pymisp 2.5.0__tar.gz → 2.5.2.dev0__tar.gz

{pymisp-2.5.0 → pymisp-2.5.2.dev0}/CHANGELOG.txt

@@ -2,11 +2,31 @@ Changelog
 =========
 
 
+v2.5.1 (2024-10-17)
+-------------------
+
+New
+~~~
+- Onion-address type. [Raphaël Vinot]
+
+Changes
+~~~~~~~
+- Bump changelog. [Raphaël Vinot]
+- Bump objects. [Raphaël Vinot]
+- Bump version. [Raphaël Vinot]
+- Bump deps. [Raphaël Vinot]
+
+Fix
+~~~
+- Skip trying to install doc in python 3.9. [Raphaël Vinot]
+
+
 v2.5.0 (2024-10-04)
 -------------------
 
 Changes
 ~~~~~~~
+- Bump changelog. [Raphaël Vinot]
 - Bump deps. [Raphaël Vinot]
 - Bump deps. [Raphaël Vinot]
 - [tests] misp_instance_version_master now uses the 2.5 branch.

{pymisp-2.5.0 → pymisp-2.5.2.dev0}/PKG-INFO

@@ -1,12 +1,12 @@
 Metadata-Version: 2.1
 Name: pymisp
-Version: 2.5.0
+Version: 2.5.2.dev0
 Summary: Python API for MISP.
 Home-page: https://github.com/MISP/PyMISP
 License: BSD-2-Clause
 Author: Raphaël Vinot
 Author-email: raphael.vinot@circl.lu
-Requires-Python: >=3.8,<4.0
+Requires-Python: >=3.9,<4.0
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Environment :: Console
 Classifier: Intended Audience :: Information Technology
@@ -15,11 +15,11 @@ Classifier: Intended Audience :: Telecommunications Industry
 Classifier: License :: OSI Approved :: BSD License
 Classifier: Operating System :: POSIX :: Linux
 Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.8
 Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
 Classifier: Topic :: Internet
 Classifier: Topic :: Security
 Provides-Extra: brotli
@@ -34,19 +34,19 @@ Requires-Dist: RTFDE (>=0.1.1,<0.2.0) ; extra == "email"
 Requires-Dist: Sphinx (>=8,<9) ; (python_version >= "3.10") and (extra == "docs")
 Requires-Dist: beautifulsoup4 (>=4.12.3,<5.0.0) ; extra == "openioc"
 Requires-Dist: deprecated (>=1.2.14,<2.0.0)
-Requires-Dist: docutils (>=0.21.1,<0.22.0) ; (python_version >= "3.9") and (extra == "docs")
-Requires-Dist: extract_msg (>=0.49,<0.50) ; extra == "email"
+Requires-Dist: docutils (>=0.21.1,<0.22.0) ; (python_version >= "3.10") and (extra == "docs")
+Requires-Dist: extract_msg (>=0.52,<0.53) ; extra == "email"
 Requires-Dist: lief (>=0.15.0,<0.16.0) ; extra == "fileobjects"
 Requires-Dist: oletools (>=0.60.1,<0.61.0) ; extra == "email"
-Requires-Dist: publicsuffixlist (>=1.0.2.20241003,<2.0.0.0)
+Requires-Dist: publicsuffixlist (>=1.0.2.20241108,<2.0.0.0)
 Requires-Dist: pydeep2 (>=0.5.1,<0.6.0) ; extra == "fileobjects"
 Requires-Dist: pyfaup (>=1.2,<2.0) ; extra == "url"
 Requires-Dist: python-dateutil (>=2.9.0.post0,<3.0.0)
 Requires-Dist: python-magic (>=0.4.27,<0.5.0) ; extra == "fileobjects"
-Requires-Dist: recommonmark (>=0.7.1,<0.8.0) ; (python_version >= "3.9") and (extra == "docs")
+Requires-Dist: recommonmark (>=0.7.1,<0.8.0) ; (python_version >= "3.10") and (extra == "docs")
 Requires-Dist: reportlab (>=4.2.5,<5.0.0) ; extra == "pdfexport"
 Requires-Dist: requests (>=2.32.3,<3.0.0)
-Requires-Dist: sphinx-autodoc-typehints (>=2.4.4,<3.0.0) ; (python_version >= "3.10") and (extra == "docs")
+Requires-Dist: sphinx-autodoc-typehints (>=2.5.0,<3.0.0) ; (python_version >= "3.10") and (extra == "docs")
 Requires-Dist: urllib3[brotli] ; extra == "brotli"
 Requires-Dist: validators (>=0.34.0,<0.35.0) ; extra == "virustotal"
 Project-URL: Bug Tracker, https://github.com/MISP/PyMISP/issues

{pymisp-2.5.0 → pymisp-2.5.2.dev0}/pymisp/data/describeTypes.json

@@ -760,6 +760,10 @@
             "anonymised": {
                 "default_category": "Other",
                 "to_ids": 0
+            },
