Add search all

examples/searchall.py

@@ -0,0 +1,45 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+
+from pymisp import PyMISP
+from keys import url_priv, key_priv
+# from keys import url_cert, key_cert
+import argparse
+import os
+import json
+
+
+def init(url, key):
+    return PyMISP(url, key, True, 'json')
+
+
+def searchall(m, search, quiet, url, out=None):
+    result = m.search_all(search)
+    if quiet:
+        for e in result['response']:
+            print('{}{}{}\n'.format(url, '/events/view/', e['Event']['id']))
+    elif out is None:
+        for e in result['response']:
+            print(json.dumps(e) + '\n')
+    else:
+        with open(out, 'w') as f:
+            for e in result['response']:
+                f.write(json.dumps(e) + '\n')
+
+
+if __name__ == '__main__':
+    parser = argparse.ArgumentParser(description='Get all the events matching a value.')
+    parser.add_argument("-s", "--search", required=True, help="String to search.")
+    parser.add_argument("-q", "--quiet", action='store_true', help="Only display URLs to MISP")
+    parser.add_argument("-o", "--output", help="Output file")
+
+    args = parser.parse_args()
+
+    if args.output is not None and os.path.exists(args.output):
+        print('Output file already exists, abord.')
+        exit(0)
+
+    misp = init(url_priv, key_priv)
+    # misp = init(url_cert, key_cert)
+
+    searchall(misp, args.search, args.quiet, url_priv, args.output)

pymisp/api.py

@@ -200,6 +200,11 @@ class PyMISP(object):
 
     # ######## REST Search #########
 
+    def search_all(self, value):
+        query = {'value': value, 'searchall': 1}
+        session = self.__prepare_session()
+        return self.__query(session, 'restSearch/download', query)
+
     def __prepare_rest_search(self, values, not_values):
         """
             Prepare a search, generate the chain processed by the server

setup.py

@@ -4,7 +4,7 @@ from setuptools import setup
 
 setup(
     name='pymisp',
-    version='1.2',
+    version='1.3',
     author='Raphaël Vinot',
     author_email='raphael.vinot@circl.lu',
     maintainer='Raphaël Vinot',