MISP
/
PyMISP
mirror of https://github.com/MISP/PyMISP
2
0
Fork 0
Code Issues Releases Wiki Activity

chg: [jupyter] remove all the response key (as response is removing it)

pull/362/head
Alexandre Dulaunoy 2019-02-28 19:49:32 +01:00
parent c35a2aea55
commit 33186b6ec8
No known key found for this signature in database
GPG Key ID: 09E2CD4944E6CBCD
1 changed files with 20 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
docs/tutorial/Usage-NG.ipynb
View File

@ -23,7 +23,7 @@
"misp_url = 'http://127.0.0.1:8080'\n",
"# Can be found in the MISP web interface under \n",
"# http://+MISP_URL+/users/view/me -> Authkey\n",
"misp_key = 'LBelWqKY9SQyG0huZzAMqiEBl6FODxpgRRXMsZFu'\n",
"misp_key = 'aJAmQQoBhVL5jqUDSucIkPrEYIbFyW0wwQnxyBfc'\n",
"# Should PyMISP verify the MISP certificate\n",
"misp_verifycert = False"
]
@ -87,10 +87,11 @@
},
"outputs": [],
"source": [
"response = misp.search(publish_timestamp='2h')\n",
"response = misp.search(publish_timestamp='2d')\n",
"\n",
"print (response)\n",
"events = []\n",
"for event in response['response']:\n",
"for event in response:\n",
" me = MISPEvent()\n",
" me.load(event)\n",
" events.append(me)\n",
@ -133,7 +134,7 @@
"response = misp.search(timestamp=ts-36000)\n",
"\n",
"events = []\n",
"for event in response['response']:\n",
"for event in response:\n",
" me = MISPEvent()\n",
" me.load(event)\n",
" events.append(me)\n",
@ -179,10 +180,10 @@
"metadata": {},
"outputs": [],
"source": [
"response = misp.search(controller='attributes', publish_timestamp='1h')\n",
"response = misp.search(controller='attributes', publish_timestamp='1d')\n",
"\n",
"attributes = []\n",
"for attribute in response['response']['Attribute']:\n",
"for attribute in response['Attribute']:\n",
" ma = MISPAttribute()\n",
" ma.from_dict(**attribute)\n",
" attributes.append(ma)\n",
@ -197,10 +198,10 @@
"metadata": {},
"outputs": [],
"source": [
"response = misp.search(controller='attributes', publish_timestamp=['2h', '1h'])\n",
"response = misp.search(controller='attributes', publish_timestamp=['2d', '1h'])\n",
"\n",
"attributes = []\n",
"for attribute in response['response']['Attribute']:\n",
"for attribute in response['Attribute']:\n",
" ma = MISPAttribute()\n",
" ma.from_dict(**attribute)\n",
" attributes.append(ma)\n",
@ -229,7 +230,7 @@
"response = misp.search(controller='attributes', timestamp=ts - 36000)\n",
"\n",
"attributes = []\n",
"for attribute in response['response']['Attribute']:\n",
"for attribute in response['Attribute']:\n",
" ma = MISPAttribute()\n",
" ma.from_dict(**attribute)\n",
" attributes.append(ma)\n",
@ -256,7 +257,7 @@
"response = misp.search_index(eventinfo='Cobalt Strike')\n",
"\n",
"events = []\n",
"for event in response['response']:\n",
"for event in response:\n",
" me = MISPEvent()\n",
" me.from_dict(**event)\n",
" events.append(me)\n",
@ -280,10 +281,10 @@
"metadata": {},
"outputs": [],
"source": [
"response = misp.search_index(tag='malware_classification:malware-category=\"Ransomware\"')\n",
"response = misp.search_index(tags='malware_classification:malware-category=\"Ransomware\"')\n",
"\n",
"events = []\n",
"for event in response['response']:\n",
"for event in response:\n",
" me = MISPEvent()\n",
" me.from_dict(**event)\n",
" events.append(me)\n",
@ -303,7 +304,7 @@
"response = misp.search_index(timestamp='1h')\n",
"\n",
"events = []\n",
"for event in response['response']:\n",
"for event in response:\n",
" me = MISPEvent()\n",
" me.from_dict(**event)\n",
" events.append(me)\n",
@ -328,8 +329,9 @@
"outputs": [],
"source": [
"event = MISPEvent()\n",
"event.load(misp.get(events[0].id))\n",
"print(event.to_json())"
"#event.load(misp.get(events[0].id))\n",
"print (misp.get(events[0].id))\n",
"#print(event.to_json())"
]
},
{
@ -345,7 +347,7 @@
"metadata": {},
"outputs": [],
"source": [
"complex_query = misp.build_complex_query(or_parameters=['59.157.4.2', 'hotfixmsupload.com'])\n",
"complex_query = misp.build_complex_query(or_parameters=['59.157.4.2', 'hotfixmsupload.com', '8.8.8.8'])\n",
"events = misp.search(value=complex_query, pythonify=True)\n",
"\n",
"for e in events:\n",
@ -365,7 +367,7 @@
"metadata": {},
"outputs": [],
"source": [
"misp.sighting(value=e.attributes[3].value)"
"misp.sighting(value=e.attributes[1].value)"
]
},
{
@ -374,7 +376,7 @@
"metadata": {},
"outputs": [],
"source": [
"misp.sighting_list(e.attributes[3].id)"
"misp.sighting_list(e.attributes[1].id)"
]
},
{