Python script that takes a csv file and turns it into a set of .json files which are VERIS 1.2 schema compliant. This script is for incidents where an external activist has defaced a website. #hacking #defacement #veris

deface-activisty.py

import json
import uuid
import copy
import csv 
import datetime
 
infile = csv.DictReader(open('list.csv','rU'))
template = {u'impact': {u'overall_rating': u'Unknown'}, u'incident_id': '', u'reference': '', u'attribute': {u'integrity': {u'notes': u'', u'variety': [u'Modify data', u'Misappropriation']}}, u'notes': u'', u'schema_version': u'1.2', u'summary': '', u'action': {u'hacking': {u'notes': u'', u'vector': [u'Web application'], u'variety': ['Unknown']}}, u'security_incident': u'Confirmed', u'plus': {u'f500': u'N', u'master_id': u'osint523', u'timeline': {u'notification': {}}}, u'actor': {u'external': {u'motive': ['Ideology'], u'country': [u'Unknown'], u'variety': ['Activist']}}, u'victim': [{u'victim_id': '', u'country': '', u'notes': u'', u'industry': ''}], u'timeline': {u'incident': {u'year': 2012}}, u'source_id': u'osint', u'discovery_method': u'Ext - actor disclosure', u'asset': {u'assets': [{u'variety': u'S - Web application'}]}}
 
for row in infile:
    incident = copy.copy(template)
    incident['victim'][0]['victim_id'] = row['vic.name']
    incident['victim'][0]['industry'] = row['vic.naics']
    incident['victim'][0]['country'] = row['vic.country']
    if row['actor.country'] != '': 
        incident['actor']['external']['country'] = [row['actor.country']]
    if row['actor.notes'] != '': 
        incident['actor']['external']['notes'] = row['actor.notes']
    incident['reference'] = row['reference']
    incident['summary'] = row['summary'].decode('ascii','ignore').encode('utf-8')
    notification_date = datetime.datetime.strptime(row['notification'],'%m/%d/%y')
    incident_date = datetime.datetime.strptime(row['incident'],'%m/%d/%y')
    incident['plus']['timeline']['notification']['month'] = notification_date.month
    incident['plus']['timeline']['notification']['day'] = notification_date.day
    incident['plus']['timeline']['notification']['year'] = notification_date.year
    incident['timeline']['incident']['month'] = incident_date.month
    incident['timeline']['incident']['day'] = incident_date.day
    incident['timeline']['incident']['year'] = incident_date.year
    identity = str(uuid.uuid4()).upper()
    incident['incident_id'] = identity
    incident['plus']['master_id'] = identity
    outfile = open(identity+'.json','w')
    outfile.write(json.dumps(incident,indent=2, sort_keys=True, separators=(',', ': ')))