MISP
/
MISP-maltego
mirror of https://github.com/MISP/MISP-maltego
2
0
Fork 0
Code Issues Releases Wiki Activity
Set of Maltego transforms to inferface with a MISP Threat Sharing instance, and also to explore the whole MITRE ATT&CK dataset.
7 Commits
2 Branches
7 Tags
5 MiB
Python 97.6%
Dockerfile 2.3%
Shell 0.1%
 
 
 
Go to file
deresz 59a0ba7496 Config package and icons from tom.king2<at>baesystems.com 
new file:   MISP_Config.mtz
 		2016-02-25 23:16:29 +01:00
LICENSE Initial commit 2016-02-20 16:51:49 +01:00
MISP_Config.mtz Config package and icons from tom.king2<at>baesystems.com 2016-02-25 23:16:29 +01:00
MaltegoTransform.py Added files via upload 2016-02-20 16:58:38 +01:00
README.md Update README.md 2016-02-20 17:09:43 +01:00
misp_domain2event.py Added files via upload 2016-02-20 16:58:38 +01:00
misp_event2domain.py Added files via upload 2016-02-20 16:58:38 +01:00
misp_getEventInfo.py Added files via upload 2016-02-20 16:58:38 +01:00
misp_util.py To make it working with 2.4 2016-02-21 17:40:37 +01:00

README.md

MISP-Maltego

Set of Maltego transforms to inferface with a MISP instance

Prerequisites

  • MISP instance API access
  • PyMISP

INSTALL

  • Edit misp_util.py and set BASE_URL and API_KEY variables with your MISP base URL and MISP API key.

  • Create symbolic links to misp_domain2event.py and misp_event2domain.py in the same directory.

for i in misp_email2event.py misp_email-subject2event.py misp_ip2event.py misp_hash2event.py ; do ln -s misp_domain2event.py $i; done for i in misp_event2email.py misp_event2email-subject.py misp_event2hash.py misp_event2ip.py ; do ln -s misp_event2domain.py $i; done


- Import transforms in Maltego as follow (for instance):

  * misp_ip2event.py: [MISP] IP to Event / Returns MISPEvent entities containing the corresponding IP attribute
  * misp_domain2event.py: [MISP] Domain to Event / Returns MISPEvent entities containing the corresponding Domain attribute
  * misp_hash2event.py: [MISP] Hash to Event / Returns MISPEvent entities containing the corresponding Hash attribute
  * misp_email2event.py: [MISP] Email address to Event / Returns MISPEvent entities containing the corresponding Email address attribute
  * misp_email-subject2event.py: [MISP] Email subject to Event / Returns MISPEvent entities containing the corresponding Email subject attribute
  * misp_event2ip.py: [MISP] Event to IP attribute / Returns the IP attributes belonging to an event
  * misp_event2domain.py: [MISP] Event to Domain attribute / Returns Domain attributes belonging to an event
  * misp_event2hash.py: [MISP] Event to Hash attribute / Returns Hash attributes belonging to an event
  * misp_event2email.py: [MISP] Event to Email address attribute / Returns Email address attributes belonging to an event
  * misp_event2email-subject.py: [MISP] Event to Email subject attribute / Returns Email subject attributes belonging to an event
  * misp_getEventInfo.py: [MISP] Get Event Info / Adorns the Event with Info as notes