Skip to content

Commit 6ea18d4

Browse files
gtbackgtback
authored
Merge pull request #84 from awest1339/master
Use argparse to parse CL args
2 parents 9dced3f + eca294a commit 6ea18d4

4 files changed

Lines changed: 176 additions & 192 deletions

File tree

‎scripts/maec_4.0.1_to_4.1.py‎

100644100755
Lines changed: 88 additions & 88 deletions
Original file line numberDiff line numberDiff line change
@@ -1,88 +1,88 @@
1-
# MAEC 4.0.1 to MAEC 4.1 Converter Script
2-
# Translates a MAEC 4.0.1 Package or Bundle into a valid MAEC 4.1 Package or Bundle
3-
4-
import sys
5-
import os
6-
import shutil
7-
import maec
8-
from maec.bundle.bundle import Bundle
9-
from maec.package.package import Package
10-
11-
# Update the MAEC v4.0.1 file to MAEC v4.1
12-
def update_maec(infilename, outfilename):
13-
# Parse the input document using the parse_xml_instance() method
14-
maec_objects = maec.parse_xml_instance(infilename, check_version = False)
15-
16-
# Get the API Object from the parsed input
17-
api_object = maec_objects['api']
18-
19-
# Determine if we're dealing with a Package or Bundle
20-
if isinstance(api_object, Package):
21-
# Update the Package schema_version
22-
api_object.schema_version = "2.1"
23-
for malware_subject in api_object.malware_subjects:
24-
for analysis in malware_subject.analyses:
25-
# Replace the Analysis type value of "manual" with "in-depth"
26-
if analysis.type and analysis.type == "manual":
27-
analysis.type = "in-depth"
28-
# Update the schema_versions on the Bundles
29-
for bundle in malware_subject.findings_bundles.bundles:
30-
bundle.schema_version = "4.1"
31-
elif isinstance(api_object, Bundle):
32-
# Update the Bundle schema_version
33-
api_object.schema_version = "4.1"
34-
35-
# Output the updated MAEC object to XML
36-
api_object.to_xml_file(outfilename)
37-
38-
# Print the usage text
39-
def usage():
40-
print USAGE_TEXT
41-
sys.exit(1)
42-
43-
USAGE_TEXT = """
44-
MAEC 4.0.1 --> MAEC 4.1 XML Converter Utility
45-
46-
Usage: python maec_4.0.1_to_4.1.py -i <input maec 4.0.1 xml file> -o <output maec 4.1 xml file>
47-
"""
48-
49-
def main():
50-
infilename = None
51-
outfilename = None
52-
directoryname = ''
53-
filepath = ''
54-
55-
#Get the command-line arguments
56-
args = sys.argv[1:]
57-
58-
if len(args) < 2:
59-
usage()
60-
sys.exit(1)
61-
62-
for i in range(0,len(args)):
63-
if args[i] == '-i':
64-
infilename = args[i+1]
65-
elif args[i] == '-o':
66-
outfilename = args[i+1]
67-
elif args[i] == '-d':
68-
directoryname = args[i+1]
69-
70-
if directoryname != '':
71-
for filename in os.listdir(directoryname):
72-
print filename
73-
if '.xml' not in filename:
74-
pass
75-
elif '_report.maec-4.0.1' not in filename:
76-
update_maec(os.path.join(directoryname, filename), filename.rstrip('.xml') + '_cuckoobox_maec.xml')
77-
else:
78-
new_filepath = os.path.join(directoryname, filename.replace('_report.maec-4.0.1', ''))
79-
shutil.move(os.path.join(directoryname, filename), new_filepath)
80-
update_maec(new_filepath, new_filepath.rstrip('.xml') + '_cuckoobox_maec.xml')
81-
82-
# Basic parameter checking
83-
elif infilename and outfilename:
84-
