pymisp 2.5.17.3__tar.gz → 2.5.32__tar.gz

{pymisp-2.5.17.3 → pymisp-2.5.32}/CHANGELOG.txt

@@ -2,6 +2,38 @@ Changelog
 =========
 
 
+v2.5.32 (2026-01-14)
+--------------------
+
+New
+~~~
+- Add missing workers endpoints. [Raphaël Vinot]
+
+  Fix #1372
+- Add logo. [Raphaël Vinot]
+
+Changes
+~~~~~~~
+- Bump deps, version. [Raphaël Vinot]
+- Bump doc. [Raphaël Vinot]
+- Remove outdated dep. [Raphaël Vinot]
+- Bump deps. [Raphaël Vinot]
+- [poetry] Bumped latest lock file with minimum python version >= 3.10.
+  [Christian Studer]
+- Bump changelog, one last time. [Raphaël Vinot]
+- Setting new minimum python version to 3.10. [Christian Studer]
+
+Fix
+~~~
+- Revert bump to sphinx 9. [Raphaël Vinot]
+- [actions] Changed python versions to align with the currently
+  supported ones. [Christian Studer]
+
+Other
+~~~~~
+- Chg; Bump deps. [Raphaël Vinot]
+
+
 v2.5.17.3 (2025-11-25)
 ----------------------
 
@@ -11,6 +43,7 @@ New
 
 Changes
 ~~~~~~~
+- Bump changelog, again. [Raphaël Vinot]
 - Bump changelog. [Raphaël Vinot]
 - Bump version. [Raphaël Vinot]
 - Use pure-magic-rs. [Raphaël Vinot]
@@ -23,6 +56,7 @@ Changes
 
 Fix
 ~~~
+- Call order & typo in magic call. [Raphaël Vinot]
 - [tools:emailobject] Gracefully handle case where getStringStream
   cannot find  the requested stream. [Sami Mokaddem]
 - [tools-emailobject] Circuvent crashes when dealing with ms-tnef

{pymisp-2.5.17.3 → pymisp-2.5.32}/PKG-INFO

@@ -1,12 +1,12 @@
 Metadata-Version: 2.4
 Name: pymisp
-Version: 2.5.17.3
+Version: 2.5.32
 Summary: Python API for MISP.
 License-Expression: BSD-2-Clause
 License-File: LICENSE
 Author: Raphaël Vinot
 Author-email: raphael.vinot@circl.lu
-Requires-Python: >=3.9.2,<4.0
+Requires-Python: >=3.10,<4.0
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Environment :: Console
 Classifier: Intended Audience :: Information Technology
@@ -29,36 +29,36 @@ Provides-Extra: openioc
 Provides-Extra: pdfexport
 Provides-Extra: url
 Provides-Extra: virustotal
-Requires-Dist: RTFDE (>=0.1.2.1) ; (python_version <= "3.9") and (extra == "email")
+Requires-Dist: RTFDE (>=0.1.2.2) ; (python_version <= "3.10") and (extra == "email")
 Requires-Dist: beautifulsoup4 (>=4.13.5,<4.14) ; extra == "openioc"
 Requires-Dist: deprecated (>=1.3.1)
-Requires-Dist: docutils (<0.22) ; (python_version >= "3.11") and (extra == "docs")
+Requires-Dist: docutils (<0.22) ; (python_version >= "3.12") and (extra == "docs")
 Requires-Dist: extract_msg (>=0.55.0) ; extra == "email"
-Requires-Dist: lief (>=0.17.1) ; extra == "fileobjects"
-Requires-Dist: myst-parser (>=4.0.1) ; (python_version >= "3.11") and (extra == "docs")
+Requires-Dist: lief (>=0.17.2) ; extra == "fileobjects"
+Requires-Dist: myst-parser (>=4.0.1) ; (python_version >= "3.12") and (extra == "docs")
 Requires-Dist: oletools (>=0.60.2) ; extra == "email"
-Requires-Dist: pure-magic-rs (>=0.2.0) ; extra == "fileobjects"
+Requires-Dist: pure-magic-rs (>=0.2.4) ; extra == "fileobjects"
 Requires-Dist: pydeep2 (>=0.5.1) ; extra == "fileobjects"
 Requires-Dist: pyfaup-rs (>=0.1.2,<0.2.0) ; extra == "url"
 Requires-Dist: python-dateutil (>=2.9.0.post0)
-Requires-Dist: reportlab (>=4.4.5) ; extra == "pdfexport"
+Requires-Dist: reportlab (>=4.4.7) ; extra == "pdfexport"
 Requires-Dist: requests (>=2.32.5)
-Requires-Dist: sphinx (>=8.2.3) ; (python_version >= "3.11") and (extra == "docs")
-Requires-Dist: sphinx-autodoc-typehints (>=3.5.2) ; (python_version >= "3.11") and (extra == "docs")
-Requires-Dist: urllib3 (>=2.5.0) ; extra == "brotli"
+Requires-Dist: sphinx (<9) ; (python_version >= "3.12") and (extra == "docs")
+Requires-Dist: sphinx-autodoc-typehints (<3.6) ; (python_version >= "3.12") and (extra == "docs")
+Requires-Dist: urllib3[broti] (>=2.6.3) ; extra == "brotli"
 Requires-Dist: validators (>=0.35.0) ; extra == "virustotal"
 Project-URL: Documentation, https://pymisp.readthedocs.io
 Project-URL: Repository, https://github.com/MISP/PyMISP
 Project-URL: issues, https://github.com/MISP/PyMISP/issues
 Description-Content-Type: text/markdown
 
