pymisp 2.5.3__py3-none-any.whl → 2.5.7__py3-none-any.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Potentially problematic release.

This version of pymisp might be problematic. Click here for more details.

Files changed (162) hide show
  1. CHANGELOG.txt +5380 -0
  2. examples/__init__.py +0 -0
  3. examples/add_attributes_from_csv.py +74 -0
  4. examples/add_email_object.py +29 -0
  5. examples/add_fail2ban_object.py +86 -0
  6. examples/add_feed.py +25 -0
  7. examples/add_file_object.py +47 -0
  8. examples/add_filetype_object_from_csv.py +53 -0
  9. examples/add_generic_object.py +26 -0
  10. examples/add_github_user.py +65 -0
  11. examples/add_gitlab_user.py +56 -0
  12. examples/add_named_attribute.py +25 -0
  13. examples/add_organisations.py +57 -0
  14. examples/add_ssh_authorized_keys.py +29 -0
  15. examples/add_user.py +22 -0
  16. examples/add_vehicle_object.py +22 -0
  17. examples/addtag2.py +45 -0
  18. examples/asciidoc_generator.py +114 -0
  19. examples/cache_all.py +10 -0
  20. examples/copyTagsFromAttributesToEvent.py +68 -0
  21. examples/copy_list.py +93 -0
  22. examples/create_events.py +26 -0
  23. examples/cytomic_orion.py +549 -0
  24. examples/del.py +22 -0
  25. examples/delete_user.py +16 -0
  26. examples/edit_organisation.py +20 -0
  27. examples/edit_user.py +20 -0
  28. examples/falsepositive_disabletoids.py +136 -0
  29. examples/fetch_events_feed.py +15 -0
  30. examples/fetch_warninglist_hits.py +38 -0
  31. examples/freetext.py +22 -0
  32. examples/generate_file_objects.py +78 -0
  33. examples/generate_meta_feed.py +15 -0
  34. examples/get.py +37 -0
  35. examples/get_csv.py +37 -0
  36. examples/get_network_activity.py +187 -0
  37. examples/last.py +48 -0
  38. examples/load_csv.py +94 -0
  39. examples/lookup.py +28 -0
  40. examples/misp2cef.py +71 -0
  41. examples/misp2clamav.py +52 -0
  42. examples/openioc_to_misp.py +27 -0
  43. examples/proofpoint_tap.py +203 -0
  44. examples/proofpoint_vap.py +65 -0
  45. examples/search.py +48 -0
  46. examples/search_attributes_yara.py +40 -0
  47. examples/search_sighting.py +42 -0
  48. examples/server_sync_check_conn.py +32 -0
  49. examples/sharing_groups.py +15 -0
  50. examples/show_sightings.py +168 -0
  51. examples/stats_report.py +405 -0
  52. examples/sync_sighting.py +171 -0
  53. examples/tags.py +25 -0
  54. examples/test_sign.py +19 -0
  55. examples/trustar_misp.py +59 -0
  56. examples/up.py +21 -0
  57. examples/upload.py +60 -0
  58. examples/users_list.py +15 -0
  59. examples/vmray_automation.py +281 -0
  60. examples/vt_to_misp.py +182 -0
  61. examples/warninglists.py +22 -0
  62. examples/yara.py +38 -0
  63. examples/yara_dump.py +98 -0
  64. pymisp/api.py +33 -5
  65. pymisp/data/misp-objects/objects/android-app/definition.json +8 -2
  66. pymisp/data/misp-objects/objects/instagram-account/definition.json +66 -0
  67. pymisp/data/misp-objects/objects/lnk/definition.json +13 -1
  68. pymisp/data/misp-objects/objects/rmm/definition.json +88 -0
  69. pymisp/data/misp-objects/objects/spambee-report/definition.json +54 -0
