MISP
/
PyMISP
mirror of https://github.com/MISP/PyMISP
2
0
Fork 0
Code Issues Releases Wiki Activity

chg: [last] You can now paginate over multiple results in the last example command 

You can do stuff like this:

python3 last.py  -l 48h  -m 10 -p 2  | jq .[].Event.info

which means the last 10 events on second page which are between a
time range of 0 and 48 hours.
pull/418/head
Alexandre Dulaunoy 2019-06-24 15:55:01 +02:00
parent db9824c4bc
commit 3e70a90b0d
No known key found for this signature in database
GPG Key ID: 09E2CD4944E6CBCD
1 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
examples/last.py
View File

@ -9,14 +9,14 @@ import json
# Usage for pipe masters: ./last.py -l 5h | jq .
# Usage in case of large data set and pivoting page by page: python3 last.py -l 48h -m 10 -p 2 | jq .[].Event.info
def init(url, key):
return PyMISP(url, key, misp_verifycert, 'json')
def download_last(m, last, out=None):
result = m.download_last(last)
def download_last(m, last, limit='10', page='1', out=None):
result = m.search(last=last, limit=limit, page=page)
if out is None:
if 'response' in result:
print(json.dumps(result['response']))
@ -30,14 +30,16 @@ def download_last(m, last, out=None):
if __name__ == '__main__':
parser = argparse.ArgumentParser(description='Download latest events from a MISP instance.')
parser.add_argument("-l", "--last", required=True, help="can be defined in days, hours, minutes (for example 5d or 12h or 30m).")
parser.add_argument("-m", "--limit", required=False, default="10", help="Add the limit of records to get (by default, the limit is set to 10)")
parser.add_argument("-p", "--page", required=False, default="1", help="Add the page to request to paginate over large dataset (by default page is set to 1)")
parser.add_argument("-o", "--output", help="Output file")
args = parser.parse_args()
if args.output is not None and os.path.exists(args.output):
print('Output file already exists, abord.')
print('Output file already exists, aborted.')
exit(0)
misp = init(misp_url, misp_key)
download_last(misp, args.last, args.output)
download_last(misp, args.last, limit=args.limit, page=args.page, out=args.output)