-**IMPORTANT NOTE**: This library will require **at least** Python 3.10 starting the 1st of January 2024. If you have legacy versions of python, please use the latest PyMISP version that will be released in December 2023, and consider updating your system(s). Anything released within the last 2 years will do, starting with Ubuntu 22.04.
+![](docs/source/MISP-pymisp-hori-color.png)
 
 # PyMISP - Python Library to access MISP
 
 [![Documentation Status](https://readthedocs.org/projects/pymisp/badge/?version=latest)](http://pymisp.readthedocs.io/?badge=latest)
 [![Coverage Status](https://coveralls.io/repos/github/MISP/PyMISP/badge.svg?branch=main)](https://coveralls.io/github/MISP/PyMISP?branch=main)
-[![Python 3.9](https://img.shields.io/badge/python-3.9+-blue.svg)](https://www.python.org/downloads/release/python-390/)
+[![Python 3.10](https://img.shields.io/badge/python-3.10+-blue.svg)](https://www.python.org/downloads/release/python-3100/)
 [![PyPi version](https://img.shields.io/pypi/v/pymisp.svg)](https://pypi.python.org/pypi/pymisp/)
 [![Number of PyPI downloads](https://img.shields.io/pypi/dm/pymisp.svg)](https://pypi.python.org/pypi/pymisp/)
 

{pymisp-2.5.17.3 → pymisp-2.5.32}/README.md

@@ -1,10 +1,10 @@
-**IMPORTANT NOTE**: This library will require **at least** Python 3.10 starting the 1st of January 2024. If you have legacy versions of python, please use the latest PyMISP version that will be released in December 2023, and consider updating your system(s). Anything released within the last 2 years will do, starting with Ubuntu 22.04.
+![](docs/source/MISP-pymisp-hori-color.png)
 
 # PyMISP - Python Library to access MISP
 
 [![Documentation Status](https://readthedocs.org/projects/pymisp/badge/?version=latest)](http://pymisp.readthedocs.io/?badge=latest)
 [![Coverage Status](https://coveralls.io/repos/github/MISP/PyMISP/badge.svg?branch=main)](https://coveralls.io/github/MISP/PyMISP?branch=main)
-[![Python 3.9](https://img.shields.io/badge/python-3.9+-blue.svg)](https://www.python.org/downloads/release/python-390/)
+[![Python 3.10](https://img.shields.io/badge/python-3.10+-blue.svg)](https://www.python.org/downloads/release/python-3100/)
 [![PyPi version](https://img.shields.io/pypi/v/pymisp.svg)](https://pypi.python.org/pypi/pymisp/)
 [![Number of PyPI downloads](https://img.shields.io/pypi/dm/pymisp.svg)](https://pypi.python.org/pypi/pymisp/)
 

{pymisp-2.5.17.3 → pymisp-2.5.32}/docs/source/conf.py

@@ -38,7 +38,7 @@ extensions = [
     'sphinx.ext.viewcode',
     'sphinx.ext.napoleon',
     'sphinx.ext.imgconverter',
-    'myst_parser',
+    'myst_parser'
 ]
 
 napoleon_google_docstring = False
@@ -80,7 +80,7 @@ release = 'main'
 #
 # This is also used if you do content translation via gettext catalogs.
 # Usually you set "language" from the command line for these cases.
-language = None
+language = 'en'
 