+            "onion-address": {
+                "default_category": "Network activity",
+                "to_ids": 1
             }
         },
         "types": [
@@ -952,7 +956,8 @@
             "chrome-extension-id",
             "cortex",
             "boolean",
-            "anonymised"
+            "anonymised",
+            "onion-address"
         ],
         "categories": [
             "Internal reference",
@@ -1098,7 +1103,8 @@
                 "mobile-application-id",
                 "chrome-extension-id",
                 "whois-registrant-email",
-                "anonymised"
+                "anonymised",
+                "onion-address"
             ],
             "Artifacts dropped": [
                 "md5",
@@ -1234,7 +1240,6 @@
                 "x509-fingerprint-md5",
                 "x509-fingerprint-sha256",
                 "azure-application-id",
-                "azure-application-id",
                 "mobile-application-id",
                 "chrome-extension-id",
                 "other",
@@ -1299,7 +1304,8 @@
                 "dkim",
                 "dkim-signature",
                 "ssh-fingerprint",
-                "dom-hash"
+                "dom-hash",
+                "onion-address"
             ],
             "Payload type": [
                 "comment",
@@ -1384,7 +1390,8 @@
                 "cortex",
                 "anonymised",
                 "community-id",
-                "dom-hash"
+                "dom-hash",
+                "onion-address"
             ],
             "Financial fraud": [
                 "btc",
@@ -1486,4 +1493,4 @@
             ]
         }
     }
-}
+}

pymisp-2.5.2.dev0/pymisp/data/misp-objects/objects/dom-hash/definition.json

@@ -0,0 +1,24 @@
+{
+  "attributes": {
+    "dom-hash": {
+      "description": "dom-hash value of the url(s)",
+      "misp-attribute": "dom-hash",
+      "ui-priority": 0
+    },
+    "url": {
+      "description": "Full URL of the dom-hashed HTML structure",
+      "misp-attribute": "url",
+      "multiple": true,
+      "ui-priority": 1
+    }
+  },
+  "description": "dom-hash object to describe similar structure of HTML pages.",
+  "meta-category": "file",
+  "name": "url",
+  "requiredOneOf": [
+    "url",
+    "dom-hash"
+  ],
+  "uuid": "c7771a39-afa5-4ecb-8d67-ca87ff60236d",
+  "version": 2
+}

pymisp-2.5.2.dev0/pymisp/data/misp-objects/objects/opentide/definition.json

@@ -0,0 +1,41 @@
+{
+  "attributes": {
+    "name": {
+      "description": "Name of the OpenTIDE Object",
+      "misp-attribute": "text",
+      "ui-priority": 0
+    },
+    "opentide-object": {
+      "description": "YAML Content of the Opentide Object",
+      "misp-attribute": "text",
+      "ui-priority": 3
+    },
+    "opentide-type": {
+      "description": "Type of the OpenTIDE Object",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "multiple": false,
+      "ui-priority": 2,
+      "values_list": [
+        "tvm",
+        "cdm",
+        "mdr"
+      ]
+    },
+    "uuid": {
+      "description": "UUID of the OpenTIDE Object",
+      "misp-attribute": "text",
+      "ui-priority": 1
+    }
+  },
+  "description": "Object that is a container for threat or detection data, in accordance with the OpenTIDE Framework (https://code.europa.eu/ec-digit-s2/opentide)",
+  "meta-category": "misc",
+  "name": "opentide",
+  "required": [
+    "uuid",
+    "opentide-object",
+    "opentide-type"
+  ],
+  "uuid": "892fd46a-f69e-455c-8c4f-843a4b8f4295",
+  "version": 1
+}

