Skip to content

Commit 64989e5

Browse files
DavidCrucianiDavidCruciani
committed
first commit, miss api part
1 parent 42003c7 commit 64989e5

28 files changed

+339
-0
lines changed

‎.nojekyll

Whitespace-only changes.

‎docs/_coverpage.md

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
![logo](images/flowintel.png)
2+
3+
> Designed to assist analysts in organizing their cases and tasks.
4+
5+
- Simple and lightweight
6+
7+
[GitHub](https://github.com/flowintel/flowintel/)
8+
[Getting Started](#flowintel)

‎docs/_sidebar.md

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
- [Quick start](docs/installation.md)
2+
- [Configuration](docs/installation.md#configuration)
3+
- [Installation](docs/installation.md#installation)
4+
- [Dockerfile](docs/installation.md#dockerfile)
5+
- [Docker Image](docs/installation.md#docker-image)
6+
- [Connectors](docs/connectors.md "Connect external tools")
7+
- [Modules](docs/connectors.md#modules)
8+
- [Analyzers](docs/analyzers.md "Analyze with external tools")
9+
- [Connectors vs Analyzers](docs/connectors_analyzers.md)
10+
- [Importer](docs/importer.md)
11+
- [Notifications](docs/notifications.md)
12+
- [API](docs/api.md)
13+
- [Screenshots](docs/screenshots.md "Some screenshots of the project")
14+
- [Contributions](docs/contributions.md "How to contribute to the project")

‎docs/analyzers.md

+37
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
# Analyzers
2+
3+
An analyzer is a connected tool which will receive and send back data to flowintel.
4+
5+
![](../images/flowintel_analyzers.png)
6+
7+
After a selection in notes, send this to an analyzer, here it's [misp-modules](https://github.com/MISP/misp-modules) that is used as analyzer. You'll be redirect to misp-modules main page with pre-filled fields. After a research, results can be send to flowintel and populate notes with them.
8+
9+
# Format
10+
11+
### From flowintel
12+
13+
Array of string. Each element is a new line of `Note selected`. (see `/analyzer` in flowintel)
14+
15+
*<u>example</u>* `["8.8.8.8", "127.0.0.1",...]` or `["circl.lu", "google.com",...]`
16+
17+
### To flowintel
18+
19+
Dictionary
20+
21+
```json
22+
{
23+
"8.8.8.8": { // Element queried
24+
"circl_passivedns": { // module used in the analyzer
25+
"results"{ // required key
26+
...
27+
}
28+
},
29+
"dns": {
30+
...
31+
        }
32+
},
33+
"127.0.0.1": {
34+
...
35+
}
36+
}
37+
```

‎docs/api.md

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# API
2+
3+

‎docs/connectors.md

+37
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
# Connectors
2+
3+
A connector represent the tool you want to connect to, it will contain instances which contains information to connect and use the tool.
4+
5+
An instance is usable by multiple cases but in each case an identifier is to be defined manually or will be defined by the module that will use the instance.
6+
7+
<img title="" src="../images/flowintel_connectors.png" alt="" width="508">
8+
9+
## Modules
10+
11+
A module is a script that use flowintel data and send it to an other tool in a compatible
12+
13+
### Create your own module
14+
15+
You can find an example [here](https://github.com/flowintel/flowintel/blob/main/app/modules/send_to/misp_event.py)
16+
17+
You need at least to fill those two things:
18+
19+
```python
20+
module_config = {
21+
"connector": "", # type of connector to use, can be removed
22+
"case_task": "" # 'case' or 'task'
23+
}
24+
25+
def handler(instance, case, user):
26+
"""
27+
instance: Info about the connector like name, api_key...
28+
case: Dictionary with all case info, including all its tasks
29+
user: Info on the user who use the module
30+
"""
31+
# Write your code here
32+
# ...
33+
```
34+
35+
Save your module in the directory that correspond to the type of your module:
36+
37+
`flowintel/app/modules`

‎docs/connectors_analyzers.md

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
# Connectors vs Analyzers
2+
3+
Connectors and Analyzers are not the same but have some similarities that can be confusing.
4+
5+
![](../images/flowintel_connections.png)
6+
7+
Analyzers receive data from flowintel and can send data to flowintel to enrich notes of cases or tasks.
8+
9+
Connectors can only receive data from flowintel. In the case of MISP, this will result in the creation of an event with a flowintel-cm-case object for a case and a flowintel-cm-task object for a task.

