Add Yara rules download support (by event)

examples/yara.py

@@ -0,0 +1,40 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+
+from pymisp import PyMISP
+from keys import url_priv, key_priv
+# from keys import url_cert, key_cert
+import argparse
+import os
+
+
+def init(url, key):
+    return PyMISP(url, key, True, 'json')
+
+
+def get_yara(m, event_id, out=None):
+    ok, rules = m.get_yara(event_id)
+    if not ok:
+        print(rules)
+    elif out is None:
+        print(rules)
+    else:
+        with open(out, 'w') as f:
+            f.write(rules)
+
+
+if __name__ == '__main__':
+    parser = argparse.ArgumentParser(description='Get yara rules from an event.')
+    parser.add_argument("-e", "--event", required=True, help="Event ID.")
+    parser.add_argument("-o", "--output", help="Output file")
+
+    args = parser.parse_args()
+
+    if args.output is not None and os.path.exists(args.output):
+        print('Output file already exists, abord.')
+        exit(0)
+
+    misp = init(url_priv, key_priv)
+    # misp = init(url_cert, key_cert)
+
+    get_yara(misp, args.event, args.output)

pymisp/api.py

@@ -295,6 +295,18 @@ class PyMISP(object):
         session = self.__prepare_session()
         return session.get(attach)
 
+    def get_yara(self, event_id):
+        to_post = {'request': {'eventid': event_id, 'type': 'yara'}}
+        session = self.__prepare_session()
+        response = session.post(urljoin(self.root_url, 'attributes/restSearch'), data=json.dumps(to_post))
+        result = response.json()
+        if response.status_code != 200:
+            return False, result.get('message')
+        if not result.get('response') and result.get('message'):
+            return False, result.get('message')
+        rules = '\n\n'.join([a['value'] for a in result['response']['Attribute']])
+        return True, rules
+
     def download_samples(self, sample_hash=None, event_id=None, all_samples=False):
         to_post = {'request': {'hash': sample_hash, 'eventID': event_id, 'allSamples': all_samples}}
         session = self.__prepare_session()

setup.py

@@ -4,7 +4,7 @@ from setuptools import setup
 
 setup(
     name='pymisp',
-    version='1.5',
+    version='1.6',
     author='Raphaël Vinot',
     author_email='raphael.vinot@circl.lu',
     maintainer='Raphaël Vinot',