mirror of https://github.com/MISP/PyMISP
chg: Fixes & update Jupyter
parent
c2f7c01b5d
commit
3113fcad55
|
@ -787,7 +787,7 @@
|
||||||
"name": "python",
|
"name": "python",
|
||||||
"nbconvert_exporter": "python",
|
"nbconvert_exporter": "python",
|
||||||
"pygments_lexer": "ipython3",
|
"pygments_lexer": "ipython3",
|
||||||
"version": "3.6.5"
|
"version": "3.6.7"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"nbformat": 4,
|
"nbformat": 4,
|
||||||
|
|
|
@ -22,10 +22,10 @@
|
||||||
"outputs": [],
|
"outputs": [],
|
||||||
"source": [
|
"source": [
|
||||||
"# The URL of the MISP instance to connect to\n",
|
"# The URL of the MISP instance to connect to\n",
|
||||||
"misp_url = 'http://127.0.0.1:9090/'\n",
|
"misp_url = 'http://127.0.0.1:8080/'\n",
|
||||||
"# Can be found in the MISP web interface under \n",
|
"# Can be found in the MISP web interface under \n",
|
||||||
"# http://+MISP_URL+/users/view/me -> Authkey\n",
|
"# http://+MISP_URL+/users/view/me -> Authkey\n",
|
||||||
"misp_key = 'btm3o1j6SzKUEsHiNz0vTMYzPfcc5eIKpfaWFADj'\n",
|
"misp_key = 'BSip0zVadeFDeolkX2g7MHx8mrlr0uE04hh6CQj0'\n",
|
||||||
"# Should PyMISP verify the MISP certificate\n",
|
"# Should PyMISP verify the MISP certificate\n",
|
||||||
"misp_verifycert = False"
|
"misp_verifycert = False"
|
||||||
]
|
]
|
||||||
|
@ -67,9 +67,10 @@
|
||||||
"metadata": {},
|
"metadata": {},
|
||||||
"outputs": [],
|
"outputs": [],
|
||||||
"source": [
|
"source": [
|
||||||
"from pymisp import PyMISP\n",
|
"from pymisp import ExpandedPyMISP, PyMISP\n",
|
||||||
"\n",
|
"\n",
|
||||||
"misp = PyMISP(misp_url, misp_key, misp_verifycert)"
|
"misp = ExpandedPyMISP(misp_url, misp_key, misp_verifycert)\n",
|
||||||
|
"misp_old = PyMISP(misp_url, misp_key, misp_verifycert)"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
|
@ -96,7 +97,7 @@
|
||||||
" threat_level_id=1,\n",
|
" threat_level_id=1,\n",
|
||||||
" analysis=1,\n",
|
" analysis=1,\n",
|
||||||
" info=\"Event from notebook\")\n",
|
" info=\"Event from notebook\")\n",
|
||||||
"print(\"Event id: %s\" % event['Event']['id'])"
|
"print(\"Event id: %s\" % event.id)"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
|
@ -120,7 +121,7 @@
|
||||||
"event_obj.analysis = 1\n",
|
"event_obj.analysis = 1\n",
|
||||||
"event_obj.info = \"Event from notebook 2\"\n",
|
"event_obj.info = \"Event from notebook 2\"\n",
|
||||||
"event = misp.add_event(event_obj)\n",
|
"event = misp.add_event(event_obj)\n",
|
||||||
"event_id = event['Event']['id']\n",
|
"event_id = event.id\n",
|
||||||
"print(\"Event id: %s\" % event_id)"
|
"print(\"Event id: %s\" % event_id)"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
|
@ -237,7 +238,7 @@
|
||||||
"source": [
|
"source": [
|
||||||
"# Add the attribute to the event\n",
|
"# Add the attribute to the event\n",
|
||||||
"## Fetch the event from MISP\n",
|
"## Fetch the event from MISP\n",
|
||||||
"event_dict = misp.get(event_id)['Event']\n",
|
"event_dict = misp_old.get(event_id)['Event']\n",
|
||||||
"\n",
|
"\n",
|
||||||
"## Convert it to a PyMISP Event\n",
|
"## Convert it to a PyMISP Event\n",
|
||||||
"event = MISPEvent()\n",
|
"event = MISPEvent()\n",
|
||||||
|
@ -248,7 +249,25 @@
|
||||||
"event.add_attribute(type='domain', value='circl.lu', disable_correlation=True)\n",
|
"event.add_attribute(type='domain', value='circl.lu', disable_correlation=True)\n",
|
||||||
"\n",
|
"\n",
|
||||||
"## Push the updated event to MISP\n",
|
"## Push the updated event to MISP\n",
|
||||||
"event_dict = misp.update(event)\n",
|
"event_dict = misp.update_event(event)\n",
|
||||||
|
"print(event_dict)"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"cell_type": "code",
|
||||||
|
"execution_count": null,
|
||||||
|
"metadata": {},
|
||||||
|
"outputs": [],
|
||||||
|
"source": [
|
||||||
|
"# New Python 3.6 API\n",
|
||||||
|
