Skip to content

Commit b2bee0e

Browse files
julienloizeletjulienloizelet
committed
feat(*): init project
0 parents  commit b2bee0e

File tree

19 files changed

+6430
-0
lines changed

19 files changed

+6430
-0
lines changed

‎.github/workflows/doc-links.yml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
name: Documentation links
2+
3+
on:
4+
push:
5+
branches: [ main ]
6+
workflow_dispatch:
7+
8+
permissions:
9+
contents: read
10+
11+
jobs:
12+
markdown-test:
13+
name: Markdown files test
14+
runs-on: ubuntu-latest
15+
steps:
16+
17+
- name: Clone sources
18+
uses: actions/checkout@v4
19+
with:
20+
path: extension
21+
22+
- name: Launch localhost server
23+
run: |
24+
sudo npm install --global http-server
25+
http-server ./extension &
26+
27+
- name: Set up Ruby 2.6
28+
uses: ruby/setup-ruby@v1
29+
with:
30+
ruby-version: 2.6
31+
32+
- name: Check links in Markdown files
33+
run: |
34+
gem install awesome_bot
35+
cd extension
36+
awesome_bot --files README.md --allow-dupe --allow-redirect --allow 401 --skip-save-results --base-url http://localhost:8080/
37+
awesome_bot docs/*.md --allow-dupe --allow-redirect --allow 401 --white-list http://localhost:80 --skip-save-results --base-url http://localhost:8080/docs/

