diff --git a/docs/tutorial/PyMISP_tutorial.ipynb b/docs/tutorial/PyMISP_tutorial.ipynb new file mode 100644 index 0000000..af84d24 --- /dev/null +++ b/docs/tutorial/PyMISP_tutorial.ipynb @@ -0,0 +1,448 @@ +{ + "cells": [ + { + "cell_type": "markdown", + "metadata": {}, + "source": [ + "# PyMISP - An interactive tutorial: Basics" + ] + }, + { + "cell_type": "markdown", + "metadata": {}, + "source": [ + "## Connecting to MISP\n", + "### Your configuration" + ] + }, + { + "cell_type": "code", + "execution_count": 3, + "metadata": {}, + "outputs": [], + "source": [ + "# The URL of the MISP instance to connect to\n", + "misp_url = 'http://127.0.0.1:9090/'\n", + "# Can be found in the MISP web interface under \n", + "# http://+MISP_URL+/users/view/me -> Authkey\n", + "misp_key = 'btm3o1j6SzKUEsHiNz0vTMYzPfcc5eIKpfaWFADj'\n", + "# Should PyMISP verify the MISP certificate\n", + "misp_verifycert = False" + ] + }, + { + "cell_type": "code", + "execution_count": 4, + "metadata": {}, + "outputs": [], + "source": [ + "from pymisp import PyMISP\n", + "\n", + "misp = PyMISP(misp_url, misp_key, misp_verifycert)" + ] + }, + { + "cell_type": "markdown", + "metadata": {}, + "source": [ + "## Creating a MISP Event" + ] + }, + { + "cell_type": "markdown", + "metadata": {}, + "source": [ + "### Directly" + ] + }, + { + "cell_type": "code", + "execution_count": 3, + "metadata": {}, + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "Event id: 16\n" + ] + } + ], + "source": [ + "event = misp.new_event(distribution=1,\n", + " threat_level_id=1,\n", + " analysis=1,\n", + " info=\"Event from notebook\")\n", + "print(\"Event id: %s\" % event['Event']['id'])" + ] + }, + { + "cell_type": "markdown", + "metadata": {}, + "source": [ + "### Using the MISPEvent constructor" + ] + }, + { + "cell_type": "code", + "execution_count": 4, + "metadata": {}, + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "Event id: 17\n" + ] + } + ], + "source": [ + "from pymisp import MISPEvent\n", + "\n", + "event_obj = MISPEvent()\n", + "event_obj.distribution = 1\n", + "event_obj.threat_level_id = 1\n", + "event_obj.analysis = 1\n", + "event_obj.info = \"Event from notebook 2\"\n", + "event = misp.add_event(event_obj)\n", + "event_id = event['Event']['id']\n", + "print(\"Event id: %s\" % event_id)" + ] + }, + { + "cell_type": "markdown", + "metadata": {}, + "source": [ + "## Fetching a MISP Event" + ] + }, + { + "cell_type": "code", + "execution_count": 9, + "metadata": {}, + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "{'Event': {'attribute_count': '1', 'published': False, 'orgc_id': '1', 'disable_correlation': False, 'id': '17', 'Orgc': {'uuid': '5aa4dd31-42e0-4ebb-a65f-776c88efcce7', 'id': '1', 'name': 'ORGNAME'}, 'ShadowAttribute': [], 'threat_level_id': '1', 'info': 'Event from notebook 2', 'analysis': '1', 'date': '2018-03-28', 'org_id': '1', 'publish_timestamp': '0', 'uuid': '5abb3fc8-8b04-4f1f-9454-0eba0a00020f', 'Org': {'uuid': '5aa4dd31-42e0-4ebb-a65f-776c88efcce7', 'id': '1', 'name': 'ORGNAME'}, 'sharing_group_id': '0', 'distribution': '1', 'Attribute': [{'ShadowAttribute': [], 'uuid': '5abb4064-23e8-4087-83ed-0cba0a00020f', 'category': 'Network activity', 'event_id': '17', 'deleted': False, 'disable_correlation': False, 'id': '4928', 'sharing_group_id': '0', 'object_id': '0', 'distribution': '5', 'type': 'ip-src', 'to_ids': False, 'timestamp': '1522221156', 'value': '8.8.8.8', 'comment': '', 'object_relation': None}], 'proposal_email_lock': False, 'locked': False, 'RelatedEvent': [{'Event': {'published': False, 'uuid': '5aa8b0e7-7424-4747-8592-17acc0a83865', 'Org': {'uuid': '5aa4dd31-42e0-4ebb-a65f-776c88efcce7', 'id': '1', 'name': 'ORGNAME'}, 'analysis': '1', 'distribution': '1', 'Orgc': {'uuid': '5aa4dd31-42e0-4ebb-a65f-776c88efcce7', 'id': '1', 'name': 'ORGNAME'}, 'orgc_id': '1', 'threat_level_id': '1', 'id': '9', 'info': 'Event from notebook 2', 'date': '2018-03-14', 'org_id': '1', 'timestamp': '1522058405'}}, {'Event': {'published': False, 'uuid': '5aa63a59-25a4-4cf9-bd93-024dc0a83865', 'Org': {'uuid': '5aa4dd31-42e0-4ebb-a65f-776c88efcce7', 'id': '1', 'name': 'ORGNAME'}, 'analysis': '0', 'distribution': '0', 'Orgc': {'uuid': '5aa4dd31-42e0-4ebb-a65f-776c88efcce7', 'id': '1', 'name': 'ORGNAME'}, 'orgc_id': '1', 'threat_level_id': '3', 'id': '1', 'info': 'Test event', 'date': '2018-03-12', 'org_id': '1', 'timestamp': '1520991310'}}], 'timestamp': '1522221156', 'event_creator_email': 'admin@admin.test', 'Galaxy': [], 'Object': []}}\n" + ] + } + ], + "source": [ + "# Fetch by ID\n", + "event = misp.get_event(event_id)\n", + "print(event)" + ] + }, + { + "cell_type": "markdown", + "metadata": {}, + "source": [ + "## Adding Attribute to an event" + ] + }, + { + "cell_type": "markdown", + "metadata": {}, + "source": [ + "### Adding directly" + ] + }, + { + "cell_type": "code", + "execution_count": 10, + "metadata": {}, + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "[{'errors': {'value': ['A similar attribute already exists for this event.']}, 'message': 'Could not add Attribute', 'url': '/attributes/add', 'name': 'Could not add Attribute'}]\n" + ] + } + ], + "source": [ + "attr_type = \"ip-src\"\n", + "value = \"8.8.8.8\"\n", + "category = \"Network activity\"\n", + "to_ids = False\n", + "proposal = False\n", + "updated_event = misp.add_named_attribute(event,\n", + " attr_type,\n", + " value,\n", + " category=category,\n", + " to_ids=to_ids,\n", + " proposal=proposal)\n", + "print(updated_event)" + ] + }, + { + "cell_type": "markdown", + "metadata": {}, + "source": [ + "### Using the MISPAttribute constructor" + ] + }, + { + "cell_type": "code", + "execution_count": 11, + "metadata": {}, + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "