diff --git a/examples/openioc_to_misp.py b/examples/openioc_to_misp.py new file mode 100755 index 0000000..0011e9c --- /dev/null +++ b/examples/openioc_to_misp.py @@ -0,0 +1,27 @@ +#!/usr/bin/env python +# -*- coding: utf-8 -*- + +import argparse + +from pymisp import PyMISP +from keys import misp_url, misp_key, misp_verifycert +from pymisp.tools import load_openioc_file + + +if __name__ == '__main__': + parser = argparse.ArgumentParser(description='Convert an OpenIOC file to a MISPEvent. Optionnaly send it to MISP.') + parser.add_argument("-i", "--input", required=True, help="Input file") + group = parser.add_mutually_exclusive_group(required=True) + group.add_argument("-o", "--output", help="Output file") + group.add_argument("-m", "--misp", action='store_true', help="Create new event on MISP") + + args = parser.parse_args() + + misp_event = load_openioc_file(args.input) + + if args.misp: + pymisp = PyMISP(misp_url, misp_key, misp_verifycert, debug=True) + pymisp.add_event(misp_event) + else: + with open(args.output, 'w') as f: + f.write(misp_event.to_json()) diff --git a/pymisp/tools/__init__.py b/pymisp/tools/__init__.py index e57c41a..b551432 100644 --- a/pymisp/tools/__init__.py +++ b/pymisp/tools/__init__.py @@ -7,3 +7,4 @@ from .machoobject import MachOObject, MachOSectionObject # noqa from .create_misp_object import make_binary_objects # noqa from .abstractgenerator import AbstractMISPObjectGenerator # noqa from .genericgenerator import GenericObjectGenerator # noqa +from .openioc import load_openioc, load_openioc_file # noqa