‎docs/contributions.md

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# Contributions
2+
3+
Every Contributions is more than welcome and can be found on [github](https://github.com/flowintel/flowintel).
4+
5+
## Ideas
6+
7+
For ideas go on the [issues](https://github.com/flowintel/flowintel/issues) page.
8+
9+
## Pull requests
10+
11+
For pull requests go on the [pull requests](https://github.com/flowintel/flowintel/pulls) page.

‎docs/home.md

+37
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
<a id="flowintel"></a>
2+
3+
![](images/flowintel.png)
4+
5+
> Support analysts to organize their case and tasks
6+
7+
## Features
8+
9+
- **Case and Task Management**: Tailored for security analysts, enabling efficient tracking and organization.
10+
11+
- **Rich Documentation Tools**: Includes Markdown and Mermaid integration for detailed notes, with export options like PDF.
12+
13+
- **Integration with MISP standard**: Seamless connection with [MISP taxonomies](https://github.com/MISP/misp-taxonomies) and [MISP galaxy](https://www.misp-galaxy.org/).
14+
15+
- **Calendar and Notifications**: Features an efficient calendar view and notifications for timely task management.
16+
17+
- **Templating System**: Provides templates for cases and tasks, creating a playbook and process repository for cybersecurity.
18+
19+
- **Flexible Data Export**: Offers modules for exporting data to platforms like [MISP](https://www.misp-project.org/), [AIL](https://www.ail-project.org/), and more.
20+
21+
- **Accessible API**: Exposes an API for easy interaction with FlowIntel CM's functionalities.
22+
23+
![task-management](images/case_example.png)
24+
25+
## License
26+
27+
This software is licensed under [GNU Affero General Public License version 3](http://www.gnu.org/licenses/agpl-3.0.html)
28+
29+
```
30+
Copyright (C) 2022-2023 CIRCL - Computer Incident Response Center Luxembourg
31+
Copyright (C) 2022-2023 David Cruciani
32+
```
33+
34+
## Funding
35+
36+
![CIRCL.lu](https://www.circl.lu/assets/images/logo.png)
37+
![CEF Telecom funding (D4 Project](https://www.misp-project.org/assets/images/en_cef.png)

‎docs/importer.md

+37
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
# Importer
2+
3+
To import a case and its tasks, JSON is needed.
4+
5+
Here the format:
6+
7+
```json
8+
{
9+
"title": "Super Case",
10+
"description": "My super case for the documentation",
11+
"uuid": "0b1f9a85-0d38-46a1-b9dd-1eeea1608308",
12+
"deadline": null,
13+
"recurring_date": null,
14+
"recurring_type": null,
15+
"notes": "This case is just boring...",
16+
"tags": [],
17+
"clusters": [],
18+
"tasks": [
19+
{
20+
"title": "Prepare a super tea",
21+
"description": "Keep it as hot as possible",
22+
"uuid": "ddd271b4-d7f8-4af0-a9b3-46ad52aca1bf",
23+
"notes": [
24+
{
25+
"uuid": "",
26+
"note": "# Preparation\n- add one sugar\n",
27+
"task_uuid": "ddd271b4-d7f8-4af0-a9b3-46ad52aca1bf"
28+
}
29+
],
30+
"url": "",
31+
"deadline": null,
32+
"tags": ["PAP:RED"],
33+
"clusters": []
34+
}
35+
]
36+
}
37+
```

‎docs/installation.md

+51
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
# Quick start
2+
3+
This was tested only on Ubuntu.
4+
5+
### Configuration
6+
7+
First of all you need to change the main configuration:
8+
9+
```
10+
/conf/config.py
11+
```
12+
13+
If you plan to use module, have a look on the configuration file for module:
14+
15+
```
16+
/conf/config_module.py
17+
```
18+
19+
### Installation
20+
21+
After configuration you can run the installation script:
22+
23+
```bash
24+
./install.sh
25+
```
26+
27+
### Dockerfile
28+
29+
You have also the possibility to use the docker file:
30+
31+
```bash
32+
docker build
33+
docker run -t -i -p 7006:7006 ID_IMAGE
34+
```
35+
36+
### Docker image
37+
38+
There's an image already ready to use
39+
40+
```bash
41+
docker pull ghcr.io/flowintel/flowintel-cm:latest
42+
docker run -t -i -p 7006:7006 ID_IMAGE
43+
```
44+
45+
46+
47+
### Account
48+
49+
- email: `[email protected]`
50+
51+
- password: `admin`