 # There are two options for replacing |today|: either, you set today to some
 # non-false value, then it is used:

{pymisp-2.5.17.3 → pymisp-2.5.32}/pymisp/api.py

@@ -355,6 +355,35 @@ class PyMISP:
         response = self._prepare_request('POST', 'servers/restartWorkers')
         return self._check_json_response(response)
 
+    def restart_dead_workers(self) -> dict[str, Any] | list[dict[str, Any]]:
+        """Restart the dead workers"""
+        response = self._prepare_request('POST', 'servers/restartDeadWorkers')
+        return self._check_json_response(response)
+
+    def get_workers(self) -> dict[str, Any] | list[dict[str, Any]]:
+        """Get all the workers"""
+        response = self._prepare_request('GET', 'servers/getWorkers')
+        return self._check_json_response(response)
+
+    def start_worker(self, worker_type: str) -> dict[str, Any] | list[dict[str, Any]]:
+        """Start a worker
+        :param worker_type: The type of worker, must be one of the following: "default" "email" "scheduler" "cache" "prio" "update"
+        """
+        response = self._prepare_request('POST', f'servers/startWorker/{worker_type}')
+        return self._check_json_response(response)
+
+    def stop_worker_by_pid(self, worker_pid: str | int) -> dict[str, Any] | list[dict[str, Any]]:
+        """Stop a worker by its PID (get the pid with get_workers)
+        :param worker_pid: The pid of the worker to stop
+        """
+        response = self._prepare_request('POST', f'servers/stopWorker/{worker_pid}')
+        return self._check_json_response(response)
+
+    def kill_all_workers(self) -> dict[str, Any] | list[dict[str, Any]]:
+        """Kill all the workers"""
+        response = self._prepare_request('POST', 'servers/killAllWorkers')
+        return self._check_json_response(response)
+
     def db_schema_diagnostic(self) -> dict[str, Any] | list[dict[str, Any]]:
         """Get the schema diagnostic"""
         response = self._prepare_request('GET', 'servers/dbSchemaDiagnostic')
@@ -2705,6 +2734,11 @@ class PyMISP:
         r = self._prepare_request('POST', f'users/discardRegistrations/{registration_id}')
         return self._check_json_response(r)
 
+    def users_heartbeat(self) -> dict[str, str]:
+        """?"""
+        r = self._prepare_request('GET', 'users/heartbeat')
+        return self._check_json_response(r)
+
     # ## END User ###
 
     # ## BEGIN Role ###

pymisp-2.5.32/pymisp/data/misp-objects/objects/administrative-decision/definition.json

@@ -0,0 +1,58 @@
+{
+  "attributes": {
+    "attachment": {
+      "description": "A file.",
+      "misp-attribute": "attachment",
+      "ui-priority": 1
+    },
+    "caseNumber": {
+      "description": "Case number",
+      "disable_correlation": false,
+      "misp-attribute": "text",
+      "multiple": true,
+      "ui-priority": 1
+    },
+    "close-date": {
+      "description": "Close Date",
+      "misp-attribute": "datetime",
+      "ui-priority": 0
+    },
+    "creation-date": {
+      "description": "Creation Date",
+      "misp-attribute": "datetime",
+      "ui-priority": 0
+    },
+    "language": {
+      "description": "Language",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "sane_default": [
+        "French",
+        "Dutch"
+      ],
+      "ui-priority": 1
+    },
+    "modification-date": {
+      "description": "Modification Date",
+      "misp-attribute": "datetime",
+      "ui-priority": 0
+    },
+    "text": {
+      "description": "Free text value",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "multiple": true,
+      "recommended": false,
+      "ui-priority": 1
+    }
+  },
+  "description": "Administrative Decision",
+  "meta-category": "misc",
+  "name": "administrative-decision",
+  "requiredOneOf": [
+    "caseNumber",
+    "creation-date"
+  ],
+  "uuid": "9d0ac25c-f1cd-425c-87a4-b28bbb15ee2d",
+  "version": 1
+}