‎.github/workflows/release.yml‎

Lines changed: 140 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,140 @@
1+
name: Create release
2+
# example: gh workflow run release.yml -f tag_name=v1.1.4
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
tag_name:
7+
type: string
8+
required: true
9+
description: Tag name
10+
first-release:
11+
type: boolean
12+
description: First release
13+
default: false
14+
15+
jobs:
16+
create-release:
17+
name: Create release
18+
runs-on: ubuntu-latest
19+
permissions:
20+
contents: write
21+
env:
22+
EXTENSION_ZIP_NAME: "crowdsec-misp-module"
23+
INPUT_TAG_NAME: ${{ github.event.inputs.tag_name }}
24+
25+
steps:
26+
- name: Check naming convention
27+
run: |
28+
VERIF=$(echo ${{ env.INPUT_TAG_NAME }} | grep -E "^v([0-9]{1,}\.)([0-9]{1,}\.)([0-9]{1,})(-(alpha|beta)\.[0-9]{1,})?$")
29+
if [ ! ${VERIF} ]
30+
then
31+
echo "Tag name does not comply with naming convention vX.Y.Z"
32+
exit 1
33+
fi
34+
35+
- name: Set version number env variables
36+
run: |
37+
# Set version number without v
38+
echo "VERSION_NUMBER=$(echo ${{ env.INPUT_TAG_NAME }} | sed 's/v//g')" >> $GITHUB_ENV
39+
# Set version with only major and minor
40+
echo "VERSION_MAJOR_MINOR=$(echo ${{ env.INPUT_TAG_NAME }} | sed 's/v//g' | cut -d. -f1,2)" >> $GITHUB_ENV
41+
# version with only major and minor and _ as separator
42+
echo "VERSION_MAJOR_MINOR_UNDERSCORE=$(echo ${{ env.INPUT_TAG_NAME }} | sed 's/v//g' | cut -d. -f1,2 | sed 's/\./_/g')" >> $GITHUB_ENV
43+
44+
- name: Set version sources
45+
run: |
46+
echo "VERSION_SOURCES=$(echo ${{ env.EXTENSION_ZIP_NAME }}-${{ env.VERSION_NUMBER }} )" >> $GITHUB_ENV
47+
48+
- name: Clone sources
49+
uses: actions/checkout@v4
50+
with:
51+
path: ${{ env.VERSION_SOURCES }}
52+
53+
- name: Check version ${{ env.VERSION_NUMBER }} consistency in files and folder
54+
# CHANGELOG.md, src/misp_modules/modules/expansion/crowdsec.py
55+
run: |
56+
cd ${{ env.VERSION_SOURCES }}
57+
# Check top ## [VERSION_NUMBER](GITHUB_URL/releases/tag/vVERSION_NUMBER) - yyyy-mm-dd in CHANGELOG.md
58+
# Example: ## [0.0.2](https://github.com/crowdsecurity/cs-thehive-cortex-analyzer/releases/tag/v0.0.2) - 2024-02-07
59+
CURRENT_DATE=$(date +'%Y-%m-%d')
60+
echo $CURRENT_DATE
61+
CHANGELOG_VERSION=$(grep -o -E "## \[(.*)\].* - $CURRENT_DATE" CHANGELOG.md | head -1 | sed 's/ //g')
62+
echo $CHANGELOG_VERSION
63+
if [[ $CHANGELOG_VERSION == "##[${{ env.VERSION_NUMBER }}]($GITHUB_SERVER_URL/$GITHUB_REPOSITORY/releases/tag/v${{ env.VERSION_NUMBER }})-$CURRENT_DATE" ]]
64+
then
65+
echo "CHANGELOG VERSION OK"
66+
else
67+
echo "CHANGELOG VERSION KO"
68+
echo $CHANGELOG_VERSION
69+
exit 1
70+
fi
71+
# Check top [_Compare with previous release_](GITHUB_URL/compare/vLAST_TAG...vVERSION_NUMBER) in CHANGELOG.md
72+
# Example: [_Compare with previous release_](https://github.com/crowdsecurity/python-capi-sdk/compare/v0.0.1...v0.0.2)
73+
if [[ ${{ github.event.inputs.first-release }} != "true" ]]
74+
then
75+
COMPARISON=$(grep -oP "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/compare/\K(.*)$" CHANGELOG.md | head -1)
76+
LAST_TAG=$(curl -Ls -o /dev/null -w %{url_effective} $GITHUB_SERVER_URL/$GITHUB_REPOSITORY/releases/latest | grep -oP "\/tag\/\K(.*)$")
77+
if [[ $COMPARISON == "$LAST_TAG...v${{ env.VERSION_NUMBER }})" ]]
78+
then
79+
echo "VERSION COMPARISON OK"
80+
else
81+
echo "VERSION COMPARISON KO"
82+
echo $COMPARISON
83+
echo "$LAST_TAG...v${{ env.VERSION_NUMBER }})"
84+
exit 1
85+
fi
86+
fi
87+
# Check "User-Agent": "crowdsec-misp/vVERSION_NUMBER", in src/misp_modules/modules/expansion/crowdsec.py
88+
if [[ ${{ github.event.inputs.first-release }} != "true" ]]
89+
# First release has incorrect User-Agent (should be 2.0.0 as the moduleinfo version is 2.0)
90+
then
91+
UA_VERSION=$(grep -E "\"User-Agent\": \"crowdsec-misp\/v(.*)\"" src/misp_modules/modules/expansion/crowdsec.py | sed 's/ //g' | sed 's/"//g')
92+
if [[ $UA_VERSION == "User-Agent:crowdsec-misp/v${{ env.VERSION_NUMBER }}," ]]
93+
then
94+
echo "USER AGENT VERSION OK"
95+
else
96+
echo "USER AGENT VERSION KO"
97+
echo $UA_VERSION
98+
exit 1
99+
fi
100+
fi
101+
# Check "version": "VERSION_MAJOR_MINOR", in src/misp_modules/modules/expansion/crowdsec.py
102+
INFO_VERSION=$(grep -E "\"version\": \"${{ env.VERSION_MAJOR_MINOR }}\"" src/misp_modules/modules/expansion/crowdsec.py | sed 's/ //g' | sed 's/"//g')
103+
if [[ $INFO_VERSION == "version:${{ env.VERSION_MAJOR_MINOR }}," ]]
104+
then
105+
echo "INFO VERSION OK"
106+
else
107+
echo "INFO VERSION KO"
108+
echo $INFO_VERSION
109+
exit 1
110+
fi
111+
112+
- name: Create zip for MISP modules pull request
113+
run: |
114+
zip -r ${{ env.VERSION_SOURCES }}.zip ${{ env.VERSION_SOURCES }}/src
115+
116+
- name: Create Tag ${{ github.event.inputs.tag_name }}
117+
uses: actions/github-script@v7
118+
with:
119+
github-token: ${{ github.token }}
120+
script: |
121+
github.rest.git.createRef({
122+
owner: context.repo.owner,
123+
repo: context.repo.repo,
124+
ref: "refs/tags/${{ github.event.inputs.tag_name }}",
125+
sha: context.sha
126+
})
127+
128+
- name: Prepare release notes
129+
run: |
130+
# Retrieve release body and remove ---
131+
VERSION_RELEASE_NOTES=$(awk -v ver="[${{ env.VERSION_NUMBER }}]($GITHUB_SERVER_URL/$GITHUB_REPOSITORY/releases/tag/v${{ env.VERSION_NUMBER }})" '/^## / { if (p) { exit }; if ($2 == ver) { p=1; next} } p && NF' ${{ env.VERSION_SOURCES }}/CHANGELOG.md | sed ':a;N;$!ba;s/\n---/ /g')
132+
echo "$VERSION_RELEASE_NOTES" >> CHANGELOG.txt
133+
134+
- name: Create release ${{ env.VERSION_NUMBER }}
135+
uses: softprops/action-gh-release@v2
136+
with:
137+
files: ${{ env.VERSION_SOURCES }}.zip
138+
body_path: CHANGELOG.txt
139+
name: ${{ env.VERSION_NUMBER }}
140+
tag_name: ${{ env.INPUT_TAG_NAME }}

