mmisp-lib 0.1.0__py3-none-any.whl

mmisp/api_schemas/attributes/add_attribute_body.py

@@ -0,0 +1,34 @@
+from typing import Any, Optional
+
+from pydantic import BaseModel, root_validator
+
+
+class AddAttributeBody(BaseModel):
+    type: str
+    value: Optional[str]
+    value1: Optional[str]
+    value2: str | None = None
+    event_id: str | None = None
+    object_id: str | None = None
+    object_relation: str | None = None
+    category: str | None = None
+    to_ids: bool | None = None
+    uuid: str | None = None
+    timestamp: str | None = None
+    distribution: str | None = None
+    sharing_group_id: str | None = None
+    comment: str | None = None
+    deleted: bool | None = None
+    disable_correlation: bool | None = None
+    first_seen: str | None = None
+    last_seen: str | None = None
+
+    @root_validator
+    def ensure_value_or_value1_is_set(cls, data: dict[str, Any]) -> Optional[dict[str, Any]]:  # noqa: ANN101
+        required_values: list[str] = [str(data.get("value")), str(data.get("value1"))]
+        if all(item is None for item in required_values):
+            raise ValueError("value or value1 has to be set")
+        return data
+
+    class Config:
+        orm_mode = True

mmisp/api_schemas/attributes/add_attribute_response.py

@@ -0,0 +1,33 @@
+from typing import Optional
+
+from pydantic import BaseModel, Field
+
+
+class AddAttributeAttributes(BaseModel):
+    id: str
+    event_id: str
+    object_id: str
+    object_relation: Optional[str] = Field(..., nullable=True)
+    category: str
+    type: str
+    value: str
+    value1: str
+    value2: str
+    to_ids: bool
+    uuid: str
+    timestamp: str
+    distribution: str
+    sharing_group_id: str
+    comment: str
+    deleted: bool
+    disable_correlation: bool
+    first_seen: Optional[str] = Field(..., nullable=True)
+    last_seen: Optional[str] = Field(..., nullable=True)
+    attribute_tag: list[str] = Field([], alias="AttributeTag")
+
+
+class AddAttributeResponse(BaseModel):
+    Attribute: AddAttributeAttributes
+
+    class Config:
+        orm_mode = True

mmisp/api_schemas/attributes/add_remove_tag_attribute_response.py

@@ -0,0 +1,13 @@
+from typing import Optional
+
+from pydantic import BaseModel
+
+
+class AddRemoveTagAttributeResponse(BaseModel):
+    saved: bool
+    success: Optional[str]
+    check_publish: Optional[bool]
+    errors: Optional[str]
+
+    class Config:
+        orm_mode = True

mmisp/api_schemas/attributes/delete_attribute_response.py

@@ -0,0 +1,8 @@
+from pydantic import BaseModel
+
+
+class DeleteAttributeResponse(BaseModel):
+    message: str
+
+    class Config:
+        orm_mode = True

mmisp/api_schemas/attributes/delete_selected_attribute_body.py

@@ -0,0 +1,9 @@
+from pydantic import BaseModel
+
+
+class DeleteSelectedAttributeBody(BaseModel):
+    id: str  # id = "all" deletes all attributes in the event
+    allow_hard_delete: bool | None = None
+
+    class Config:
+        orm_mode = True

mmisp/api_schemas/attributes/delete_selected_attribute_response.py

@@ -0,0 +1,13 @@
+from pydantic import BaseModel
+
+
+class DeleteSelectedAttributeResponse(BaseModel):
+    saved: bool
+    success: bool
+    name: str
+    message: str
+    url: str
+    id: str
+
+    class Config:
+        orm_mode = True