pymisp-2.5.32/pymisp/data/misp-objects/objects/detection/definition.json

@@ -0,0 +1,300 @@
+{
+  "attributes": {
+    "alert-severity-default": {
+      "description": "(Section 6) The default severity level of the alert.",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "ui-priority": 31,
+      "values_list": [
+        "Low",
+        "Medium",
+        "High",
+        "Critical"
+      ]
+    },
+    "alert-trigger-condition": {
+      "description": "(Section 6) The condition that triggers the automated playbook (e.g., IF 'detection-logic' RETURNS 'true').",
+      "misp-attribute": "text",
+      "ui-priority": 30
+    },
+    "analytic-robustness-justification": {
+      "description": "(Section 3) Justification for the chosen robustness level.",
+      "misp-attribute": "text",
+      "ui-priority": 14
+    },
+    "analytic-robustness-level": {
+      "description": "(Section 3) The robustness level of the analytic based on the 'Summiting the Pyramid' model.",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "ui-priority": 13,
+      "values_list": [
+        "Level 1: Ephemeral",
+        "Level 2: Core to Adversary-Brought Tool",
+        "Level 3: Core to Pre-Existing Tool",
+        "Level 4: Core to Some Implementations of a (Sub-)Technique",
+        "Level 5: Core to a (Sub-)Technique (Invariant Behavior)"
+      ]
+    },
+    "analytic-title": {
+      "description": "(Section 1) A clear, descriptive title of the detection rule (e.g., 'LSASS Memory Access via OpenProcess').",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "ui-priority": 1
+    },
+    "author": {
+      "description": "(Section 1) The name or team responsible for creating/maintaining the analytic.",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "ui-priority": 5
+    },
+    "d3fend-tactic": {
+      "description": "(Section 7) The D3FEND Tactic this analytic maps to (e.g., Detect (D3-DET)).",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "ui-priority": 40
+    },
+    "d3fend-technique": {
+      "description": "(Section 7) The D3FEND Technique this analytic maps to (e.g., Process Spawn Analysis (D3-PSA)).",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "ui-priority": 41
+    },
+    "data-event": {
+      "description": "(Section 3) The specific event(s) required (e.g., Sysmon Event ID 10).",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "ui-priority": 17
+    },
+    "data-platform": {
+      "description": "(Section 3) The platform where the data is sourced (e.g., Windows, Linux, Network).",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "ui-priority": 15
+    },
+    "data-source": {
+      "description": "(Section 3) The specific data source (e.g., EDR, Sysmon, Zeek).",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "ui-priority": 16
+    },
+    "date-created": {
+      "description": "(Section 1) The date the analytic was initially created.",
+      "disable_correlation": true,
+      "misp-attribute": "datetime",
+      "ui-priority": 6
+    },
+    "date-modified": {
+      "description": "(Section 1) The date the analytic was last modified.",
+      "disable_correlation": true,
+      "misp-attribute": "datetime",
+      "ui-priority": 7
+    },
+    "description": {
+      "description": "(Section 2) A brief, high-level summary of the detection's purpose. What threat or behavior is this designed to catch? Why is it important?",
+      "misp-attribute": "text",
+      "ui-priority": 8
+    },
+    "detection-logic": {
+      "description": "(Section 4) The detection logic, preferably in the vendor-agnostic SIGMA format. Include heavy commenting to explain the logic.",
+      "misp-attribute": "sigma",
+      "ui-priority": 21
+    },
+    "event-robustness-column": {
+      "description": "(Section 3) The robustness of the event source telemetry.",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "ui-priority": 18,
+      "values_list": [
+        "Host-Based: Application (A)",
+        "Host-Based: User-Mode (U)",
+        "Host-Based: Kernel-Mode (K)",
+        "Network-Based: Protocol Payload (P)",
+        "Network-Based: Protocol Header (H)"
+      ]
+    },
+    "event-robustness-justification": {
+      "description": "(Section 3) Justification for the chosen event robustness column.",
+      "misp-attribute": "text",
+      "ui-priority": 19
+    },
+    "exclusion-strategy": {
+      "description": "(Section 4) The strategy for filtering out false positives. Focus on robust, context-rich attributes.",
+      "misp-attribute": "text",
+      "ui-priority": 23
+    },
+    "final-summiting-score": {
+      "description": "(Section 3) The combined robustness score (e.g., 4K, 3U).",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "ui-priority": 20
+    },
+    "hypothesis": {
+      "description": "(Section 2) The scientific hypothesis for the detection. E.g., 'We hypothesize that an adversary performing will execute [Procedure]. This can be observed through [Observables]...'",
+      "misp-attribute": "text",
+      "ui-priority": 9
+    },
+    "id": {
+      "description": "(Section 1) A unique identifier for tracking the analytic (e.g., DE-TA0006-T1003.001-001).",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "ui-priority": 2
+    },
+    "investigation-steps": {
+      "description": "(Section 5) A clear, step-by-step checklist for deeper investigation by a responding analyst.",
+      "misp-attribute": "text",
+      "ui-priority": 28
+    },
+    "known-false-positives": {
+      "description": "(Section 4) A list of any legitimate activities or tools that may trigger this alert.",