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
__pycache__

‎CHANGELOG.md‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
# Changelog
2+
All notable changes to this project will be documented in this file.
3+
4+
The format is based on [Keep a Changelog](https://keepachangelog.com/en/) and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
5+
6+
## SemVer public API
7+
8+
The [public API](https://semver.org/spec/v2.0.0.html#spec-item-1) for this project is defined by the set of functions provided by the `src/misp_modules/modules/expansion/crowdsec.py` file.
9+
10+
---
11+
12+
## [2.0.0](https://github.com/crowdsecurity/cs-misp-module/releases/tag/v2.0.0) - 2024-??-??
13+
14+
- Initial release: synchronization with MISP modules `v2.4.195` release

‎README.md‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
![CrowdSec Logo](https://raw.githubusercontent.com/crowdsecurity/cs-misp-module/main/docs/images/logo_crowdsec.png)
2+
3+
# MISP CrowdSec module
4+
5+
> Module which enriches your knowledge by using CrowdSec's CTI API.
6+
7+
[![Version](https://img.shields.io/github/v/release/crowdsecurity/cs-misp-module)](https://github.com/crowdsecurity/cs-misp-module/releases/)
8+
9+
## Usage
10+
11+
See [User Guide](https://github.com/crowdsecurity/cs-misp-module/blob/main/docs/USER_GUIDE.md)
12+
13+
## Installation
14+
15+
See [Installation Guide](https://github.com/crowdsecurity/cs-misp-module/blob/main/docs/INSTALLATION_GUIDE.md)
16+
17+
## Developer guide
18+
19+
See [Developer guide](https://github.com/crowdsecurity/cs-misp-module/blob/main/docs/DEVELOPER.md)
20+
21+
22+
23+

‎dev/docker-compose.override.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
services:
2+
misp-modules:
3+
volumes:
4+
- ../cs-misp-module/src/misp_modules/modules/expansion/crowdsec.py:/usr/local/lib/python3.12/site-packages/misp_modules/modules/expansion/crowdsec.py