mmisp/api_schemas/attributes/edit_attribute_body.py

@@ -0,0 +1,24 @@
+from pydantic import BaseModel
+
+
+class EditAttributeBody(BaseModel):
+    type: str | None = None
+    value: str | None = None
+    value1: str | None = None
+    value2: str | None = None
+    object_id: str | None = None
+    object_relation: str | None = None
+    category: str | None = None
+    to_ids: bool | None = None
+    uuid: str | None = None
+    timestamp: str | None = None
+    distribution: str | None = None
+    sharing_group_id: str | None = None
+    comment: str | None = None
+    deleted: bool | None = None
+    disable_correlation: bool | None = None
+    first_seen: str | None = None
+    last_seen: str | None = None
+
+    class Config:
+        orm_mode = True

mmisp/api_schemas/attributes/edit_attributes_response.py

@@ -0,0 +1,42 @@
+from pydantic import BaseModel
+
+
+class EditAttributeTag(BaseModel):
+    id: str
+    name: str
+    colour: str
+    exportable: str
+    user_id: str
+    hide_tag: bool
+    numerical_value: int
+    is_galaxy: bool
+    is_costum_galaxy: bool
+    local_only: bool
+
+
+class EditAttributeAttributes(BaseModel):
+    id: str
+    event_id: str
+    object_id: str
+    object_relation: str | None = None
+    category: str
+    type: str
+    value: str
+    to_ids: bool
+    uuid: str
+    timestamp: str
+    distribution: str
+    sharing_group_id: str
+    comment: str | None = None
+    deleted: bool
+    disable_correlation: bool
+    first_seen: str | None = None
+    last_seen: str | None = None
+    tag: list[EditAttributeTag]
+
+
+class EditAttributeResponse(BaseModel):
+    Attribute: EditAttributeAttributes
+
+    class Config:
+        orm_mode = True

mmisp/api_schemas/attributes/get_all_attributes_response.py

@@ -0,0 +1,38 @@
+from typing import Any, Dict, Optional
+
+from pydantic import BaseModel, validator
+
+
+class GetAllAttributesResponse(BaseModel):
+    id: str
+    event_id: str | None = None
+    object_id: str | None = None
+    object_relation: str | None = None
+    category: str | None = None
+    type: str
+    value1: str | None = None
+    value2: str | None = None
+    to_ids: bool | None = None
+    uuid: str | None = None
+    timestamp: str | None = None
+    distribution: str | None = None
+    sharing_group_id: str | None = None
+    comment: str | None = None
+    deleted: bool | None = None
+    disable_correlation: bool | None = None
+    first_seen: str | None = None
+    last_seen: str | None = None
+    value: str | None = None
+
+    @validator("sharing_group_id", always=True)
+    def check_sharing_group_id(cls, value: Any, values: Dict[str, Any]) -> Optional[int]:  # noqa: ANN101
+        """
+        If distribution equals 4, sharing_group_id will be shown.
+        """
+        distribution = values.get("distribution", None)
+        if distribution == "4" and value is not None:
+            return value
+        return None
+
+    class Config:
+        orm_mode = True

mmisp/api_schemas/attributes/get_attribute_response.py

@@ -0,0 +1,41 @@
+from typing import Optional
+
+from pydantic import BaseModel, Field
+
+
+class GetAttributeTag(BaseModel):
+    id: str
+    name: str
+    colour: str
+    numerical_value: int | None = None
+    is_galaxy: bool
+    local: bool
+
+
+class GetAttributeAttributes(BaseModel):
+    id: str
+    event_id: str
+    object_id: str
+    object_relation: Optional[str] = Field(..., nullable=True)
+    category: str
+    type: str
+    value: str
+    to_ids: bool
+    uuid: str
+    timestamp: str
+    distribution: str
+    sharing_group_id: str
+    comment: str | None = None
+    deleted: bool
+    disable_correlation: bool
+    first_seen: Optional[str] = Field(..., nullable=True)
+    last_seen: Optional[str] = Field(..., nullable=True)
+    event_uuid: str
+    tag: list[GetAttributeTag] | None = None
+
+
+class GetAttributeResponse(BaseModel):
+    Attribute: GetAttributeAttributes
+
+    class Config:
+        orm_mode = True