update_maec(infilename, outfilename)
85-
86-
if __name__ == "__main__":
87-
main()
88-
1+
# MAEC 4.0.1 to MAEC 4.1 Converter Script
2+
# Translates a MAEC 4.0.1 Package or Bundle into a valid MAEC 4.1 Package or Bundle
3+
4+
import sys
5+
import os
6+
import shutil
7+
import argparse
8+
import maec
9+
from maec.bundle.bundle import Bundle
10+
from maec.package.package import Package
11+
12+
# Update the MAEC v4.0.1 file to MAEC v4.1
13+
def update_maec(infilename, outfilename):
14+
# Parse the input document using the parse_xml_instance() method
15+
maec_objects = maec.parse_xml_instance(infilename, check_version = False)
16+
17+
# Get the API Object from the parsed input
18+
api_object = maec_objects['api']
19+
20+
# Determine if we're dealing with a Package or Bundle
21+
if isinstance(api_object, Package):
22+
# Update the Package schema_version
23+
api_object.schema_version = "2.1"
24+
for malware_subject in api_object.malware_subjects:
25+
for analysis in malware_subject.analyses:
26+
# Replace the Analysis type value of "manual" with "in-depth"
27+
if analysis.type and analysis.type == "manual":
28+
analysis.type = "in-depth"
29+
# Update the schema_versions on the Bundles
30+
for bundle in malware_subject.findings_bundles.bundles:
31+
bundle.schema_version = "4.1"
32+
elif isinstance(api_object, Bundle):
33+
# Update the Bundle schema_version
34+
api_object.schema_version = "4.1"
35+
36+
# Output the updated MAEC object to XML
37+
api_object.to_xml_file(outfilename)
38+
39+
# Print the usage text
40+
def usage():
41+
print USAGE_TEXT
42+
sys.exit(1)
43+
44+
USAGE_TEXT = """
45+
MAEC 4.0.1 --> MAEC 4.1 XML Converter Utility
46+
Usage: python maec_4.0.1_to_4.1.py -i <input maec 4.0.1 xml file> -o <output maec 4.1 xml file>
47+
"""
48+
49+
def main():
50+
# Setup the argument parser
51+
parser = argparse.ArgumentParser(
52+
description='MAEC 4.0.1 --> MAEC 4.1 XML Converter Utility'
53+
)
54+
mutex_group = parser.add_mutually_exclusive_group(required=True)
55+
required_name = parser.add_argument_group('required arguments')
56+
mutex_group.add_argument(
57+
'--input', '-i',
58+
help='input maec 4.0.1 xml file'
59+
)
60+
mutex_group.add_argument(
61+
'--directory', '-d',
62+
help='directory containing maec 4.0.1 xml files to convert to 4.1 xml files'
63+
)
64+
required_name.add_argument(
65+
'--output', '-o', required=True,
66+
help='output maec 4.1 xml file'
67+
)
68+
69+
args = parser.parse_args()
70+
71+
if args.directory:
72+
for filename in os.listdir(args.directory):
73+
print filename
74+
if '.xml' not in filename:
75+
pass
76+
elif '_report.maec-4.0.1' not in filename:
77+
update_maec(os.path.join(args.directory, filename), filename.rstrip('.xml') + '_cuckoobox_maec.xml')
78+
else:
79+
new_filepath = os.path.join(args.directory, filename.replace('_report.maec-4.0.1', ''))
80+
shutil.move(os.path.join(args.directory, filename), new_filepath)
81+
update_maec(new_filepath, new_filepath.rstrip('.xml') + '_cuckoobox_maec.xml')
82+
83+
# Basic parameter checking
84+
elif args.input and args.output:
85+
update_maec(args.input, args.output)
86+
87+
if __name__ == "__main__":
88+
main()