{pymisp-2.5.0 → pymisp-2.5.2.dev0}/pymisp/data/misp-objects/objects/person/definition.json

@@ -108,6 +108,12 @@
       ],
       "ui-priority": 10
     },
+    "ip-src": {
+      "description": "Source IP address used by this person.",
+      "misp-attribute": "ip-src",
+      "multiple": true,
+      "ui-priority": 10
+    },
     "last-name": {
       "description": "Last name of a natural person.",
       "misp-attribute": "last-name",
@@ -256,5 +262,5 @@
     "handle"
   ],
   "uuid": "a15b0477-e9d1-4b9c-9546-abe78a4f4248",
-  "version": 20
+  "version": 21
 }

{pymisp-2.5.0 → pymisp-2.5.2.dev0}/pymisp/data/misp-objects/objects/tor-hiddenservice/definition.json

@@ -1,8 +1,8 @@
 {
   "attributes": {
     "address": {
-      "description": "onion address of the Tor node seen.",
-      "misp-attribute": "text",
+      "description": "Onion address of the Tor node seen.",
+      "misp-attribute": "onion-address",
       "ui-priority": 1
     },
     "description": {
@@ -17,11 +17,25 @@
       "misp-attribute": "datetime",
       "ui-priority": 0
     },
+    "language": {
+      "description": "Language(s) detected on the onion address.",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "multiple": true,
+      "ui-priority": 0
+    },
     "last-seen": {
       "description": "When the Tor hidden service was seen for the last time.",
       "disable_correlation": true,
       "misp-attribute": "datetime",
       "ui-priority": 0
+    },
+    "title": {
+      "description": "Known title(s) of the Tor onion address.",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "multiple": true,
+      "ui-priority": 0
     }
   },
   "description": "Tor hidden service (onion service) object.",
@@ -37,5 +51,5 @@
     "description"
   ],
   "uuid": "cbac07d6-fbe9-43b8-8d91-d515812ce330",
-  "version": 1
+  "version": 2
 }

{pymisp-2.5.0 → pymisp-2.5.2.dev0}/pymisp/data/misp-objects/objects/victim/definition.json

@@ -89,6 +89,7 @@
         "energy",
         "engineering",
         "entertainment",
+        "faith-based organization",
         "financial services",
         "government local",
         "government national",
@@ -100,6 +101,8 @@
         "infrastructure",
         "insurance",
         "international organization",
+        "justice",
+        "law enforcement",
         "legal",
         "manufacturing",
         "mining",
@@ -109,6 +112,9 @@
         "retail",
         "technology",
         "telecommunications",
+        "telecommunications - internet service provider",
+        "telecommunications - managed service provider",
+        "telecommunications - hosting provider",
         "think tank",
         "transportation",
         "utilities"
@@ -131,5 +137,5 @@
     "sectors"
   ],
   "uuid": "a8806e40-39ad-435f-be02-ac2a13d6fc7d",
-  "version": 9
+  "version": 10
 }

{pymisp-2.5.0 → pymisp-2.5.2.dev0}/pymisp/data/misp-objects/relationships/definition.json

@@ -1900,7 +1900,14 @@
       ],
       "name": "summarized-by",
       "opposite": "summarizes"
+    },
+    {
+      "description": "The source object is releasable to the target object.",
+      "format": [
+        "misp"
+      ],
+      "name": "releasable-to"
     }
   ],
-  "version": 49
+  "version": 50
 }

{pymisp-2.5.0 → pymisp-2.5.2.dev0}/pymisp/data/misp-objects/schema_objects.json

@@ -70,6 +70,7 @@
             "dns-soa-email",
             "domain",
             "domain|ip",
+            "dom-hash",
             "email",
             "email-attachment",
             "email-body",
@@ -150,6 +151,7 @@
             "mutex",