‎docs/notifications.md

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# Notifications
2+
3+
Each time the bell is clicked on a task to notify a user a notification is send.
4+
5+
Regarding recurring case a screen is used. Every day at 2am the script create a notification for each recurring case for all users concern.
6+
7+
## Screen
8+
9+
To access the screen and eventually debug:
10+
11+
```bash
12+
screen -r fcm
13+
```
14+
15+
## Modules
16+
17+
It's possible to notify user using modules like email, matrix... Here an [example](https://github.com/flowintel/flowintel/blob/main/app/modules/notify_user/email.py).
18+
19+
If some parameters is needed to your own module, use [config_module.py](https://github.com/flowin.tel/flowintel/blob/main/conf/config_module.py)

‎docs/screenshots.md

+33
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# Screenshots
2+
3+
### Case
4+
5+
![](../images/case_example.png)
6+
7+
### My Assignment
8+
9+
![My Assignment](../images/my_assignment.png)
10+
11+
### Calendar
12+
13+
![Calendar](../images/calendar.png)
14+
15+
### Template
16+
17+
![Template Case](../images/template_case.png)
18+
19+
### Analyzer
20+
21+
![](../images/analyzer.png)
22+
23+
### Importer
24+
25+
![Importer](../images/importer.png)
26+
27+
### Orgs
28+
29+
![Org](../images/orgs.png)
30+
31+
### Users
32+
33+
![Users](../images/users.png)

‎favicon.ico

4.19 KB
Binary file not shown.

‎images/analyzer.png

139 KB
Loading

‎images/calendar.png

65 KB
Loading

‎images/case_example.png

136 KB
Loading

‎images/case_index.png

59.5 KB
Loading

‎images/flowintel.png

23 KB
Loading

‎images/flowintel_analyzers.png

45.7 KB
Loading

‎images/flowintel_connections.png

246 KB
Loading

‎images/flowintel_connectors.png

70.5 KB
Loading

‎images/importer.png

112 KB
Loading

‎images/my_assignment.png

78.4 KB
Loading

‎images/orgs.png

147 KB
Loading

‎images/template_case.png

96 KB
Loading

‎images/users.png

147 KB
Loading

‎index.html

+43
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
<!DOCTYPE html>
2+
<html lang="en">
3+
<head>
4+
<meta charset="UTF-8">
5+
<title>flowintel</title>
6+
<meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1" />
7+
<meta name="description" content="Description">
8+
<meta name="viewport" content="width=device-width, initial-scale=1.0, minimum-scale=1.0">
9+
<link rel="stylesheet" href="//cdn.jsdelivr.net/npm/docsify@4/lib/themes/vue.css">
10+
<!-- <link rel="stylesheet" href="//unpkg.com/docsify-themeable/dist/css/theme-simple.css"> -->
11+
<link rel="icon" href="./favicon.ico" />
12+
<style>
13+
.sidebar > h1 {
14+
/* margin-bottom: -.75em; */
15+
margin-top: .75em;
16+
}
17+
.sidebar > h1 img {
18+
height: 4em;
19+
}
20+
21+
</style>
22+
</head>
23+
<body>
24+
<div id="app">Loading...</div>
25+
<script>
26+
window.$docsify = {
27+
name: 'flowintel',
28+
logo: './images/flowintel.png',
29+
loadSidebar: 'docs/_sidebar.md',
30+
repo: 'https://github.com/flowintel/flowintel-cm',
31+
coverpage: 'docs/_coverpage.md',
32+
autoHeader: true,
33+
auto2top: true,
34+
homepage: 'docs/home.md',
35+
}
36+
</script>
37+
<!-- Docsify v4 -->
38+
<script src="//cdn.jsdelivr.net/npm/docsify@4"></script>
39+
<script src="//unpkg.com/docsify/lib/plugins/search.min.js"></script>
40+
<script src="//cdn.jsdelivr.net/npm/prismjs@1/components/prism-python.min.js"></script>
41+
<script src="//cdn.jsdelivr.net/npm/prismjs@1/components/prism-json.min.js"></script>
42+
</body>
43+
</html>

0 commit comments

Comments
 (0)