  70. pymisp/data/misp-objects/objects/target-system/definition.json +2 -2
  71. pymisp/data/misp-objects/objects/vulnerability/definition.json +5 -4
  72. pymisp/data/misp-objects/relationships/definition.json +17 -1
  73. pymisp/data/misp-objects/schema_objects.json +1 -1
  74. pymisp/mispevent.py +95 -23
  75. {pymisp-2.5.3.dist-info → pymisp-2.5.7.dist-info}/METADATA +23 -28
  76. {pymisp-2.5.3.dist-info → pymisp-2.5.7.dist-info}/RECORD +144 -30
  77. {pymisp-2.5.3.dist-info → pymisp-2.5.7.dist-info}/WHEEL +1 -1
  78. tests/57c4445b-c548-4654-af0b-4be3950d210f.json +1 -0
  79. tests/__init__.py +0 -0
  80. tests/csv_testfiles/invalid_fieldnames.csv +11 -0
  81. tests/csv_testfiles/valid_fieldnames.csv +4 -0
  82. tests/email_testfiles/mail_1.eml.zip +0 -0
  83. tests/email_testfiles/mail_1.msg +0 -0
  84. tests/email_testfiles/mail_1_bom.eml +858 -0
  85. tests/email_testfiles/mail_1_headers_only.eml +28 -0
  86. tests/email_testfiles/mail_2.eml +32 -0
  87. tests/email_testfiles/mail_3.eml +170 -0
  88. tests/email_testfiles/mail_3.msg +0 -0
  89. tests/email_testfiles/mail_4.msg +0 -0
  90. tests/email_testfiles/mail_5.msg +0 -0
  91. tests/email_testfiles/mail_multiple_to.eml +15 -0
  92. tests/email_testfiles/source +1 -0
  93. tests/git-vuln-finder-quagga.json +1493 -0
  94. tests/misp_event.json +76 -0
  95. tests/mispevent_testfiles/attribute.json +21 -0
  96. tests/mispevent_testfiles/attribute_del.json +23 -0
  97. tests/mispevent_testfiles/def_param.json +53 -0
  98. tests/mispevent_testfiles/event.json +8 -0
  99. tests/mispevent_testfiles/event_obj_attr_tag.json +57 -0
  100. tests/mispevent_testfiles/event_obj_def_param.json +62 -0
  101. tests/mispevent_testfiles/event_obj_tag.json +29 -0
  102. tests/mispevent_testfiles/event_tags.json +18 -0
  103. tests/mispevent_testfiles/existing_event.json +4599 -0
  104. tests/mispevent_testfiles/existing_event_edited.json +4601 -0
  105. tests/mispevent_testfiles/galaxy.json +25 -0
  106. tests/mispevent_testfiles/malware.json +19 -0
  107. tests/mispevent_testfiles/malware_exist.json +163 -0
  108. tests/mispevent_testfiles/misp_custom_obj.json +38 -0
  109. tests/mispevent_testfiles/overwrite_file/definition.json +457 -0
  110. tests/mispevent_testfiles/proposals.json +35 -0
  111. tests/mispevent_testfiles/shadow.json +148 -0
  112. tests/mispevent_testfiles/sighting.json +5 -0
  113. tests/mispevent_testfiles/simple.json +2 -0
  114. tests/mispevent_testfiles/test_object_template/definition.json +29 -0
  115. tests/new_misp_event.json +34 -0
  116. tests/reportlab_testfiles/HTML_event.json +1 -0
  117. tests/reportlab_testfiles/galaxy_1.json +1250 -0
  118. tests/reportlab_testfiles/image_event.json +2490 -0
  119. tests/reportlab_testfiles/japanese_test.json +156 -0
  120. tests/reportlab_testfiles/japanese_test_heavy.json +318 -0
  121. tests/reportlab_testfiles/long_event.json +3730 -0
  122. tests/reportlab_testfiles/mainly_objects_1.json +1092 -0
  123. tests/reportlab_testfiles/mainly_objects_2.json +977 -0
  124. tests/reportlab_testfiles/sighting_1.json +305 -0
  125. tests/reportlab_testfiles/sighting_2.json +221 -0
