pymisp 2.5.4__py3-none-any.whl → 2.5.7__py3-none-any.whl

tests/misp_event.json

@@ -0,0 +1,76 @@
+{
+    "Attribute": [
+        {
+            "ShadowAttribute": [],
+            "category": "Payload delivery",
+            "comment": "",
+            "deleted": false,
+            "distribution": "5",
+            "event_id": "2",
+            "id": "7",
+            "sharing_group_id": "0",
+            "timestamp": "1465681304",
+            "to_ids": false,
+            "type": "url",
+            "uuid": "575c8598-f1f0-4c16-a94a-0612c0a83866",
+            "value": "http://fake.website.com/malware/is/here"
+        },
+        {
+            "ShadowAttribute": [],
+            "category": "Payload type",
+            "comment": "",
+            "deleted": false,
+            "distribution": "5",
+            "event_id": "2",
+            "id": "6",
+            "sharing_group_id": "0",
+            "timestamp": "1465681801",
+            "to_ids": false,
+            "type": "text",
+            "uuid": "575c8549-9010-4555-8b37-057ac0a83866",
+            "value": "Locky"
+        }
+    ],
+    "Org": {
+        "id": "1",
+        "name": "ORGNAME",
+        "uuid": "57586e9a-4a64-4f79-9009-4dc1c0a83866"
+    },
+    "Orgc": {
+        "id": "1",
+        "name": "ORGNAME",
+        "uuid": "57586e9a-4a64-4f79-9009-4dc1c0a83866"
+    },
+    "RelatedEvent": [],
+    "ShadowAttribute": [],
+    "Tag": [
+        {
+            "colour": "#005a5a",
+            "exportable": true,
+            "id": "6",
+            "name": "ecsirt:malicious-code=\"ransomware\""
+        },
+        {
+            "colour": "#142bf7",
+            "exportable": true,
+            "id": "1",
+            "name": "for_intelmq_processing"
+        }
+    ],
+    "analysis": "0",
+    "attribute_count": "2",
+    "date": "2016-06-09",
+    "distribution": "0",
+    "id": "2",
+    "info": "A Random Event",
+    "locked": false,
+    "org_id": "1",
+    "orgc_id": "1",
+    "proposal_email_lock": false,
+    "publish_timestamp": "0",
+    "published": false,
+    "sharing_group_id": "0",
+    "threat_level_id": "1",
+    "timestamp": "1465681801",
+    "uuid": "5758ebf5-c898-48e6-9fe9-5665c0a83866"
+}

tests/mispevent_testfiles/attribute.json

@@ -0,0 +1,21 @@
+{
+  "Attribute": [
+    {
+      "Tag": [
+        {
+          "name": "osint"
+        }
+      ],
+      "category": "Payload delivery",
+      "disable_correlation": false,
+      "to_ids": true,
+      "type": "filename",
+      "value": "bar.exe"
+    }
+  ],
+  "analysis": "1",
+  "date": "2017-12-31",
+  "distribution": "1",
+  "info": "This is a test",
+  "threat_level_id": "1"
+}

tests/mispevent_testfiles/attribute_del.json

@@ -0,0 +1,23 @@
+{
+  "Attribute": [
+    {
+      "Tag": [
+        {
+          "name": "osint"
+        }
+      ],
+      "category": "Payload delivery",
+      "deleted": true,
+      "disable_correlation": false,
+      "id": "42",
+      "to_ids": true,
+      "type": "filename",
+      "value": "bar.exe"
+    }
+  ],
+  "analysis": "1",
+  "date": "2017-12-31",
+  "distribution": "1",
+  "info": "This is a test",
+  "threat_level_id": "1"
+}

tests/mispevent_testfiles/def_param.json

@@ -0,0 +1,53 @@
+{
+  "Object": [
+    {
+      "Attribute": [
+        {
+          "category": "Attribution",
+          "disable_correlation": false,
+          "object_relation": "registrar",
+          "to_ids": false,
+          "type": "whois-registrar",
+          "value": "registar.example.com"
+        },
+        {
+          "category": "Network activity",
+          "disable_correlation": false,
+          "object_relation": "domain",
+          "to_ids": true,
+          "type": "domain",
+          "value": "domain.example.com"
+        },
+        {
+          "category": "Network activity",
+          "disable_correlation": true,
+          "object_relation": "nameserver",
+          "to_ids": false,
+          "type": "hostname",
+          "value": "ns1.example.com"
+        },
+        {
+          "category": "External analysis",
+          "disable_correlation": false,
+          "object_relation": "nameserver",
+          "to_ids": true,
+          "type": "hostname",
+          "value": "ns2.example.com"
+        }
+      ],
+      "description": "Whois records information for a domain name or an IP address.",
+      "distribution": "5",
+      "meta-category": "network",
+      "name": "whois",
+      "sharing_group_id": "0",
+      "template_uuid": "429faea1-34ff-47af-8a00-7c62d3be5a6a",
+      "template_version": "10",
+      "uuid": "a"
+    }
+  ],
+  "analysis": "1",
+  "date": "2017-12-31",
+  "distribution": "1",
+  "info": "This is a test",
+  "threat_level_id": "1"
+}