             "named pipe",
             "nationality",
+            "onion-address",
             "other",
             "passenger-name-record-locator-number",
             "passport-country",

{pymisp-2.5.0 → pymisp-2.5.2.dev0}/pymisp/mispevent.py

@@ -67,7 +67,7 @@ class AnalystDataBehaviorMixin(AbstractMISP):
         self.edited = True
         return the_note
 
-    def add_opinion(self, opinion: int, comment: str | None = None, **kwargs) -> MISPNote:  # type: ignore[no-untyped-def]
+    def add_opinion(self, opinion: int, comment: str | None = None, **kwargs) -> MISPOpinion:  # type: ignore[no-untyped-def]
         the_opinion = MISPOpinion()
         the_opinion.from_dict(opinion=opinion, comment=comment,
                               object_uuid=self.uuid, object_type=self.analyst_data_object_type,
@@ -76,7 +76,7 @@ class AnalystDataBehaviorMixin(AbstractMISP):
         self.edited = True
         return the_opinion
 
-    def add_relationship(self, related_object_type: AbstractMISP | str, related_object_uuid: str | None, relationship_type: str, **kwargs) -> MISPNote:  # type: ignore[no-untyped-def]
+    def add_relationship(self, related_object_type: AbstractMISP | str, related_object_uuid: str | None, relationship_type: str, **kwargs) -> MISPRelationship:  # type: ignore[no-untyped-def]
         the_relationship = MISPRelationship()
         the_relationship.from_dict(related_object_type=related_object_type, related_object_uuid=related_object_uuid,
                                    relationship_type=relationship_type,

{pymisp-2.5.0 → pymisp-2.5.2.dev0}/pymisp/tools/reportlab_generator.py

@@ -12,6 +12,8 @@ from pathlib import Path
 import sys
 import os
 
+import requests
+
 if sys.version_info.major >= 3:
     from html import escape
 else:
@@ -410,10 +412,20 @@ def internationalize_font(config=None):
             NotoSansCJKtc - Medium.ttf
         '''
         font_path = Path(sys.modules['pymisp'].__file__).parent / 'tools' / 'pdf_fonts' / 'Noto_TTF'
-
         noto_bold = font_path / "NotoSansCJKtc-Bold.ttf"
         noto = font_path / "NotoSansCJKtc-DemiLight.ttf"
 
+        if not font_path.is_dir() or not noto_bold.is_file() or not noto.is_file():
+            font_path.mkdir(parents=True, exist_ok=True)
+            if not noto_bold.is_file():
+                bf = requests.get('https://github.com/MISP/pdf_fonts/raw/refs/heads/master/Noto_TTF/NotoSansCJKtc-Bold.ttf')
+                with open(noto_bold, 'wb') as f:
+                    f.write(bf.content)
+            if not noto.is_file():
+                rf = requests.get('https://github.com/MISP/pdf_fonts/raw/refs/heads/master/Noto_TTF/NotoSansCJKtc-DemiLight.ttf')
+                with open(noto, 'wb') as f:
+                    f.write(rf.content)
+
         if noto_bold.is_file() and noto.is_file():
             registerFont(TTFont("Noto", noto))
             registerFont(TTFont("Noto-bold", noto_bold))
@@ -421,7 +433,7 @@ def internationalize_font(config=None):
             FIRST_COL_FONT = 'Noto-bold'
             SECOND_COL_FONT = 'Noto'
         else:
-            logger.error(f"Trying to load a custom (internationalization) font, unable to access the file: {noto_bold}")
+            logger.error(f"Trying to load a custom (internationalization) font, unable to access the file: {noto_bold} / {noto}")
 
 
 def get_table_styles():

{pymisp-2.5.0 → pymisp-2.5.2.dev0}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "pymisp"
-version = "2.5.0"
+version = "2.5.2.dev0"
 description = "Python API for MISP."