  126. tests/reportlab_testfiles/to_delete1.json +804 -0
  127. tests/reportlab_testfiles/to_delete2.json +1 -0
  128. tests/reportlab_testfiles/to_delete3.json +1 -0
  129. tests/reportlab_testfiles/very_long_event.json +1006 -0
  130. tests/reportlab_testoutputs/to_delete1.json.pdf +391 -0
  131. tests/reportlab_testoutputs/to_delete2.json.pdf +506 -0
  132. tests/reportlab_testoutputs/to_delete3.json.pdf +277 -0
  133. tests/search_index_result.json +69 -0
  134. tests/sharing_groups.json +98 -0
  135. tests/stix1.xml-utf8 +110 -0
  136. tests/stix2.json +1 -0
  137. tests/test_analyst_data.py +123 -0
  138. tests/test_emailobject.py +157 -0
  139. tests/test_fileobject.py +20 -0
  140. tests/test_mispevent.py +473 -0
  141. tests/test_reportlab.py +431 -0
  142. tests/testlive_comprehensive.py +3734 -0
  143. tests/testlive_sync.py +474 -0
  144. pymisp/data/misp-objects/.git +0 -1
  145. pymisp/data/misp-objects/.gitchangelog.rc +0 -289
  146. pymisp/data/misp-objects/.github/workflows/codeql.yml +0 -41
  147. pymisp/data/misp-objects/.github/workflows/nosetests.yml +0 -39
  148. pymisp/data/misp-objects/.travis.yml +0 -16
  149. pymisp/data/misp-objects/LICENSE-software-only.md +0 -661
  150. pymisp/data/misp-objects/LICENSE.md +0 -36
  151. pymisp/data/misp-objects/README.md +0 -566
  152. pymisp/data/misp-objects/docs/time-related-objects.ods +0 -0
  153. pymisp/data/misp-objects/docs/time-related-objects.pdf +0 -0
  154. pymisp/data/misp-objects/jq_all_the_things.sh +0 -29
  155. pymisp/data/misp-objects/tools/adoc_objects.py +0 -145
  156. pymisp/data/misp-objects/tools/alfred_links_to_relarelationships.py +0 -48
  157. pymisp/data/misp-objects/tools/list_of_objects.py +0 -50
  158. pymisp/data/misp-objects/tools/updated.sh +0 -6
  159. pymisp/data/misp-objects/tools/validate_opposites.sh +0 -17
  160. pymisp/data/misp-objects/unique_uuid.py +0 -16
  161. pymisp/data/misp-objects/validate_all.sh +0 -38
  162. {pymisp-2.5.3.dist-info → pymisp-2.5.7.dist-info}/LICENSE +0 -0
tests/mispevent_testfiles/galaxy.json ADDED
@@ -0,0 +1,25 @@
1
+ {
2
+ "uuid": "c5f2dfb4-21a1-42d8-a452-1d3c36a204ff",
3
+ "name": "Tea Matrix",
4
+ "type": "tea-matrix",
5
+ "description": "Tea Matrix",
6
+ "namespace": "tea-matrix",
7
+ "GalaxyCluster": [
8
+ {
9
+ "collection_uuid": "7eacd736-b093-4cc0-a56c-5f84de725dfb",
10
+ "type": "tea-matrix",
11
+ "value": "Milk in tea",
12
+ "tag_name": "misp-galaxy:tea-matrix=\"Milk in tea\"",
13
+ "description": "Milk in tea",
14
+ "uuid": "24430dc6-9c27-4b3c-a5e7-6dda478fffa0",
15
+ "distribution": "3",
16
+ "default": true,
17
+ "meta": {
18
+ "kill_chain": [
19
+ "tea:black"
20
+ ]
21
+ },
22
+ "relationship_type": "ennemy-of"
23
+ }
24
+ ]
25
+ }
tests/mispevent_testfiles/malware.json ADDED
@@ -0,0 +1,19 @@
1
+ {
2
+ "Attribute": [
3
+ {
4
+ "category": "Payload delivery",
5
+ "data": "ewp9Cg==",
6
+ "disable_correlation": false,
7
+ "encrypt": true,
8
+ "malware_filename": "bar.exe",
9
+ "to_ids": true,
10
+ "type": "malware-sample",
11
+ "value": "bar.exe"
12
+ }
13
+ ],
14
+ "analysis": "1",
15
+ "date": "2017-12-31",
16
+ "distribution": "1",
