2016-10-22 14:52:17 +02:00
|
|
|
#!/usr/bin/env python
|
|
|
|
# -*- coding: utf-8 -*-
|
|
|
|
|
2019-07-17 16:46:47 +02:00
|
|
|
from pymisp import ExpandedPyMISP
|
2018-10-14 19:26:03 +02:00
|
|
|
from keys import misp_url, misp_key, misp_verifycert
|
2016-10-22 14:52:17 +02:00
|
|
|
import argparse
|
|
|
|
|
|
|
|
# For python2 & 3 compat, a bit dirty, but it seems to be the least bad one
|
|
|
|
try:
|
|
|
|
input = raw_input
|
|
|
|
except NameError:
|
|
|
|
pass
|
|
|
|
|
|
|
|
|
|
|
|
if __name__ == '__main__':
|
2018-03-26 17:37:02 +02:00
|
|
|
parser = argparse.ArgumentParser(description='Add an attribute to an event')
|
|
|
|
parser.add_argument("-e", "--event", help="The id, uuid or json of the event to update.")
|
2016-10-22 14:52:17 +02:00
|
|
|
parser.add_argument("-t", "--type", help="The type of the added attribute")
|
|
|
|
parser.add_argument("-v", "--value", help="The value of the attribute")
|
|
|
|
args = parser.parse_args()
|
|
|
|
|
2019-07-17 16:46:47 +02:00
|
|
|
misp = ExpandedPyMISP(misp_url, misp_key, misp_verifycert)
|
2016-10-22 14:52:17 +02:00
|
|
|
|
2019-07-17 16:46:47 +02:00
|
|
|
event = misp.add_attribute(args.event, {'type': args.type, 'value': args.value}, pythonify=True)
|
2016-10-22 14:52:17 +02:00
|
|
|
print(event)
|