misp-modules
misp-modules copied to clipboard
pcap import module
It would be nice to have a module allowing you to upload a PCAP, which then does the
- [ ] file extraction
- [ ] email extraction (and related IOCs)
- [ ] http/https
- [ ] dns
- [ ] ...
This module could use the code of other modules for parsing data (such as the email import module)
Having something generic on top of pypcapkit would be really nice as the reassembly is supported by pypcapkit:
- https://pypi.org/project/pypcapkit/
- https://github.com/JarryShaw/pypcapkit