mirror of https://github.com/MISP/PyMISP
				
				
				
			Neo4j stuff moved into graphdb directory
							parent
							
								
									bbf9198787
								
							
						
					
					
						commit
						55b4a0725b
					
				|  | @ -0,0 +1,45 @@ | |||
| #!/usr/bin/env python | ||||
| # -*- coding: utf-8 -*- | ||||
| 
 | ||||
| from pymisp import PyMISP | ||||
| from pymisp import Neo4j | ||||
| from pymisp import MISPEvent | ||||
| from keys import misp_url, misp_key | ||||
| import argparse | ||||
| 
 | ||||
| """ | ||||
| Sample Neo4J query: | ||||
| 
 | ||||
| 
 | ||||
| MATCH ()-[r:has]->(n) | ||||
| WITH n, count(r) as rel_cnt | ||||
| WHERE rel_cnt > 5 | ||||
| MATCH (m)-[r:has]->(n) | ||||
| RETURN m, n LIMIT 200; | ||||
| """ | ||||
| 
 | ||||
| if __name__ == '__main__': | ||||
|     parser = argparse.ArgumentParser(description='Get all the events matching a value.') | ||||
|     parser.add_argument("-s", "--search", required=True, help="String to search.") | ||||
|     parser.add_argument("--host", default='localhost:7474', help="Host where neo4j is running.") | ||||
|     parser.add_argument("-u", "--user", default='neo4j', help="User on neo4j.") | ||||
|     parser.add_argument("-p", "--password", default='neo4j', help="Password on neo4j.") | ||||
|     parser.add_argument("-d", "--deleteall", action="store_true", default=False, help="Delete all nodes from the database") | ||||
|     args = parser.parse_args() | ||||
| 
 | ||||
|     neo4j = Neo4j(args.host, args.user, args.password) | ||||
|     if args.deleteall: | ||||
|         neo4j.del_all() | ||||
|     misp = PyMISP(misp_url, misp_key) | ||||
|     result = misp.search_all(args.search) | ||||
|     for json_event in result['response']: | ||||
|         if not json_event['Event']: | ||||
|             print(json_event) | ||||
|             continue | ||||
|         print('Importing', json_event['Event']['info'], json_event['Event']['id']) | ||||
|         try: | ||||
|             misp_event = MISPEvent() | ||||
|             misp_event.load(json_event) | ||||
|             neo4j.import_event(misp_event) | ||||
|         except: | ||||
|             print('broken') | ||||
		Loading…
	
		Reference in New Issue