diff --git a/examples/sighting.json b/examples/sighting.json new file mode 100644 index 0000000..9191a5b --- /dev/null +++ b/examples/sighting.json @@ -0,0 +1,2 @@ +{"values":["www.google.com", "8.8.8.8"], "timestamp":1460558710} + diff --git a/examples/sighting.py b/examples/sighting.py new file mode 100644 index 0000000..433c2c2 --- /dev/null +++ b/examples/sighting.py @@ -0,0 +1,27 @@ +#!/usr/bin/env python +# -*- coding: utf-8 -*- + +from pymisp import PyMISP +from keys import misp_url, misp_key +import argparse + +# For python2 & 3 compat, a bit dirty, but it seems to be the least bad one +try: + input = raw_input +except NameError: + pass + + +def init(url, key): + return PyMISP(url, key, True, 'json') + +if __name__ == '__main__': + parser = argparse.ArgumentParser(description='Add sighting.') + parser.add_argument("-f", "--json_file", help="The name of the json file describing the attribute you want to add sighting to.") + args = parser.parse_args() + + misp = init(misp_url, misp_key) + + misp.sighting_per_json(args.json_file) + + diff --git a/pymisp/api.py b/pymisp/api.py index 7bf9f61..9022d34 100644 --- a/pymisp/api.py +++ b/pymisp/api.py @@ -990,9 +990,26 @@ class PyMISP(object): url = urljoin(self.root_url, 'attributes/attributeStatistics/{}/{}'.format(context, percentage)) else: url = urljoin(self.root_url, 'attributes/attributeStatistics/{}'.format(context)) - print(url) return session.get(url).json() + # ############## Sightings ################## + + def sighting_per_id(self, attribute_id, force_out=None): + session = self.__prepare_session(force_out) + url = urljoin(self.root_url, 'sightings/add/{}'.format(attribute_id)) + return session.post(url) + + def sighting_per_uuid(self, attribute_uuid, force_out=None): + session = self.__prepare_session(force_out) + url = urljoin(self.root_url, 'sightings/add/{}'.format(attribute_uuid)) + return session.post(url) + + def sighting_per_json(self, json_file, force_out=None): + session = self.__prepare_session(force_out) + jdata = json.load(open(json_file)) + url = urljoin(self.root_url, 'sightings/add/') + return session.post(url, data=json.dumps(jdata)) + # ############## Deprecated (Pure XML API should not be used) ################## @deprecated def download_all(self):