17
+ "info": "This is a test",
18
+ "threat_level_id": "1"
19
+ }
tests/mispevent_testfiles/malware_exist.json ADDED
@@ -0,0 +1,163 @@
1
+ {"response":[{
2
+ "id": "6719",
3
+ "orgc_id": "1",
4
+ "org_id": "1",
5
+ "date": "2018-01-04",
6
+ "threat_level_id": "1",
7
+ "info": "Test existing malware PyMISP",
8
+ "published": false,
9
+ "uuid": "5a4e4fdd-1eb4-4ff3-9e87-43fa950d210f",
10
+ "attribute_count": "6",
11
+ "analysis": "0",
12
+ "timestamp": "1515081727",
13
+ "distribution": "0",
14
+ "proposal_email_lock": false,
15
+ "locked": false,
16
+ "publish_timestamp": "0",
17
+ "sharing_group_id": "0",
18
+ "disable_correlation": false,
19
+ "event_creator_email": "raphael.vinot@circl.lu",
20
+ "Org": {
21
+ "id": "1",
22
+ "name": "CIRCL",
23
+ "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
24
+ },
25
+ "Orgc": {
26
+ "id": "1",
27
+ "name": "CIRCL",
28
+ "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
29
+ },
30
+ "Attribute": [],
31
+ "ShadowAttribute": [],
32
+ "RelatedEvent": [],
33
+ "Galaxy": [],
34
+ "Object": [
35
+ {
36
+ "id": "2279",
37
+ "name": "file",
38
+ "meta-category": "file",
39
+ "description": "File object describing a file with meta-information",
40
+ "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
41
+ "template_version": "6",
42
+ "event_id": "6719",
43
+ "uuid": "5a4e4ffe-4cb8-48b1-bd5c-48fb950d210f",
44
+ "timestamp": "1515081726",
45
+ "distribution": "5",
46
+ "sharing_group_id": "0",
47
+ "comment": "",
48
+ "deleted": false,
49
+ "ObjectReference": [],
50
+ "Attribute": [
51
+ {
52
+ "id": "814967",
53
+ "type": "malware-sample",
54
+ "category": "Payload delivery",
55
+ "to_ids": true,
56
+ "uuid": "5a4e4fff-407c-40ff-9de5-43dc950d210f",
57
+ "event_id": "6719",
58
+ "distribution": "5",
59
+ "timestamp": "1515081727",
60
+ "comment": "",
61
+ "sharing_group_id": "0",
62
+ "deleted": false,
63
+ "disable_correlation": false,
64
+ "object_id": "2279",
65
+ "object_relation": "malware-sample",
66
+ "value": "simple.json|7637beddacbeac59d44469b2b120b9e6",
67
+ "data": "UEsDBAoACQAAAFYGA0/yk6nqEAAAAAQAAAAgABwANWI3NmIwZWVmOWFmOGEyMzAwNjczZTA1NTNmNjA5ZjlVVAkAA0O+RF1DvkRddXgLAAEEIQAAAAQhAAAAKjTWvfZCN4PlYePhL4s52lBLBwjyk6nqEAAAAAQAAABQSwMECgAJAAAAVgYDT4OOVAAXAAAACwAAAC0AHAA1Yjc2YjBlZWY5YWY4YTIzMDA2NzNlMDU1M2Y2MDlmOS5maWxlbmFtZS50eHRVVAkAA0O+RF1DvkRddXgLAAEEIQAAAAQhAAAAGOK3WSE/A/8NRU5Dlo6Z5J+yV17raVlQSwcIg45UABcAAAALAAAAUEsBAh4DCgAJAAAAVgYDT/KTqeoQAAAABAAAACAAGAAAAAAAAQAAAKSBAAAAADViNzZiMGVlZjlhZjhhMjMwMDY3M2UwNTUzZjYwOWY5VVQFAANDvkRddXgLAAEEIQAAAAQhAAAAUEsBAh4DCgAJAAAAVgYDT4OOVAAXAAAACwAAAC0AGAAAAAAAAQAAAKSBegAAADViNzZiMGVlZjlhZjhhMjMwMDY3M2UwNTUzZjYwOWY5LmZpbGVuYW1lLnR4dFVUBQADQ75EXXV4CwABBCEAAAAEIQAAAFBLBQYAAAAAAgACANkAAAAIAQAAAAA=",
68
+ "ShadowAttribute": []
69
+ },
70
+ {
71
+ "id": "814968",
72
+ "type": "filename",
73
+ "category": "Payload delivery",
74
+ "to_ids": false,
75
+ "uuid": "5a4e4fff-9ec0-4822-a405-4e29950d210f",
76
+ "event_id": "6719",
77
+ "distribution": "5",
78
+ "timestamp": "1515081727",
79
+ "comment": "",
80
+ "sharing_group_id": "0",
81
+ "deleted": false,
82
+ "disable_correlation": false,