‎docs/DEVELOPER.md‎

Lines changed: 137 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,137 @@
1+
![CrowdSec Logo](images/logo_crowdsec.png)
2+
# MISP CrowdSec module
3+
4+
## Developer guide
5+
6+
<!-- START doctoc generated TOC please keep comment here to allow auto update -->
7+
<!-- DON'T EDIT THIS SECTION, INSTEAD RE-RUN doctoc TO UPDATE -->
8+
9+
- [Local installation](#local-installation)
10+
- [Prepare local environment](#prepare-local-environment)
11+
- [Start Docker environment](#start-docker-environment)
12+
- [Stop Docker environment](#stop-docker-environment)
13+
- [Manual testing in UI](#manual-testing-in-ui)
14+
- [Update documentation table of contents](#update-documentation-table-of-contents)
15+
16+
<!-- END doctoc generated TOC please keep comment here to allow auto update -->
17+
18+
19+
## Local installation
20+
21+
### Prepare local environment
22+
23+
The final structure of the project will look like below.
24+
25+
```markdown
26+
crowdsec-misp (choose the name you want for this folder)
27+
│
28+
│
29+
└───misp-modules (do not change this folder name; Only needed for MISP Pull Request process)
30+
│ │
31+
│ │ (Clone of https://github.com/crowdsecurity/misp-modules)
32+
│
33+
└───misp-docker (do not change this folder name;)
34+
│ │
35+
│ │ (Clone of https://github.com/misp/misp-docker)
36+
│
37+
└───cs-misp-module (do not change this folder name)
38+
│
39+
│ (Clone of this repo)
40+
41+
```
42+
43+
- Create an empty folder that will contain all necessary sources:
44+
```bash
45+
mkdir crowdsec-misp && cd crowdsec-misp
46+
```
47+
48+
- Clone the fork of misp-modules repository:
49+
50+
```bash
51+
git clone [email protected]:crowdsecurity/misp-modules.git
52+
```
53+
54+
- Clone this repository:
55+
56+
``` bash
57+
git clone [email protected]:crowdsecurity/cs-misp-modules.git
58+
```
59+
60+
- Clone the MISP docker repository:
61+
62+
``` bash
63+
git clone [email protected]:misp/misp-docker.git
64+
```
65+
66+
### Start Docker environment
67+
68+
Before running the docker environment, we need to create a volume so that our local sources are mounted in the misp-modules container.
69+
70+
**Warning**: The python version that is hard-coded in the `docker-compose.override.yml` may change: it should be same version that is used by the misp-modules container.
71+
Please look the `python_version` value at the end of the `misp-modules/Pipfile` file.
72+
73+
```bash
74+
cp cs-misp-module/dev/docker-compose.override.yml misp-docker/
75+
```
76+
77+
We also need to create a `env` file:
78+
79+
```bash
80+
cp misp-docer/template.env misp-docker/.env
81+
```
82+
83+
Then, start the docker environment:
84+
85+
```bash
86+
cd misp-docker && docker compose up -d --build
87+
```
88+
89+
Once running, you can browse to your MISP instance at `http://localhost:80` and login with the default credentials that you can find in the `.env` file.
90+
91+
92+
### Stop Docker environment
93+
94+
To stop all containers:
95+
96+
```bash
97+
docker compose down
98+
```
99+
100+
To stop all containers and remove all data (if you want to come back to a fresh TheHive/Cortex installation):
101+
102+
```bash
103+
docker compose down -v
104+
```
105+
106+
## Manual testing in UI
107+
108+
When you have the docker environment running, you can test the module in the MISP UI.
109+
110+
After each modification in the module code, you need to restart the misp-modules container to apply the changes:
111+
112+
```bash
113+
docker compose restart misp-modules
114+
```
115+
116+
## Update documentation table of contents
117+
118+
To update the table of contents in the documentation, you can use [the `doctoc` tool](https://github.com/thlorenz/doctoc).
119+
120+
First, install it:
121+
122+
```bash
123+
npm install -g doctoc
124+
```
125+
126+
Then, run it in the documentation folder:
127+
128+
```bash
129+
doctoc docs/* --maxlevel 3
130+
```
131+
132+
133+
134+
135+
136+
137+

‎docs/INSTALLATION_GUIDE.md‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
![CrowdSec Logo](images/logo_crowdsec.png)
2+
3+
# MISP CrowdSec module
4+
5+
## Installation Guide
6+
7+
<!-- START doctoc generated TOC please keep comment here to allow auto update -->
8+
<!-- DON'T EDIT THIS SECTION, INSTEAD RE-RUN doctoc TO UPDATE -->
9+
10+
- [Requirements](#requirements)
11+
- [Installation](#installation)
12+
13+
<!-- END doctoc generated TOC please keep comment here to allow auto update -->
14+
15+
16+
## Requirements
17+
18+
- A CrowdSec CTI API key. See [instructions to obtain it](https://docs.crowdsec.net/docs/next/cti_api/getting_started/#getting-an-api-key)
19+
20+
21+
## Installation
22+
23+
Enabling this module could be done by browsing to the Plugins tab of your MISP instance:
24+
25+
- Navigate to plugin settings page at `http://<your_misp_address>/servers/serverSettings/Plugin`
26+
- Click on Enrichment
27+
- Set the value of `Plugin.Enrichment_crowdsec_enabled` to `true`
28+
- Set the value of `Plugin.Enrichment_crowdsec_api_key` to your CrowdSec CTI API key
29+

0 commit comments

Comments
 (0)