mmisp/api_schemas/attributes/get_attribute_statistics_response.py

@@ -0,0 +1,137 @@
+from pydantic import BaseModel, Field
+
+
+class GetAttributeStatisticsTypesResponse(BaseModel):
+    as_: str = Field(alias="AS")
+    attachment: str
+    authentihash: str
+    boolean: str
+    btc: str
+    campaign_id: str = Field(alias="campaign-id")
+    campaign_name: str = Field(alias="campaign-name")
+    comment: str
+    cookie: str
+    counter: str
+    cpe: str
+    date_of_birth: str = Field(alias="date-of-birth")
+    datetime: str
+    dns_soa_email: str = Field(alias="dns-soa-email")
+    domain: str
+    domain_ip: str = Field(alias="domain|ip")
+    email: str
+    email_attachment: str = Field(alias="email-attachment")
+    email_body: str = Field(alias="email-body")
+    email_dst: str = Field(alias="email-dst")
+    email_message_id: str = Field(alias="email-message-id")
+    email_mime_boundary: str = Field(alias="email-mime-boundary")
+    email_reply_to: str = Field(alias="email-reply-to")
+    email_src: str = Field(alias="email-src")
+    email_src_display_name: str = Field(alias="email-src-display-name")
+    email_subject: str = Field(alias="email-subject")
+    email_x_mailer: str = Field(alias="email-x-mailer")
+    filename: str
+    filename_pattern: str = Field(alias="filename-pattern")
+    filename_md5: str = Field(alias="filename|md5")
+    filename_sha1: str = Field(alias="filename|sha1")
+    filename_sha256: str = Field(alias="filename|sha256")
+    first_name: str = Field(alias="first-name")
+    float: str
+    full_name: str = Field(alias="full-name")
+    gender: str
+    github_repository: str = Field(alias="github-repository")
+    github_username: str = Field(alias="github-username")
+    hex: str
+    hostname: str
+    http_method: str = Field(alias="http-method")
+    imphash: str
+    ip_dst: str = Field(alias="ip-dst")
+    ip_dst_port: str = Field(alias="ip-dst|port")
+    ip_src: str = Field(alias="ip-src")
+    ip_src_port: str = Field(alias="ip-src|port")
+    ja3_fingerprint_md5: str = Field(alias="ja3-fingerprint-md5")
+    jabber_id: str = Field(alias="jabber-id")
+    jarm_fingerprint: str = Field(alias="jarm-fingerprint")
+    last_name: str = Field(alias="last-name")
+    link: str
+    malware_sample: str = Field(alias="malware-sample")
+    md5: str
+    mime_type: str = Field(alias="mime-type")
+    mobile_application_id: str = Field(alias="mobile-application-id")
+    mutex: str
+    named_pipe: str = Field(alias="named pipe")
+    nationality: str
+    other: str
+    passport_country: str = Field(alias="passport-country")
+    passport_expiration: str = Field(alias="passport-expiration")
+    passport_number: str = Field(alias="passport-number")
+    pattern_in_file: str = Field(alias="pattern-in-file")
+    pattern_in_memory: str = Field(alias="pattern-in-memory")
+    pattern_in_traffic: str = Field(alias="pattern-in-traffic")
+    pdb: str
+    pehash: str
+    phone_number: str = Field(alias="phone-number")
+    place_of_birth: str = Field(alias="place-of-birth")
+    port: str
+    regkey: str
+    regkey_value: str = Field(alias="regkey|value")
+    sha1: str
+    sha224: str
+    sha256: str
+    sha384: str
+    sha512: str
+    sigma: str
+    size_in_bytes: str = Field(alias="size-in-bytes")
+    snort: str
+    ssdeep: str
+    stix2_pattern: str = Field(alias="stix2-pattern")
+    target_external: str = Field(alias="target-external")
+    target_location: str = Field(alias="target-location")
+    target_machine: str = Field(alias="target-machine")
+    target_org: str = Field(alias="target-org")
+    target_user: str = Field(alias="target-user")
+    text: str
+    threat_actor: str = Field(alias="threat-actor")
+    tlsh: str
+    uri: str
+    url: str
+    user_agent: str = Field(alias="user-agent")
+    vhash: str
+    vulnerability: str
+    weakness: str
+    whois_creation_date: str = Field(alias="whois-creation-date")
+    whois_registrant_email: str = Field(alias="whois-registrant-email")
+    whois_registrant_name: str = Field(alias="whois-registrant-name")
+    whois_registrant_org: str = Field(alias="whois-registrant-org")
+    whois_registrant_phone: str = Field(alias="whois-registrant-phone")
+    whois_registrar: str = Field(alias="whois-registrar")
+    windows_scheduled_task: str = Field(alias="windows-scheduled-task")
+    windows_service_name: str = Field(alias="windows-service-name")
+    x509_fingerprint_md5: str = Field(alias="x509-fingerprint-md5")
+    x509_fingerprint_sha1: str = Field(alias="x509-fingerprint-sha1")
+    x509_fingerprint_sha256: str = Field(alias="x509-fingerprint-sha256")
+    yara: str
+
+    class Config:
+        orm_mode = True
+
+
+class GetAttributeStatisticsCategoriesResponse(BaseModel):
+    antivirus_detection: str = Field(alias="Antivirus detection")
+    artifacts_dropped: str = Field(alias="Artifacts dropped")
+    attribution: str = Field(alias="Attribution")
+    external_analysis: str = Field(alias="External analysis")
+    financial_fraud: str = Field(alias="Financial fraud")
+    internal_reference: str = Field(alias="Internal reference")
+    network_activity: str = Field(alias="Network activity")
+    other: str = Field(alias="Other")
+    payload_delivery: str = Field(alias="Payload delivery")
+    payload_installation: str = Field(alias="Payload installation")
+    payload_type: str = Field(alias="Payload type")
+    persistence_mechanism: str = Field(alias="Persistence mechanism")
+    person: str = Field(alias="Person")
+    social_network: str = Field(alias="Social network")
+    support__tool: str = Field(alias="Support Tool")
+    targeting_data: str = Field(alias="Targeting data")
+
+    class Config:
+        orm_mode = True

