mirror of https://github.com/MISP/MISP-maltego
new: [documentation] Updated documentation
parent
82a572e1a6
commit
3a5138f086
17
README.md
17
README.md
|
@ -14,22 +14,9 @@ Dependencies:
|
|||
* [Canari3](https://github.com/redcanari/canari3)
|
||||
|
||||
## Installation:
|
||||
```
|
||||
git clone https://github.com/MISP/MISP-maltego.git
|
||||
cd MISP-maltego
|
||||
cp src/MISP_maltego/resources/etc/MISP_maltego.conf MISP_maltego.conf
|
||||
python3 setup.py install --user && canari create-profile MISP_maltego
|
||||
```
|
||||
Import the profile/transforms `MISP_maltego.mtz` in Maltego. (Import|Export > Import Config)
|
||||
Installation is fairly easy, just read the steps in the [documentation](https://github.com/MISP/MISP-maltego/blob/master/doc/README.md).
|
||||
|
||||
|
||||
Edit `$HOME/.canari/MISP_maltego.conf` and enter your `misp_url` and `misp_key`
|
||||
```
|
||||
[MISP_maltego.local]
|
||||
misp_url = https://a.b.c.d
|
||||
misp_key = verysecretkey
|
||||
misp_verify = True
|
||||
misp_debug = False
|
||||
```
|
||||
## Screenshot
|
||||
![Screenshot](https://github.com/MISP/MISP-maltego/blob/master/doc/screenshot.png)
|
||||
|
||||
|
|
|
@ -0,0 +1,40 @@
|
|||
# MISP-Maltego User Guide
|
||||
|
||||
This user guide should help you through the installation of **MISP-Maltego**, and should guide you how to use it through a few use-cases. As this is a collaborative project, do not hesitate to propose changes, write other use-cases or raise [feature requests](https://github.com/MISP/MISP-maltego/issues) for missing features.
|
||||
|
||||
## Installation
|
||||
These instructions have been tested on Ubuntu 18.04 LTS, but should be similar on other systems.
|
||||
1. Download and install [Maltego](https://www.paterva.com/web7/downloads.php)
|
||||
2. Install dependencies: `sudo apt install git build-essential python3-setuptools python3-dev python3-pip`
|
||||
3. Clone the repository, install and create the Maltego local transform bundle.
|
||||
To the question *".canari/canari.conf already exists, would you like to overwrite it?"* you will probably want to answer yes.
|
||||
```
|
||||
git clone https://github.com/MISP/MISP-maltego.git
|
||||
cd MISP-maltego
|
||||
sudo pip3 install .
|
||||
canari create-profile MISP_maltego
|
||||
```
|
||||
5. Import this bundle in Maltego.
|
||||
1. Open Maltego
|
||||
2. Click on the home button (Maltego icon, top-left corner).
|
||||
3. Click on 'Import'
|
||||
4. Click on 'Import Configuration'.
|
||||
5. Load the `MISP_maltego.mtz` file and follow the prompts.
|
||||
6. Edit `$HOME/.canari/MISP_maltego.conf` and enter your `misp_url` and `misp_key`
|
||||
|
||||
## Custom Entities
|
||||
MISP-Maltego tries to use as much as possible the default Paterva entities, or the most popular from the community. It however comes with a few custom entities:
|
||||
* **MISPEvent**: A representation of an *Event* on MISP, containing *Attributes* (MISP) / *Entities* (Maltego)
|
||||
* **MISPObject**: A way to group associated attributes in a structured way.
|
||||
* **MISPGalaxy**: A *Tag* containing much more metadata. Please refer to the [MISP Galaxy
|
||||
](https://github.com/MISP/misp-galaxy) for more information. **MITRE ATT&CK** is for example completely available through MISPGalaxy entities (see use-cases for an example)
|
||||
|
||||
# Use Cases
|
||||
## Transform on existing data
|
||||
TODO
|
||||
## Transform from MISP Event ID
|
||||
TODO
|
||||
## Transform from Galaxy
|
||||
TODO
|
||||
## Visualise MITRE ATT&CK
|
||||
TODO
|
13
setup.py
13
setup.py
|
@ -7,11 +7,24 @@ setup(
|
|||
author='Christophe Vandeplas',
|
||||
version='1.0',
|
||||
author_email='christophe@vandeplas.com',
|
||||
maintainer='Christophe Vandeplas',
|
||||
url='https://github.com/MISP/MISP-maltego',
|
||||
description='Maltego transform for interacting with a MISP Threat Sharing community.',
|
||||
license='AGPLv3',
|
||||
packages=find_packages('src'),
|
||||
package_dir={'': 'src'},
|
||||
zip_safe=False,
|
||||
classifiers=[
|
||||
'License :: OSI Approved :: GNU Affero General Public License v3',
|
||||
'Development Status :: 4 - Beta',
|
||||
'Operating System :: POSIX :: Linux',
|
||||
'Intended Audience :: Science/Research',
|
||||
'Intended Audience :: Telecommunications Industry',
|
||||
'Intended Audience :: Information Technology',
|
||||
'Programming Language :: Python :: 3',
|
||||
'Topic :: Security',
|
||||
'Topic :: Internet',
|
||||
],
|
||||
package_data={
|
||||
'': ['*.gif', '*.png', '*.conf', '*.mtz', '*.machine'] # list of resources
|
||||
},
|
||||
|
|
Loading…
Reference in New Issue