"event = misp.get(event_id)\n",
|
||||||
|
"\n",
|
||||||
|
"## Add the attribute to the event\n",
|
||||||
|
"event.add_attribute(**attribute)\n",
|
||||||
|
"event.add_attribute(type='domain', value='circl.lu', disable_correlation=True)\n",
|
||||||
|
"\n",
|
||||||
|
"## Push the updated event to MISP\n",
|
||||||
|
"event_dict = misp.update_event(event)\n",
|
||||||
"print(event_dict)"
|
"print(event_dict)"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
|
@ -273,8 +292,6 @@
|
||||||
"outputs": [],
|
"outputs": [],
|
||||||
"source": [
|
"source": [
|
||||||
"results = misp.search_index(eventinfo='notebook')\n",
|
"results = misp.search_index(eventinfo='notebook')\n",
|
||||||
"# The data is stored in the field 'response'\n",
|
|
||||||
"results = results['response']\n",
|
|
||||||
"\n",
|
"\n",
|
||||||
"for event in results:\n",
|
"for event in results:\n",
|
||||||
" print(event['id'], ':', event['info'])"
|
" print(event['id'], ':', event['info'])"
|
||||||
|
@ -304,12 +321,8 @@
|
||||||
"source": [
|
"source": [
|
||||||
"# Search attributes (specified in controller) where the attribute type is 'ip-src'\n",
|
"# Search attributes (specified in controller) where the attribute type is 'ip-src'\n",
|
||||||
"# And the to_ids flag is set\n",
|
"# And the to_ids flag is set\n",
|
||||||
"response = misp.search(controller='attributes', type_attribute='ip-src', to_ids=False)\n",
|
"attributes = misp.search(controller='attributes', type_attribute='ip-src', to_ids=0, pythonify=True)\n",
|
||||||
"# The data is stored in the field 'response'\n",
|
|
||||||
"results = response['response']\n",
|
|
||||||
"\n",
|
"\n",
|
||||||
"# Get all related event\n",
|
|
||||||
"attributes = results['Attribute']\n",
|
|
||||||
"event_ids = set()\n",
|
"event_ids = set()\n",
|
||||||
"for attr in attributes:\n",
|
"for attr in attributes:\n",
|
||||||
" event_ids.add(event_id)\n",
|
" event_ids.add(event_id)\n",
|
||||||
|
@ -317,7 +330,7 @@
|
||||||
"# Fetch all related events\n",
|
"# Fetch all related events\n",
|
||||||
"for event_id in event_ids:\n",
|
"for event_id in event_ids:\n",
|
||||||
" event = misp.get_event(event_id)\n",
|
" event = misp.get_event(event_id)\n",
|
||||||
" print(event['Event']['info'])"
|
" print(event.info)"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
|
@ -451,7 +464,7 @@
|
||||||
"name": "python",
|
"name": "python",
|
||||||
"nbconvert_exporter": "python",
|
"nbconvert_exporter": "python",
|
||||||
"pygments_lexer": "ipython3",
|
"pygments_lexer": "ipython3",
|
||||||
"version": "3.6.5"
|
"version": "3.6.7"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"nbformat": 4,
|
"nbformat": 4,
|
||||||
|
|
|
@ -498,7 +498,7 @@
|
||||||
"name": "python",
|
"name": "python",
|
||||||
"nbconvert_exporter": "python",
|
"nbconvert_exporter": "python",
|
||||||
"pygments_lexer": "ipython3",
|
"pygments_lexer": "ipython3",
|
||||||
"version": "3.6.5"
|
"version": "3.6.7"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"nbformat": 4,
|
"nbformat": 4,
|
||||||
|
|
|
@ -2258,7 +2258,7 @@ class PyMISP(object):
|
||||||
"""Returns the list of Object templates available on the MISP instance"""
|
"""Returns the list of Object templates available on the MISP instance"""
|
||||||
url = urljoin(self.root_url, 'objectTemplates')
|
url = urljoin(self.root_url, 'objectTemplates')
|
||||||
response = self._prepare_request('GET', url)
|
response = self._prepare_request('GET', url)
|
||||||
return self._check_response(response)['response']
|
return self._check_response(response)
|
||||||
|
|
||||||
def get_object_template_id(self, object_uuid):
|
def get_object_template_id(self, object_uuid):
|
||||||
"""Gets the template ID corresponting the UUID passed as parameter"""
|
"""Gets the template ID corresponting the UUID passed as parameter"""
|
||||||
|
|
Loading…
Reference in New Issue