mmisp/api_schemas/attributes/get_describe_types_response.py

@@ -0,0 +1,29 @@
+from pydantic import BaseModel
+
+from mmisp.lib.attributes import AttributeCategories, default_category, inverted_categories, to_ids
+
+
+class GetDescribeTypesAttributes(BaseModel):
+    sane_defaults: dict = {}
+    for k, v in to_ids.items():
+        sane_defaults.update(
+            {
+                k: {
+                    "default_category": default_category[k],
+                    "to_ids": v,
+                }
+            }
+        )
+
+    types: list[str] = list(default_category.keys())
+
+    categories: list[str] = [member.value for member in AttributeCategories]
+
+    category_type_mappings: dict = inverted_categories
+
+
+class GetDescribeTypesResponse(BaseModel):
+    result: GetDescribeTypesAttributes
+
+    class Config:
+        orm_mode = True

mmisp/api_schemas/attributes/restore_attribute_reponse.py

@@ -0,0 +1,25 @@
+from pydantic import BaseModel
+
+
+class RestoreAttributeResponse(BaseModel):
+    id: str
+    event_id: str
+    object_id: str
+    object_relation: str
+    category: str
+    type: str
+    value: str
+    to_ids: bool
+    uuid: str
+    timestamp: str
+    distribution: str
+    sharing_group_id: str
+    comment: str
+    deleted: bool
+    disable_correlation: bool
+    first_seen: str
+    last_seen: str
+    event_uuid: str  # new
+
+    class Config:
+        orm_mode = True