tests/mispevent_testfiles/event.json

@@ -0,0 +1,8 @@
+{
+  "analysis": "1",
+  "date": "2017-12-31",
+  "distribution": "1",
+  "info": "This is a test",
+  "published": true,
+  "threat_level_id": "1"
+}

tests/mispevent_testfiles/event_obj_attr_tag.json

@@ -0,0 +1,57 @@
+{
+  "Object": [
+    {
+      "Attribute": [
+        {
+          "Tag": [
+            {
+              "name": "blah"
+            }
+          ],
+          "category": "Payload delivery",
+          "disable_correlation": true,
+          "object_relation": "filename",
+          "to_ids": true,
+          "type": "filename",
+          "value": "bar"
+        }
+      ],
+      "ObjectReference": [
+        {
+          "comment": "foo",
+          "object_uuid": "a",
+          "referenced_uuid": "b",
+          "relationship_type": "baz"
+        }
+      ],
+      "description": "File object describing a file with meta-information",
+      "distribution": "5",
+      "meta-category": "file",
+      "name": "file",
+      "sharing_group_id": "0",
+      "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
+      "template_version": "25",
+      "uuid": "a"
+    },
+    {
+      "Attribute": [
+        {
+          "category": "Network activity",
+          "disable_correlation": false,
+          "object_relation": "url",
+          "to_ids": true,
+          "type": "url",
+          "value": "https://www.circl.lu"
+        }
+      ],
+      "description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
+      "distribution": "5",
+      "meta-category": "network",
+      "name": "url",
+      "sharing_group_id": "0",
+      "template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
+      "template_version": "10",
+      "uuid": "b"
+    }
+  ]
+}

tests/mispevent_testfiles/event_obj_def_param.json

@@ -0,0 +1,62 @@
+{
+  "Object": [
+    {
+      "Attribute": [
+        {
+          "Tag": [
+            {
+              "name": "blah"
+            }
+          ],
+          "category": "Payload delivery",
+          "disable_correlation": true,
+          "object_relation": "filename",
+          "to_ids": true,
+          "type": "filename",
+          "value": "bar"
+        },
+        {
+          "category": "Artifacts dropped",
+          "disable_correlation": false,
+          "object_relation": "pattern-in-file",
+          "to_ids": true,
+          "type": "pattern-in-file",
+          "value": "baz"
+        }
+      ],
+      "description": "File object describing a file with meta-information",
+      "distribution": "5",
+      "meta-category": "file",
+      "name": "file",
+      "sharing_group_id": "0",
+      "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
+      "template_version": "25",
+      "uuid": "a"
+    },
+    {
+      "Attribute": [
+        {
+          "Tag": [
+            {
+              "name": "blah"
+            }
+          ],
+          "category": "Payload delivery",
+          "disable_correlation": true,
+          "object_relation": "filename",
+          "to_ids": true,
+          "type": "filename",
+          "value": "baz"
+        }
+      ],
+      "description": "File object describing a file with meta-information",
+      "distribution": "5",
+      "meta-category": "file",
+      "name": "file",
+      "sharing_group_id": "0",
+      "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
+      "template_version": "25",
+      "uuid": "b"
+    }
+  ]
+}

tests/mispevent_testfiles/event_obj_tag.json

@@ -0,0 +1,29 @@
+{
+  "Object": [
+    {
+      "Attribute": [
+        {
+          "category": "Payload delivery",
+          "disable_correlation": false,
+          "object_relation": "filename",
+          "to_ids": true,
+          "type": "filename",
+          "value": "bar"
+        }
+      ],
+      "Tag": [
+        {
+          "name": "osint"
+        }
+      ],
+      "description": "File object describing a file with meta-information",
+      "distribution": 5,
+      "meta-category": "file",
+      "name": "file",
+      "sharing_group_id": 0,
+      "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
+      "template_version": 9,
+      "uuid": "a"
+    }
+  ]
+}

tests/mispevent_testfiles/event_tags.json

@@ -0,0 +1,18 @@
+{
+  "Tag": [
+    {
+      "name": "bar"
+    },
+    {
+      "name": "baz"
+    },
+    {
+      "name": "foo"
+    }
+  ],
+  "analysis": "1",
+  "date": "2017-12-31",
+  "distribution": "1",
+  "info": "This is a test",
+  "threat_level_id": "1"
+}