pymisp 2.5.3__py3-none-any.whl → 2.5.7__py3-none-any.whl

examples/addtag2.py

@@ -0,0 +1,45 @@
+#!/usr/bin/env python3
+
+from pymisp import PyMISP
+from keys import misp_url, misp_key, misp_verifycert
+import argparse
+
+
+def init(url, key):
+    return PyMISP(url, key, misp_verifycert, 'json')
+
+
+if __name__ == '__main__':
+    parser = argparse.ArgumentParser(description='Tag something.')
+    parser.add_argument("-u", "--uuid", help="UUID to tag.")
+    parser.add_argument("-e", "--event", help="Event ID to tag.")
+    parser.add_argument("-a", "--attribute", help="Attribute ID to tag")
+    parser.add_argument("-t", "--tag", required=True, help="Tag ID.")
+    args = parser.parse_args()
+
+    if not args.event and not args.uuid and not args.attribute:
+        print("Please provide at least one of the following : uuid, eventID or attribute ID, see --help")
+        exit()
+
+    misp = init(misp_url, misp_key)
+
+    if args.event and not args.attribute:
+        result = misp.search(eventid=args.event)
+        for event in result:
+            uuid = event['Event']['uuid']
+
+    if args.attribute:
+        if not args.event:
+            print("Please provide event ID also")
+            exit()
+        result = misp.search(eventid=args.event)
+        for event in result:
+            for attribute in event['Event']['Attribute']:
+                if attribute["id"] == args.attribute:
+                    uuid = attribute["uuid"]
+
+    if args.uuid:
+        uuid = args.uuid
+
+    print("UUID tagged: %s" % uuid)
+    misp.tag(uuid, args.tag)

examples/asciidoc_generator.py

@@ -0,0 +1,114 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+
+import argparse
+from datetime import date
+import importlib
+
+from pymisp import MISPEvent
+from defang import defang
+from pytaxonomies import Taxonomies
+
+
+class ReportGenerator():
+    def __init__(self, profile="daily_report"):
+        self.taxonomies = Taxonomies()
+        self.report = ''
+        profile_name = "profiles.{}".format(profile)
+        self.template = importlib.import_module(name=profile_name)
+
+    def from_remote(self, event_id):
+        from pymisp import PyMISP
+        from keys import misp_url, misp_key, misp_verifycert
+        misp = PyMISP(misp_url, misp_key, misp_verifycert)
+        result = misp.get(event_id)
+        self.misp_event = MISPEvent()
+        self.misp_event.load(result)
+
+    def from_file(self, path):
+        self.misp_event = MISPEvent()
+        self.misp_event.load_file(path)
+
+    def attributes(self):
+        if not self.misp_event.attributes:
+            return ''
+        list_attributes = []
+        for attribute in self.misp_event.attributes:
+            if attribute.type in self.template.types_to_attach:
+                list_attributes.append("* {}".format(defang(attribute.value)))
+        for obj in self.misp_event.Object:
+            if obj.name in self.template.objects_to_attach:
+                for attribute in obj.Attribute:
+                    if attribute.type in self.template.types_to_attach:
+                        list_attributes.append("* {}".format(defang(attribute.value)))
+        return self.template.attributes.format(list_attributes="\n".join(list_attributes))
+
+    def _get_tag_info(self, machinetag):
+        return self.taxonomies.revert_machinetag(machinetag)
+
+    def report_headers(self):
+        content = {'org_name': 'name',
+                   'date': date.today().isoformat()}
+        self.report += self.template.headers.format(**content)
+
+    def event_level_tags(self):
+        if not self.misp_event.Tag:
+            return ''
+        for tag in self.misp_event.Tag:
+            # Only look for TLP for now
+            if tag['name'].startswith('tlp'):
+                tax, predicate = self._get_tag_info(tag['name'])
+                return self.template.event_level_tags.format(value=predicate.predicate.upper(), expanded=predicate.expanded)
+
+    def title(self):
+        internal_id = ''
+        summary = ''
+        # Get internal refs for report
+        for obj in self.misp_event.Object:
+            if obj.name != 'report':
+                continue
+            for a in obj.Attribute:
+                if a.object_relation == 'case-number':
+                    internal_id = a.value
+                if a.object_relation == 'summary':
+                    summary = a.value
+
+        return self.template.title.format(internal_id=internal_id, title=self.misp_event.info,
+                                          summary=summary)
+
+    def asciidoc(self, lang='en'):
+        self.report += self.title()
+        self.report += self.event_level_tags()
+        self.report += self.attributes()
+
+
+if __name__ == '__main__':
+    try:
+        parser = argparse.ArgumentParser(description='Create a human-readable report out of a MISP event')
+        parser.add_argument("--profile", default="daily_report", help="Profile template to use")
+        parser.add_argument("-o", "--output", help="Output file to write to (generally ends in .adoc)")
+        group = parser.add_mutually_exclusive_group(required=True)
+        group.add_argument("-e", "--event", default=[], nargs='+', help="Event ID to get.")
+        group.add_argument("-p", "--path", default=[], nargs='+', help="Path to the JSON dump.")
+
+        args = parser.parse_args()
+
+        report = ReportGenerator(args.profile)
+        report.report_headers()
+
+        if args.event:
+            for eid in args.event:
+                report.from_remote(eid)
+                report.asciidoc()
+        else:
+            for f in args.path:
+                report.from_file(f)
+                report.asciidoc()
+
+        if args.output:
+            with open(args.output, "w") as ofile:
+                ofile.write(report.report)
+        else:
+            print(report.report)
+    except ModuleNotFoundError as err:
+        print(err)