mmisp/api_schemas/attributes/search_attributes_body.py

@@ -0,0 +1,74 @@
+from typing import Annotated
+
+from pydantic import BaseModel, Field
+
+
+class SearchAttributesModelOverridesBaseScoreConfig(BaseModel):
+    estimative_language_confidence_in_analytic_judgment: Annotated[
+        int, Field(alias="estimative-language:confidence-in-analytic-judgment")
+    ]
+    estimative_language_likelihood_probability: Annotated[
+        int, Field(alias="estimative-language:likelihood-probability")
+    ]
+    phishing_psychological_acceptability: Annotated[int, Field(alias="phishing:psychological-acceptability")]
+    phishing_state: Annotated[int, Field(alias="phishing:state")]
+
+
+class SearchAttributesModelOverrides(BaseModel):
+    lifetime: int
+    decay_speed: int
+    threshold: int
+    default_base_score: int
+    base_score_config: SearchAttributesModelOverridesBaseScoreConfig
+
+
+class SearchAttributesBody(BaseModel):
+    returnFormat: str
+    page: int | None = None
+    limit: int | None = None
+    value: str | None = None
+    value1: str | None = None
+    value2: str | None = None
+    type: str | None = None
+    category: str | None = None
+    org: str | None = None
+    tags: list[str] | None = None
+    from_: str | None = None
+    to: str | None = None
+    last: int | None = None
+    eventid: str | None = None
+    with_attachments: Annotated[bool | None, Field(alias="withAttachments")] = None
+    uuid: str | None = None
+    publish_timestamp: str | None = None
+    published: bool | None = None
+    timestamp: str | None = None
+    attribute_timestamp: str | None = None
+    enforce_warninglist: Annotated[bool | None, Field(alias="enforceWarninglist")]
+    to_ids: bool | None = None
+    deleted: bool | None = None
+    event_timestamp: str | None = None
+    threat_level_id: str | None = None
+    eventinfo: str | None = None
+    sharinggroup: list[str] | None = None
+    decaying_model: Annotated[str | None, Field(alias="decayingModel")] = None
+    score: str | None = None
+    first_seen: str | None = None
+    last_seen: str | None = None
+    include_event_uuid: Annotated[bool | None, Field(alias="includeEventUuid")] = None
+    include_event_tags: Annotated[bool | None, Field(alias="includeEventTags")] = None
+    include_proposals: Annotated[bool | None, Field(alias="includeProposals")] = None
+    requested_attributes: list[str] | None = None
+    include_context: Annotated[bool | None, Field(alias="includeContext")] = None
+    headerless: bool | None = None
+    include_warninglist_hits: Annotated[bool | None, Field(alias="includeWarninglistHits")] = None
+    attack_galaxy: Annotated[str | None, Field(alias="attackGalaxy")] = None
+    object_relation: str | None = None
+    include_sightings: Annotated[bool | None, Field(alias="includeSightings")] = None
+    include_correlations: Annotated[bool | None, Field(alias="includeCorrelations")] = None
+    model_overrides: Annotated[SearchAttributesModelOverrides | None, Field(alias="modelOverrides")] = None
+    include_decay_score: Annotated[bool | None, Field(alias="includeDecayScore")] = None
+    include_full_model: Annotated[bool | None, Field(alias="includeFullModel")] = None
+    exclude_decayed: Annotated[bool | None, Field(alias="excludeDecayed")] = None
+
+    class Config:
+        orm_mode = True

