. ]
71. },
72. {
73. "id": "cbbd0543.94c9e8",
74. "type": "split",
75. "z": "3bcf37ef.a9d108",
76. "name": "Execute for each IP address",
77. "splt": "\\n",
78. "spltType": "str",
79. "arraySplt": 1,
80. "arraySpltType": "len",
81. "stream": false,
82. "addname": "",
83. "x": 420,
84. "y": 354,
85. "wires": [
86. [
87. "2166f5bc.f4597a"
88. ]
89. ]
90. },
91. {
92. "id": "51a75203.b4424c",
93. "type": "function",
94. "z": "3bcf37ef.a9d108",
95. "name": "Compose MAR Search Condition",
96. "func": "msg.mispHash = msg.payload;\nmsg.conditions = {\n \"or\": [{\n \"and\": [{\n \"name\": \"Files\",\n \"output\": msg.mispHash.type,\n \"op\": \"EQUALS\",\n \"value\": msg.mispHash.value\n }]\n }]\n};\n\nreturn msg;\n",
97. "outputs": 1,
98. "noerr": 0,
99. "x": 620,
100. "y": 200,
101. "wires": [
102. [
103. "354b7393.e9e4ac"
104. ]
105. ]
106. },
107. {
108. "id": "d95da896.6b2648",
109. "type": "dxl-core-request",
110. "z": "3bcf37ef.a9d108",
111. "name": "Add Sighting to MISP Event",
112. "topic": "/opendxl-misp/service/misp-api/sighting",
113. "client": "cc766472.7a4b28",
114. "returnType": "txt",
115. "x": 780,
116. "y": 474,
117. "wires": [
118. [
119. "7fd94d76.8ea7d4"
120. ]
121. ]
122. },
123. {
124. "id": "2166f5bc.f4597a",
125. "type": "template",
126. "z": "3bcf37ef.a9d108",
127. "name": "Format Add Sighting Request",
128. "field": "payload",
129. "fieldType": "msg",
130. "format": "handlebars",
131. "syntax": "mustache",
132. "template": "{\n \"uuid\": \"{{mispHash.uuid}}\",\n \"type\": \"0\",\n \"source\": \"Observed on system {{payload}}\"\n}",
133. "output": "json",
134. "x": 470,
135. "y": 474,
136. "wires": [
137. [
138. "d95da896.6b2648",
139. "5fb31223.b5578c"
140. ]
141. ]
142. },
143. {
144. "id": "28fb53c3.5229cc",
145. "type": "split",
146. "z": "3bcf37ef.a9d108",
147. "name": "Execute MAR Search for each Hash",
148. "splt": "\\n",
149. "spltType": "str",
150. "arraySplt": 1,
151. "arraySpltType": "len",
152. "stream": false,
153. "addname": "",
154. "x": 290,
155. "y": 200,
156. "wires": [
157. [
158. "51a75203.b4424c"
159. ]
160. ]
161. },
162. {
163. "id": "7fd94d76.8ea7d4",
164. "type": "debug",
165. "z": "3bcf37ef.a9d108",
166. "name": "Debug: Response",
167. "active": true,
168. "tosidebar": true,
169. "console": false,
170. "tostatus": false,
171. "complete": "payload",
172. "x": 1030,
173. "y": 474,
174. "wires": []
175. },
176. {
177. "id": "945c3d8c.86648",
178. "type": "debug",
179. "z": "3bcf37ef.a9d108",
180. "name": "Debug: Received Event",
181. "active": true,
182. "tosidebar": true,
183. "console": false,
184. "tostatus": false,
185. "complete": "payload",
186. "x": 570,
187. "y": 60,
188. "wires": []
189. },
190. {
191. "id": "354b7393.e9e4ac",
192. "type": "dxl-mar-search",
193. "z": "3bcf37ef.a9d108",
194. "name": "",
195. "pollInterval": 5,
196. "client": "cc766472.7a4b28",
197. "projections": "[\n {\n \"name\": \"HostInfo\", \n \"outputs\": [\"ip_address\"]\n }\n]",
198. "limit": "",
199. "textFilter": "",
200. "sortBy": "",
201. "sortDirection": "",
202. "returnType": "obj",
203. "x": 870,
204. "y": 200,
205. "wires": [
206. [
207. "8e254ff0.db295"
208. ]
209. ]
210. }
211. ]

Display More