Realtime feed generator

[mokaddem]

Hi,
After a discussion with iglocska, adding lots of ephemeral attributes in a short time in MISP seems to be a bad idea.
Such a case can arise if we directly connect a honeypot to MISP.
Fortunately, MISP feeds could be a nice alternative.

Also, adding attributes and objects to daily generated events seems to be a common practice.

This PR provides scripts to ease the process of creating such a feed from the data producer, up to serving generated files to MISP.

Below is a brief summary of the files:

• generator.py exposes a class allowing to generate a MISP feed in real time, where each items can be added on daily generated events.
• fromredis.py uses generator.py to generate a MISP feed based on data stored in redis.
• server.py is a simple script using Flask_autoindex to serve data to MISP.
• MISPItemToRedis.py permits to push (in redis) items to be added in MISP by the fromredis.py consumer script.
• CowrieMISPObject.py constructor for the MISP cowrie object.

Any remarks or requests are more than welcome. :)

[codecov]

Codecov Report

Merging #204 into master will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##           master     #204   +/-   ##
=======================================
  Coverage   64.28%   64.28%           
=======================================
  Files          23       23           
  Lines        3408     3408           
=======================================
  Hits         2191     2191           
  Misses       1217     1217

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 658b149...6553519. Read the comment docs.

[coveralls]

Coverage remained the same at 64.29% when pulling 6553519 on mokaddem:redis-feed-generator into 658b149 on MISP:master.

[coveralls]

Coverage remained the same at 64.29% when pulling 6553519 on mokaddem:redis-feed-generator into 658b149 on MISP:master.

[adulau]

Cool! Thank you very much.

[iglocska]

Epic.

…

On Mon, Mar 12, 2018 at 5:08 PM, Alexandre Dulaunoy < ***@***.***> wrote: Cool! Thank you very much. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#204 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ADf6wEH_tptlTIGkfGdShOEahMU__HB7ks5tdp1mgaJpZM4Sm6o3> .