+      "misp-attribute": "text",
+      "ui-priority": 22
+    },
+    "mitre-attack-subtechnique": {
+      "description": "(Section 2) The MITRE ATT&CK Sub-technique(s) this analytic addresses (e.g., 'LSASS Memory (T1003.001)'). Use the attack-pattern object for full mapping.",
+      "misp-attribute": "text",
+      "multiple": true,
+      "ui-priority": 12
+    },
+    "mitre-attack-tactic": {
+      "description": "(Section 2) The MITRE ATT&CK Tactic(s) this analytic addresses (e.g., 'Credential Access (TA0006)'). Use the attack-pattern object for full mapping.",
+      "misp-attribute": "text",
+      "multiple": true,
+      "ui-priority": 10
+    },
+    "mitre-attack-technique": {
+      "description": "(Section 2) The MITRE ATT&CK Technique(s) this analytic addresses (e.g., 'OS Credential Dumping (T1003)'). Use the attack-pattern object for full mapping.",
+      "misp-attribute": "text",
+      "multiple": true,
+      "ui-priority": 11
+    },
+    "mitre-engage-approach": {
+      "description": "(Section 7) The MITRE Engage Approach this analytic uses (e.g., Detect (A0001)).",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "ui-priority": 39
+    },
+    "mitre-engage-goal": {
+      "description": "(Section 7) The MITRE Engage Goal this analytic supports (e.g., Disrupt (G0009)).",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "ui-priority": 38
+    },
+    "response-remediation-steps": {
+      "description": "(Section 5) Immediate, standard response and remediation actions if the activity is confirmed malicious.",
+      "misp-attribute": "text",
+      "ui-priority": 29
+    },
+    "soar-step-action": {
+      "description": "(Section 6) The automated action to perform (e.g., Get-UserDetails, Isolate-Host, Create-Ticket).",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "multiple": true,
+      "ui-priority": 33
+    },
+    "soar-step-execute-flag": {
+      "description": "(Section 6) For containment actions, specifies if execution is automatic (true) or requires manual approval (false). Default should be false.",
+      "disable_correlation": true,
+      "misp-attribute": "boolean",
+      "multiple": true,
+      "ui-priority": 37
+    },
+    "soar-step-input": {
+      "description": "(Section 6) The entity from the alert used as input for the action (e.g., event.AccountName).",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "multiple": true,
+      "ui-priority": 34
+    },
+    "soar-step-output": {
+      "description": "(Section 6) The new information to be added or the expected result (e.g., user.title, host.os).",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "multiple": true,
+      "ui-priority": 35
+    },
+    "soar-step-source-system": {
+      "description": "(Section 6) The source or destination system for the action (e.g., VirusTotal, Jira, ServiceNow).",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "multiple": true,
+      "ui-priority": 36
+    },
+    "soar-step-type": {
+      "description": "(Section 6) The type of SOAR step (Enrichment, Triage, Containment, Notification). Add one full set of 'soar-step-*' attributes for each logical step.",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "multiple": true,
+      "ui-priority": 32,
+      "values_list": [
+        "Enrichment",
+        "Triage Logic",
+        "Containment",
+        "Notification"
+      ]
+    },
+    "status": {
+      "description": "(Section 1) The current maturity status of the analytic.",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "ui-priority": 4,
+      "values_list": [
+        "Experimental",
+        "Test",
+        "Production",
+        "Deprecated"
+      ]
+    },
+    "test-case-result": {
+      "description": "(Section 5) The result of the validation test.",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "multiple": true,
+      "ui-priority": 26,
+      "values_list": [
+        "Detected",
+        "Not Detected"
+      ]
+    },
+    "test-case-tool": {
+      "description": "(Section 5) The tool or procedure used for the validation test.",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "multiple": true,
+      "ui-priority": 25
+    },
+    "test-case-type": {
+      "description": "(Section 5) The type of validation test performed (e.g., Functional Synonym). Add one set of test-case attributes per test.",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "multiple": true,
+      "ui-priority": 24,
+      "values_list": [
+        "Functional Synonym",
+        "Procedural Synonym",
+        "Sub-Technical Synonym"
+      ]
+    },
+    "triage-steps": {
+      "description": "(Section 5) A clear, step-by-step checklist for initial triage by a responding analyst.",
+      "misp-attribute": "text",
+      "ui-priority": 27
+    },
+    "version": {
+      "description": "(Section 1) The semantic version of the analytic (e.g., 1.0, 1.1, 2.0).",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "ui-priority": 3
+    }
+  },
+  "description": "A comprehensive object to document a detection analytic, its logic, robustness, validation, and associated response playbooks. It is based on an advanced detection engineering template that integrates concepts like 'Summiting the Pyramid' for robustness scoring and a 'Funnel of Fidelity' for validation, along with structured SOAR automation steps.",
+  "meta-category": "misc",
+  "name": "detection",
+  "required": [
+    "analytic-title",
+    "id",
+    "status",
+    "hypothesis"
+  ],
+  "uuid": "7a6a7c8e-4a44-4b0a-8d2a-9e7f8a9b0c1d",
+  "version": 2
+}