examples/cache_all.py

@@ -0,0 +1,10 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+
+from keys import misp_url, misp_key, misp_verifycert
+from pymisp import ExpandedPyMISP
+
+
+if __name__ == '__main__':
+    misp = ExpandedPyMISP(misp_url, misp_key, misp_verifycert)
+    misp.cache_all_feeds()

examples/copyTagsFromAttributesToEvent.py

@@ -0,0 +1,68 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+
+from pymisp import PyMISP
+from keys import misp_url, misp_key, misp_verifycert
+import argparse
+import os
+
+SILENT = False
+
+
+def getTagToApplyToEvent(event):
+    tags_to_apply = set()
+
+    event_tags = { tag.name for tag in event.tags }
+    for galaxy in event.galaxies:
+        for cluster in galaxy.clusters:
+            event_tags.add(cluster.tag_name)
+
+    for attribute in event.attributes:
+        for attribute_tag in attribute.tags:
+            if attribute_tag.name not in event_tags:
+                tags_to_apply.add(attribute_tag.name)
+
+    return tags_to_apply
+
+
+def TagEvent(event, tags_to_apply):
+    for tag in tags_to_apply:
+        event.add_tag(tag)
+    return event
+
+
+def condPrint(text):
+    if not SILENT:
+        print(text)
+
+
+if __name__ == '__main__':
+    parser = argparse.ArgumentParser(description='Get an event from a MISP instance.')
+    parser.add_argument("-e", "--event", required=True, help="Event ID to get.")
+    parser.add_argument("-y", "--yes", required=False, default=False, action='store_true',  help="Automatically accept prompt.")
+    parser.add_argument("-s", "--silent", required=False, default=False, action='store_true', help="No output to stdin.")
+
+    args = parser.parse_args()
+    SILENT = args.silent
+
+    misp = PyMISP(misp_url, misp_key, misp_verifycert)
+
+    event = misp.get_event(args.event, pythonify=True)
+    tags_to_apply = getTagToApplyToEvent(event)
+    condPrint('Tag to apply at event level:')
+    for tag in tags_to_apply:
+        condPrint(f'- {tag}')
+
+    confirmed = False
+    if args.yes:
+        confirmed = True
+    else:
+        confirm = input('Confirm [Y/n]: ')
+        confirmed = len(confirm) == 0 or confirm == 'Y' or confirm == 'y'
+    if confirmed:
+        event = TagEvent(event, tags_to_apply)
+        condPrint(f'Updating event {args.event}')
+        misp.update_event(event)
+        condPrint(f'Event {args.event} tagged with {len(tags_to_apply)} tags')
+    else:
+        condPrint('Operation cancelled')