83
+ "object_id": "2279",
84
+ "object_relation": "filename",
85
+ "value": "simple.json",
86
+ "ShadowAttribute": []
87
+ },
88
+ {
89
+ "id": "814969",
90
+ "type": "md5",
91
+ "category": "Payload delivery",
92
+ "to_ids": true,
93
+ "uuid": "5a4e4fff-8000-49f9-8c3e-4598950d210f",
94
+ "event_id": "6719",
95
+ "distribution": "5",
96
+ "timestamp": "1515081727",
97
+ "comment": "",
98
+ "sharing_group_id": "0",
99
+ "deleted": false,
100
+ "disable_correlation": false,
101
+ "object_id": "2279",
102
+ "object_relation": "md5",
103
+ "value": "7637beddacbeac59d44469b2b120b9e6",
104
+ "ShadowAttribute": []
105
+ },
106
+ {
107
+ "id": "814970",
108
+ "type": "sha1",
109
+ "category": "Payload delivery",
110
+ "to_ids": true,
111
+ "uuid": "5a4e4fff-dae0-4aa4-81ea-4899950d210f",
112
+ "event_id": "6719",
113
+ "distribution": "5",
114
+ "timestamp": "1515081727",
115
+ "comment": "",
116
+ "sharing_group_id": "0",
117
+ "deleted": false,
118
+ "disable_correlation": false,
119
+ "object_id": "2279",
120
+ "object_relation": "sha1",
121
+ "value": "023853a4331db8d67e44553004cf338ec1b7440e",
122
+ "ShadowAttribute": []
123
+ },
124
+ {
125
+ "id": "814971",
126
+ "type": "sha256",
127
+ "category": "Payload delivery",
128
+ "to_ids": true,
129
+ "uuid": "5a4e4fff-03ec-4e88-b5f4-472b950d210f",
130
+ "event_id": "6719",
131
+ "distribution": "5",
132
+ "timestamp": "1515081727",
133
+ "comment": "",
134
+ "sharing_group_id": "0",
135
+ "deleted": false,
136
+ "disable_correlation": false,
137
+ "object_id": "2279",
138
+ "object_relation": "sha256",
139
+ "value": "6ae8b0f1c7d6f3238d1fc14038018c3b4704c8cc23dac1c2bfd2c81b5a278eef",
140
+ "ShadowAttribute": []
141
+ },
142
+ {
143
+ "id": "814972",
144
+ "type": "size-in-bytes",
145
+ "category": "Other",
146
+ "to_ids": false,
147
+ "uuid": "5a4e4fff-b6f4-41ba-a6eb-446c950d210f",
148
+ "event_id": "6719",
149
+ "distribution": "5",
150
+ "timestamp": "1515081727",
151
+ "comment": "",
152
+ "sharing_group_id": "0",
153
+ "deleted": false,
154
+ "disable_correlation": true,
155
+ "object_id": "2279",
156
+ "object_relation": "size-in-bytes",
157
+ "value": "21",
158
+ "ShadowAttribute": []
159
+ }
160
+ ]
161
+ }
162
+ ]
163
+ }]}
tests/mispevent_testfiles/misp_custom_obj.json ADDED
@@ -0,0 +1,38 @@
1
+ {
2
+ "Object": [
3
+ {
4
+ "Attribute": [
5
+ {
6
+ "category": "Other",
7
+ "disable_correlation": false,
8
+ "object_relation": "member3",
9
+ "to_ids": false,
10
+ "type": "text",
11
+ "value": "foo"
12
+ },
13
+ {
14
+ "category": "Other",
15
+ "disable_correlation": false,
16
+ "object_relation": "member1",
17
+ "to_ids": false,
18
+ "type": "text",
19
+ "value": "bar"
20
+ }
21
+ ],
22
+ "description": "TestTemplate.",
23
+ "distribution": "5",
24
+ "meta-category": "file",
25
+ "name": "test_object_template",
26
+ "sharing_group_id": "0",
27
+ "template_uuid": "4ec55cc6-9e49-4c64-b794-03c25c1a6589",
28
+ "template_version": "1",
29
+ "uuid": "a"
30
+ }
31
+ ],
32
+ "analysis": "1",
33
+ "date": "2017-12-31",
34
+ "distribution": "1",
35
+ "info": "This is a test",
36
+ "threat_level_id": "1"
37
+ }
38
+