 authors = ["Raphaël Vinot <raphael.vinot@circl.lu>"]
 license = "BSD-2-Clause"
@@ -17,11 +17,11 @@ classifiers=[
     'Intended Audience :: Science/Research',
     'Intended Audience :: Telecommunications Industry',
     'Intended Audience :: Information Technology',
-    'Programming Language :: Python :: 3.8',
     'Programming Language :: Python :: 3.9',
     'Programming Language :: Python :: 3.10',
     'Programming Language :: Python :: 3.11',
     'Programming Language :: Python :: 3.12',
+    'Programming Language :: Python :: 3.13',
     'Topic :: Security',
     'Topic :: Internet'
 ]
@@ -44,11 +44,11 @@ include = [
 "Source" = "https://github.com/MISP/PyMISP"
 
 [tool.poetry.dependencies]
-python = "^3.8"
+python = "^3.9"
 requests = "^2.32.3"
 python-dateutil = "^2.9.0.post0"
 deprecated = "^1.2.14"
-extract_msg = {version = "^0.49", optional = true}
+extract_msg = {version = "^0.52", optional = true}
 RTFDE = {version = "^0.1.1", optional = true}
 oletools = {version = "^0.60.1", optional = true}
 python-magic = {version = "^0.4.27", optional = true}
@@ -56,12 +56,12 @@ pydeep2 = {version = "^0.5.1", optional = true}
 lief = {version = "^0.15.0", optional = true}
 beautifulsoup4 = {version = "^4.12.3", optional = true}
 validators = {version = "^0.34.0", optional = true}
-sphinx-autodoc-typehints = {version = "^2.4.4", optional = true, python = ">=3.10"}
-docutils = {version = "^0.21.1", optional = true, python = ">=3.9"}
-recommonmark = {version = "^0.7.1", optional = true, python = ">=3.9"}
+sphinx-autodoc-typehints = {version = "^2.5.0", optional = true, python = ">=3.10"}
+docutils = {version = "^0.21.1", optional = true, python = ">=3.10"}
+recommonmark = {version = "^0.7.1", optional = true, python = ">=3.10"}
 reportlab = {version = "^4.2.5", optional = true}
 pyfaup = {version = "^1.2", optional = true}
-publicsuffixlist = {version = "^1.0.2.20241003", optional = true}
+publicsuffixlist = {version = "^1.0.2.20241108", optional = true}
 urllib3 = {extras = ["brotli"], version = "*", optional = true}
 Sphinx = [
     {version = "^8", python = ">=3.10", optional = true}
@@ -79,18 +79,17 @@ brotli = ['urllib3']
 
 [tool.poetry.group.dev.dependencies]
 requests-mock = "^1.12.1"
-mypy = "^1.11.2"
+mypy = "^1.13.0"
 ipython = [
-    {version = "<8.13.0", python = "<3.9"},
-    {version = "^8.18.0", python = ">=3.9"},
+    {version = "^8.18.0", python = "<3.10"},
     {version = "^8.19.0", python = ">=3.10"}
 ]
-jupyterlab = "^4.2.5"
-types-requests = "^2.32.0.20240914"
+jupyterlab = "^4.3.0"
+types-requests = "^2.32.0.20241016"
 types-python-dateutil = "^2.9.0.20241003"
 types-redis = "^4.6.0.20241004"
 types-Flask = "^1.1.6"
-pytest-cov = "^5.0.0"
+pytest-cov = "^6.0.0"
 
 [build-system]
 requires = ["poetry_core>=1.1", "setuptools"]

pymisp-2.5.0/pymisp/tools/pdf_fonts/.git

@@ -1 +0,0 @@
-gitdir: ../../../.git/modules/pymisp/tools/pdf_fonts

pymisp-2.5.0/pymisp/tools/pdf_fonts/.gitignore

@@ -1,104 +0,0 @@
-# Byte-compiled / optimized / DLL files
-__pycache__/
-*.py[cod]
-*$py.class
-
-# C extensions
-*.so
-
-# Distribution / packaging
-.Python
-build/
-develop-eggs/
-dist/
-downloads/
-eggs/
-.eggs/
-lib/
-lib64/
-parts/
-sdist/
-var/
-wheels/
-*.egg-info/
-.installed.cfg
-*.egg
-MANIFEST
-
-# PyInstaller
-#  Usually these files are written by a python script from a template
-#  before PyInstaller builds the exe, so as to inject date/other infos into it.
-*.manifest
-*.spec
-
-# Installer logs
-pip-log.txt
-pip-delete-this-directory.txt
-
-# Unit test / coverage reports
-htmlcov/
-.tox/
-.coverage
-.coverage.*
-.cache
-nosetests.xml
-coverage.xml
-*.cover
-.hypothesis/
-.pytest_cache/
-
-# Translations
-*.mo
-*.pot
-
-# Django stuff:
-*.log
-local_settings.py
-db.sqlite3
-
-# Flask stuff:
-instance/
-.webassets-cache
-
-# Scrapy stuff:
-.scrapy
-
-# Sphinx documentation
-docs/_build/
-
-# PyBuilder
-target/
-
-# Jupyter Notebook
-.ipynb_checkpoints
-
-# pyenv
-.python-version
-
-# celery beat schedule file
-celerybeat-schedule
-
-# SageMath parsed files
-*.sage.py
-
-# Environments
-.env
-.venv
-env/
-venv/
-ENV/
-env.bak/
-venv.bak/
-
-# Spyder project settings
-.spyderproject
-.spyproject
-
-# Rope project settings
-.ropeproject
-
-# mkdocs documentation
-/site
-
-# mypy
-.mypy_cache/