{pymisp-2.5.17.3 → pymisp-2.5.32}/pymisp/data/misp-objects/objects/device/definition.json

@@ -342,6 +342,17 @@
       "misp-attribute": "text",
       "ui-priority": 101
     },
+    "perspective": {
+      "description": "Perspective of the device",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "sane_default": [
+        "Victim",
+        "Adversary",
+        "Unknown"
+      ],
+      "ui-priority": 0
+    },
     "status": {
       "description": "Status of the device",
       "disable_correlation": true,
@@ -369,5 +380,5 @@
     "alias"
   ],
   "uuid": "0c64b41a-e583-4f4d-ac92-d484163b9e52",
-  "version": 9
+  "version": 10
 }

{pymisp-2.5.17.3 → pymisp-2.5.32}/pymisp/data/misp-objects/objects/ip-port/definition.json

@@ -104,6 +104,11 @@
       "misp-attribute": "text",
       "ui-priority": 0
     },
+    "ptr-record": {
+      "description": "PTR record associated to the IP address",
+      "misp-attribute": "domain",
+      "ui-priority": 0
+    },
     "src-port": {
       "categories": [
         "Network activity",
@@ -135,5 +140,5 @@
     "ip-dst"
   ],
   "uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
-  "version": 9
+  "version": 10
 }

{pymisp-2.5.17.3 → pymisp-2.5.32}/pymisp/data/misp-objects/objects/sigma/definition.json

@@ -32,7 +32,7 @@
     "sigma-rule-name": {
       "description": "Sigma rule name.",
       "misp-attribute": "text",
-      "ui-priority": 0
+      "ui-priority": 1
     }
   },
   "description": "An object describing a Sigma rule (or a Sigma rule name).",
@@ -43,5 +43,5 @@
     "sigma-rule-name"
   ],
   "uuid": "aa21a3cd-ab2c-442a-9999-a5e6626591ec",
-  "version": 1
+  "version": 2
 }

{pymisp-2.5.17.3 → pymisp-2.5.32}/pymisp/data/misp-objects/objects/spearphishing-campaign/definition.json

@@ -36,6 +36,24 @@
       "multiple": true,
       "ui-priority": 1
     },
+    "mitm-connect-back-ja4": {
+      "description": "JA4 signature used by the TA for log in attempts",
+      "misp-attribute": "text",
+      "multiple": true,
+      "ui-priority": 1
+    },
+    "mitm-connect-back-ja4http": {
+      "description": "JA4HTTP signature used by the TA for log in attempts",
+      "misp-attribute": "text",
+      "multiple": true,
+      "ui-priority": 1
+    },
+    "mitm-connect-back-ja4tcp": {
+      "description": "JA4TCP signature used by the TA for log in attempts",
+      "misp-attribute": "text",
+      "multiple": true,
+      "ui-priority": 1
+    },
     "mitm-connect-back-useragent": {
       "description": "User-agent used by the TA for log in attempts",
       "misp-attribute": "user-agent",
@@ -72,5 +90,5 @@
     "phishing-domain"
   ],
   "uuid": "20241206-9e59-4b7d-9e88-951458f10a5f",
-  "version": 20250919
+  "version": 20260112
 }