‎scripts/merge_packages.py‎

100644100755
Lines changed: 50 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -1,59 +1,50 @@
1-
# merge_packages script
2-
# v0.10 BETA
3-
# Merges two or more MAEC Package documents (.xml files)
4-
# Attempts to merge related Malware Subjects
5-
import sys
6-
import os
7-
import maec
8-
from maec.utils.merge import merge_documents
9-
10-
USAGE_TEXT = """
11-
MAEC Package Merge Script v0.10 BETA
12-
*Merges two or more MAEC Package XML documents
13-
*Attempts to merge related (e.g., same MD5 hash) Malware Subjects
14-
15-
Usage: python merge_packages.py -o <output file name> -l <single whitespace separated list of MAEC Package files> OR -d <directory name>
16-
"""
17-
18-
def main():
19-
infilenames = []
20-
list_mode = False
21-
directoryname = ''
22-
outfilename = ''
23-
24-
#Get the command-line arguments
25-
args = sys.argv[1:]
26-
27-
if len(args) < 3:
28-
print USAGE_TEXT
29-
sys.exit(1)
30-
31-
for i in range(0,len(args)):
32-
if args[i] == '-o':
33-
outfilename = args[i+1]
34-
elif args[i] == '-l':
35-
list_mode = True
36-
elif args[i] == '-d':
37-
directoryname = args[i+1]
38-
39-
if outfilename == '':
40-
print USAGE_TEXT
41-
sys.exit(1)
42-
43-
sys.stdout.write("Merging...")
44-
# Get the list of input files and perform the merge operation
45-
if list_mode:
46-
files = args[3:]
47-
merge_documents(files, outfilename)
48-
elif directoryname != '':
49-
file_list = []
50-
for filename in os.listdir(directoryname):
51-
if '.xml' not in filename:
52-
pass
53-
else:
54-
file_list.append(os.path.join(directoryname, filename))
55-
merge_documents(file_list, outfilename)
56-
sys.stdout.write("Done.")
57-
58-
if __name__ == "__main__":
59-
main()
1+
# merge_packages script
2+
# v0.10 BETA
3+
# Merges two or more MAEC Package documents (.xml files)
4+
# Attempts to merge related Malware Subjects
5+
import sys
6+
import os
7+
import argparse
8+
import maec
9+
from maec.utils.merge import merge_documents
10+
11+
USAGE_TEXT = """
12+
MAEC Package Merge Script v0.10 BETA
13+
*Merges two or more MAEC Package XML documents
14+
*Attempts to merge related (e.g., same MD5 hash) Malware Subjects
15+
"""
16+
17+
def main():
18+
parser = argparse.ArgumentParser(description=USAGE_TEXT)
19+
mutex_group = parser.add_mutually_exclusive_group(required=True)
20+
required_group = parser.add_argument_group('required arguments')
21+
mutex_group.add_argument(
22+
'-l', '--list', nargs='+',
23+
help='single whitespace separated list of MAEC Package files'
24+
)
25+
mutex_group.add_argument(
26+
'-d', '--directory',
27+
help='directory name'
28+
)
29+
required_group.add_argument(
30+
'-o', '--output', required=True,
31+
help='output file name'
32+
)
33+
args = parser.parse_args()
34+
35+
sys.stdout.write("Merging...")
36+
# Get the list of input files and perform the merge operation
37+
if args.list:
38+
merge_documents(args.list, args.output)
39+
elif args.directory:
40+
file_list = []
41+
for filename in os.listdir(args.directory):
42+
if '.xml' not in filename:
43+
pass
44+
else:
45+
file_list.append(os.path.join(args.directory, filename))
46+
merge_documents(file_list, args.output)
47+
sys.stdout.write("Done.")
48+
49+
if __name__ == "__main__":
50+
main()

‎scripts/run_comparator.py‎

Lines changed: 19 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44
import pprint
55
import sys
66
import os
7+
import argparse
78
import maec
89
from maec.bundle.bundle import Bundle
910
from maec.package.package import Package
@@ -12,8 +13,6 @@
1213
MAEC Run Comparator Script v0.11 BETA
1314
*Performs Object->Object comparison of 2 or more input MAEC documents
1415
*Prints common/unique Objects between MAEC Bundles
15-
16-
Usage: python run_comparator.py -l <single whitespace separated list of MAEC files> OR -d <directory name>
1716
"""
1817

1918
# Process a set of MAEC binding objects and extract the Bundles as appropriate
@@ -29,36 +28,31 @@ def process_maec_file(filename, bundle_list):
2928
bundle_list.append(parsed_objects['api'])
3029

3130
def main():
32-
infilenames = []
33-
list_mode = False
34-
directoryname = ''
31+
parser = argparse.ArgumentParser(description=USAGE_TEXT)
32+
mutex_group = parser.add_mutually_exclusive_group(required=True)
33+
mutex_group.add_argument(
34+
'-l', '--list', nargs='+',
35+
help='single whitespace separated list of MAEC files'
36+
)
37+
mutex_group.add_argument(
38+
'-d', '--directory',
39+
help='directory name'
40+
)
41+
args = parser.parse_args()
42+
3543
# List of Bundle instances to compare
3644
bundle_list = []
37-
38-
#Get the command-line arguments
39-
args = sys.argv[1:]
40-
41-
if len(args) < 2:
42-
print USAGE_TEXT
43-
sys.exit(1)
4445

45-
for i in range(0,len(args)):
46-
if args[i] == '-l':
47-
list_mode = True
48-
elif args[i] == '-d':
49-
directoryname = args[i+1]
50-
5146
# Parse the input files and get the MAEC Bundles from each
52-
if list_mode:
53-
files = args[1:]
54-
for file in files:
47+
if args.list:
48+
for file in args.list:
5549
process_maec_file(file, bundle_list)
56-
elif directoryname != '':
57-
for filename in os.listdir(directoryname):
50+
elif args.directory:
51+
for filename in os.listdir(args.directory):
5852
if '.xml' not in filename:
5953
pass
6054
else:
61-
process_maec_file(os.path.join(directoryname, filename), bundle_list)
55+
process_maec_file(os.path.join(args.directory, filename), bundle_list)
6256

6357
# Matching properties dictionary
6458
match_on_dictionary = {'FileObjectType': ['file_path'],
@@ -75,4 +69,4 @@ def main():
7569
pprint.pprint(comparison_results.get_unique())
7670
print "****************************"
7771
if __name__ == "__main__":
78-
main()
72+
main()

0 commit comments

Comments
 (0)