diff --git a/docs/tutorial/Usage-NG.ipynb b/docs/tutorial/Usage-NG.ipynb index a0479c6..c3a4eac 100644 --- a/docs/tutorial/Usage-NG.ipynb +++ b/docs/tutorial/Usage-NG.ipynb @@ -23,7 +23,7 @@ "misp_url = 'http://127.0.0.1:8080'\n", "# Can be found in the MISP web interface under \n", "# http://+MISP_URL+/users/view/me -> Authkey\n", - "misp_key = 'LBelWqKY9SQyG0huZzAMqiEBl6FODxpgRRXMsZFu'\n", + "misp_key = 'aJAmQQoBhVL5jqUDSucIkPrEYIbFyW0wwQnxyBfc'\n", "# Should PyMISP verify the MISP certificate\n", "misp_verifycert = False" ] @@ -87,10 +87,11 @@ }, "outputs": [], "source": [ - "response = misp.search(publish_timestamp='2h')\n", + "response = misp.search(publish_timestamp='2d')\n", "\n", + "print (response)\n", "events = []\n", - "for event in response['response']:\n", + "for event in response:\n", " me = MISPEvent()\n", " me.load(event)\n", " events.append(me)\n", @@ -133,7 +134,7 @@ "response = misp.search(timestamp=ts-36000)\n", "\n", "events = []\n", - "for event in response['response']:\n", + "for event in response:\n", " me = MISPEvent()\n", " me.load(event)\n", " events.append(me)\n", @@ -179,10 +180,10 @@ "metadata": {}, "outputs": [], "source": [ - "response = misp.search(controller='attributes', publish_timestamp='1h')\n", + "response = misp.search(controller='attributes', publish_timestamp='1d')\n", "\n", "attributes = []\n", - "for attribute in response['response']['Attribute']:\n", + "for attribute in response['Attribute']:\n", " ma = MISPAttribute()\n", " ma.from_dict(**attribute)\n", " attributes.append(ma)\n", @@ -197,10 +198,10 @@ "metadata": {}, "outputs": [], "source": [ - "response = misp.search(controller='attributes', publish_timestamp=['2h', '1h'])\n", + "response = misp.search(controller='attributes', publish_timestamp=['2d', '1h'])\n", "\n", "attributes = []\n", - "for attribute in response['response']['Attribute']:\n", + "for attribute in response['Attribute']:\n", " ma = MISPAttribute()\n", " ma.from_dict(**attribute)\n", " attributes.append(ma)\n", @@ -229,7 +230,7 @@ "response = misp.search(controller='attributes', timestamp=ts - 36000)\n", "\n", "attributes = []\n", - "for attribute in response['response']['Attribute']:\n", + "for attribute in response['Attribute']:\n", " ma = MISPAttribute()\n", " ma.from_dict(**attribute)\n", " attributes.append(ma)\n", @@ -256,7 +257,7 @@ "response = misp.search_index(eventinfo='Cobalt Strike')\n", "\n", "events = []\n", - "for event in response['response']:\n", + "for event in response:\n", " me = MISPEvent()\n", " me.from_dict(**event)\n", " events.append(me)\n", @@ -280,10 +281,10 @@ "metadata": {}, "outputs": [], "source": [ - "response = misp.search_index(tag='malware_classification:malware-category=\"Ransomware\"')\n", + "response = misp.search_index(tags='malware_classification:malware-category=\"Ransomware\"')\n", "\n", "events = []\n", - "for event in response['response']:\n", + "for event in response:\n", " me = MISPEvent()\n", " me.from_dict(**event)\n", " events.append(me)\n", @@ -303,7 +304,7 @@ "response = misp.search_index(timestamp='1h')\n", "\n", "events = []\n", - "for event in response['response']:\n", + "for event in response:\n", " me = MISPEvent()\n", " me.from_dict(**event)\n", " events.append(me)\n", @@ -328,8 +329,9 @@ "outputs": [], "source": [ "event = MISPEvent()\n", - "event.load(misp.get(events[0].id))\n", - "print(event.to_json())" + "#event.load(misp.get(events[0].id))\n", + "print (misp.get(events[0].id))\n", + "#print(event.to_json())" ] }, { @@ -345,7 +347,7 @@ "metadata": {}, "outputs": [], "source": [ - "complex_query = misp.build_complex_query(or_parameters=['59.157.4.2', 'hotfixmsupload.com'])\n", + "complex_query = misp.build_complex_query(or_parameters=['59.157.4.2', 'hotfixmsupload.com', '8.8.8.8'])\n", "events = misp.search(value=complex_query, pythonify=True)\n", "\n", "for e in events:\n", @@ -365,7 +367,7 @@ "metadata": {}, "outputs": [], "source": [ - "misp.sighting(value=e.attributes[3].value)" + "misp.sighting(value=e.attributes[1].value)" ] }, { @@ -374,7 +376,7 @@ "metadata": {}, "outputs": [], "source": [ - "misp.sighting_list(e.attributes[3].id)" + "misp.sighting_list(e.attributes[1].id)" ] }, {