examples/copy_list.py

@@ -0,0 +1,93 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+
+import sys
+
+from pymisp import PyMISP
+
+from keys import cert, priv
+
+url_cert = 'https://misp.circl.lu'
+url_priv = 'https://misppriv.circl.lu'
+cert_cert = 'misp.circl.lu.crt'
+cert_priv = 'misppriv.circl.lu.crt'
+source = None
+destination = None
+
+
+def init(cert_to_priv=True):
+    global source
+    global destination
+    print(cert_to_priv)
+    if cert_to_priv:
+        source = PyMISP(url_cert, cert, cert_cert, 'xml')
+        destination = PyMISP(url_priv, priv, cert_priv, 'xml')
+    else:
+        source = PyMISP(url_priv, priv, cert_priv, 'xml')
+        destination = PyMISP(url_cert, cert, cert_cert, 'xml')
+
+
+def copy_event(event_id):
+    e = source.get_event(event_id)
+    return destination.add_event(e)
+
+
+def update_event(event_id, event_to_update):
+    e = source.get_event(event_id)
+    return destination.update_event(event_to_update, e)
+
+
+def list_copy(filename):
+    with open(filename, 'r') as f:
+        for l in f:
+            copy(l)
+
+
+def loop_copy():
+    while True:
+        line = sys.stdin.readline()
+        copy(line)
+
+
+def copy(eventid):
+    eventid = eventid.strip()
+    if len(eventid) == 0 or not eventid.isdigit():
+        print('empty line or NaN.')
+        return
+    eventid = int(eventid)
+    print(eventid, 'copying...')
+    r = copy_event(eventid)
+    if r.status_code >= 400:
+        loc = r.headers['location']
+        if loc is not None:
+            event_to_update = loc.split('/')[-1]
+            print('updating', event_to_update)
+            r = update_event(eventid, event_to_update)
+            if r.status_code >= 400:
+                print(r.status_code, r.headers)
+        else:
+            print(r.status_code, r.headers)
+    print(eventid, 'done.')
+
+
+def export_our_org():
+    circl = source.search(org='CIRCL')
+    return circl
+
+if __name__ == '__main__':
+    import argparse
+    parser = argparse.ArgumentParser(
+        description='Copy the events from one MISP instance to an other.')
+    parser.add_argument('-f', '--filename', type=str,
+                        help='File containing a list of event id.')
+    parser.add_argument(
+        '-l', '--loop', action='store_true',
+        help='Endless loop: eventid in the terminal and it will be copied.')
+    parser.add_argument('--priv_to_cert', action='store_false', default=True,
+                        help='Copy from MISP priv to MISP CERT.')
+    args = parser.parse_args()
+    init(args.priv_to_cert)
+    if args.filename is not None:
+        list_copy(args.filename)
+    else:
+        loop_copy()

examples/create_events.py

@@ -0,0 +1,26 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+
+from pymisp import ExpandedPyMISP, MISPEvent
+from keys import misp_url, misp_key, misp_verifycert
+import argparse
+
+
+if __name__ == '__main__':
+    parser = argparse.ArgumentParser(description='Create an event on MISP.')
+    parser.add_argument("-d", "--distrib", type=int, help="The distribution setting used for the attributes and for the newly created event, if relevant. [0-3].")
+    parser.add_argument("-i", "--info", help="Used to populate the event info field if no event ID supplied.")
+    parser.add_argument("-a", "--analysis", type=int, help="The analysis level of the newly created event, if applicable. [0-2]")
+    parser.add_argument("-t", "--threat", type=int, help="The threat level ID of the newly created event, if applicable. [1-4]")
+    args = parser.parse_args()
+
+    misp = ExpandedPyMISP(misp_url, misp_key, misp_verifycert)
+
+    event = MISPEvent()
+    event.distribution = args.distrib
+    event.threat_level_id = args.threat
+    event.analysis = args.analysis
+    event.info = args.info
+
+    event = misp.add_event(event, pythonify=True)
+    print(event)