mmisp/api_schemas/attributes/search_attributes_response.py

@@ -0,0 +1,52 @@
+from pydantic import BaseModel
+
+from .get_attribute_response import GetAttributeTag
+
+
+class SearchAttributesEvent(BaseModel):
+    id: str
+    org_id: str
+    distribution: str
+    info: str
+    orgc_id: str
+    uuid: str
+
+
+class SearchAttributesObject(BaseModel):
+    id: str
+    distribution: str
+    sharing_group_id: str
+
+
+class SearchAttributesAttributesDetails(BaseModel):
+    id: str
+    event_id: str | None = None
+    object_id: str | None = None
+    object_relation: str | None = None
+    category: str
+    type: str
+    value: str
+    to_ids: bool
+    uuid: str
+    timestamp: str
+    distribution: str
+    sharing_group_id: str | None = None
+    comment: str | None = None
+    deleted: bool
+    disable_correlation: bool
+    first_seen: str | None = None
+    last_seen: str | None = None
+    Event: SearchAttributesEvent | None = None
+    Object: SearchAttributesObject | None = None
+    Tag: list[GetAttributeTag] = []
+
+
+class SearchAttributesAttributes(BaseModel):
+    Attribute: SearchAttributesAttributesDetails
+
+
+class SearchAttributesResponse(BaseModel):
+    response: list[SearchAttributesAttributes]
+
+    class Config:
+        orm_mode = True

mmisp/api_schemas/auth_keys/add_auth_key_body.py

@@ -0,0 +1,10 @@
+from pydantic import BaseModel
+
+
+class AddAuthKeyBody(BaseModel):
+    uuid: str | None = None
+    read_only: bool | None = None
+    user_id: str | None = None
+    comment: str | None = None
+    allowed_ips: list[str] | None = None
+    expiration: int | str | None = 0

mmisp/api_schemas/auth_keys/add_auth_key_response.py

@@ -0,0 +1,20 @@
+from pydantic import BaseModel
+
+
+class AddAuthKeyResponseAuthKey(BaseModel):
+    id: str
+    uuid: str
+    authkey_start: str
+    authkey_end: str
+    created: str
+    expiration: str | None = "0"
+    read_only: bool
+    user_id: str
+    comment: str | None = None
+    allowed_ips: list[str] | None = None
+    unique_ips: list[str]
+    authkey_raw: str
+
+
+class AddAuthKeyResponse(BaseModel):
+    AuthKey: AddAuthKeyResponseAuthKey

mmisp/api_schemas/auth_keys/edit_auth_key_body.py

@@ -0,0 +1,8 @@
+from pydantic import BaseModel
+
+
+class EditAuthKeyBody(BaseModel):
+    read_only: bool | None = None
+    comment: str | None = None
+    allowed_ips: list[str] | None = None
+    expiration: int | None = None

mmisp/api_schemas/auth_keys/edit_auth_key_response.py

@@ -0,0 +1,24 @@
+from pydantic import BaseModel
+
+
+class EditAuthKeyResponseUser(BaseModel):
+    id: str
+    org_id: str
+
+
+class EditAuthKeyResponseAuthKey(BaseModel):
+    id: str
+    uuid: str
+    authkey_start: str
+    authkey_end: str
+    created: str
+    expiration: str
+    read_only: bool
+    user_id: str
+    comment: str
+    allowed_ips: str | None = None
+
+
+class EditAuthKeyResponse(BaseModel):
+    AuthKey: EditAuthKeyResponseAuthKey
+    User: EditAuthKeyResponseUser

mmisp/api_schemas/auth_keys/search_auth_keys_body.py

@@ -0,0 +1,17 @@
+from pydantic import BaseModel
+
+
+class SearchAuthKeyBody(BaseModel):
+    page: int | None = 0
+    limit: int | None = 25
+    id: str | None = None
+    uuid: str | None = None
+    authkey_start: str | None = None
+    authkey_end: str | None = None
+    created: str | None = None
+    expiration: str | None = None
+    read_only: bool | None = None
+    user_id: str | None = None
+    comment: str | None = None
+    allowed_ips: str | list[str] | None = None
+    last_used: str | None = None  # deprecated