|Raphaël Vinot 12e05fd0ce||23 hours ago|
|docs||1 month ago|
|examples||23 hours ago|
|pymisp||4 days ago|
|tests||1 week ago|
|travis||1 month ago|
|.gitchangelog.rc||1 year ago|
|.gitignore||6 months ago|
|.gitmodules||6 months ago|
|.readthedocs.yml||1 year ago|
|.travis.yml||1 month ago|
|CHANGELOG.txt||4 days ago|
|LICENSE||5 years ago|
|MANIFEST.in||2 years ago|
|README.md||1 month ago|
|poetry.lock||4 days ago|
|pyproject.toml||4 days ago|
|setup.cfg||4 years ago|
|setup.py||1 month ago|
IMPORTANT NOTE: This library will require at least python 3.6 starting the 1st of January 2020. If you have to legacy versions of python, please use PyMISP v184.108.40.206, and consider updating your system(s). Anything released within the last 2 years will do, starting with Ubuntu 18.04.
PyMISP is a Python library to access MISP platforms via their REST API.
PyMISP allows you to fetch events, add or update events/attributes, add or update samples or search for attributes.
It is strongly recommended to use a virtual environment
If you want to know more about virtual environments, python has you covered
Only basic dependencies:
pip3 install pymisp
With optional dependencies:
pip3 install pymisp[fileobjects,openioc,virustotal]
Note: poetry is required
git clone https://github.com/MISP/PyMISP.git && cd PyMISP git submodule update --init poetry install -E fileobjects -E openioc -E virustotal -E docs -E pdfexport
poetry run nosetests-3.4 --with-coverage --cover-package=pymisp,tests --cover-tests tests/test_*.py
If you have a MISP instance to test against, you can also run the live ones:
Note: You need to update the key in
tests/testlive_comprehensive.py to the automation key of your admin account.
poetry run nosetests-3.4 --with-coverage --cover-package=pymisp,tests --cover-tests tests/testlive_comprehensive.py
Various examples and samples scripts are in the examples/ directory.
In the examples directory, you will need to change the keys.py.sample to enter your MISP url and API key.
cd examples cp keys.py.sample keys.py vim keys.py
The API key of MISP is available in the Automation section of the MISP web interface.
To test if your URL and API keys are correct, you can test with examples/last.py to fetch the events published in the last x amount of time (supported time indicators: days (d), hours (h) and minutes (m)). last.py
cd examples python3 last.py -l 10h # 10 hours python3 last.py -l 5d # 5 days python3 last.py -l 45m # 45 minutes
You have two options there:
PyMISP and it will enable logging.DEBUG to stderr on the whole module
Use the python logging module directly:
import logging logger = logging.getLogger('pymisp') # Configure it as you whish, for example, enable DEBUG mode: logger.setLevel(logging.DEBUG)
Or if you want to write the debug output to a file instead of stderr:
import pymisp import logging logger = logging.getLogger('pymisp') logging.basicConfig(level=logging.DEBUG, filename="debug.log", filemode='w', format=pymisp.FORMAT)
mispevent.pyis tested on every commit
# From poetry nosetests-3.4 -s --with-coverage --cover-package=pymisp,tests --cover-tests tests/testlive_comprehensive.py:TestComprehensive.[test_name]
Documentation can be generated with epydoc:
epydoc --url https://github.com/MISP/PyMISP --graph all --name PyMISP --pdf pymisp -o doc
A series of Jupyter notebooks for PyMISP tutorial are available in the repository.
... or at least everything that can be imported/exported from/to a json blob
AbstractMISP is the master class, and inherit
collections.MutableMapping which means
the class can be represented as a python dictionary.
The abstraction assumes every property that should not be seen in the dictionary is prepended with a
or its name is added to the private list
__not_jsonable (accessible through
This master class has helpers that will make it easy to load, and export, to, and from, a json string.
are subclasses of AbstractMISP, which mean that they can be handled as python dictionaries.
Creating a new MISP object generator should be done using a pre-defined template and inherit
Your new MISPObject generator need to generate attributes, and add them as class properties using
When the object is sent to MISP, all the class properties will be exported to the JSON export.