Fix examples after removal of MISP XML support

pull/30/head
Raphaël Vinot 2016-09-12 12:53:58 +02:00
parent 63270d6eaa
commit bf5793992b
6 changed files with 43 additions and 60 deletions

View File

@ -27,25 +27,14 @@ def init(cert_to_priv=True):
destination = PyMISP(url_cert, cert, cert_cert, 'xml') destination = PyMISP(url_cert, cert, cert_cert, 'xml')
def _to_utf8(request):
to_return = None
if 'json' in request.headers['content-type']:
to_return = request.json()
else:
to_return = request.text.encode('utf-8')
return to_return
def copy_event(event_id): def copy_event(event_id):
r_src = source.get_event(event_id) e = source.get_event(event_id)
to_send = _to_utf8(r_src) return destination.add_event(e)
return destination.add_event(to_send)
def update_event(event_id, event_to_update): def update_event(event_id, event_to_update):
r_src = source.get_event(event_id) e = source.get_event(event_id)
to_send = _to_utf8(r_src) return destination.update_event(event_to_update, e)
return destination.update_event(event_to_update, to_send)
def list_copy(filename): def list_copy(filename):
@ -83,7 +72,7 @@ def copy(eventid):
def export_our_org(): def export_our_org():
circl = source.search(org='CIRCL') circl = source.search(org='CIRCL')
return _to_utf8(circl) return circl
if __name__ == '__main__': if __name__ == '__main__':
import argparse import argparse

View File

@ -34,13 +34,13 @@ def init():
valid_attribute_distributions = valid_attribute_distribution_levels valid_attribute_distributions = valid_attribute_distribution_levels
except: except:
valid_attribute_distributions = ['0', '1', '2', '3', '4', '5'] valid_attribute_distributions = ['0', '1', '2', '3', '4', '5']
return PyMISP(url, key, ssl, 'json') return PyMISP(url, key, ssl)
def saveEvent(misp, uuid): def saveEvent(misp, uuid):
event = misp.get_event(uuid) event = misp.get_event(uuid)
if not event.json().get('Event'): if not event.get('Event'):
print('Error while fetching event: {}'.format(event.json()['message'])) print('Error while fetching event: {}'.format(event['message']))
sys.exit('Could not create file for event ' + uuid + '.') sys.exit('Could not create file for event ' + uuid + '.')
event = __cleanUpEvent(event) event = __cleanUpEvent(event)
event = json.dumps(event) event = json.dumps(event)
@ -50,7 +50,7 @@ def saveEvent(misp, uuid):
def __cleanUpEvent(event): def __cleanUpEvent(event):
temp = event.json() temp = event
event = {'Event': {}} event = {'Event': {}}
__cleanupEventFields(event, temp) __cleanupEventFields(event, temp)
__cleanupEventObjects(event, temp) __cleanupEventObjects(event, temp)
@ -120,10 +120,12 @@ def __addEventToManifest(event):
if __name__ == '__main__': if __name__ == '__main__':
misp = init() misp = init()
result = misp.get_index(None, filters)
try: try:
events = result.json() r = misp.get_index(filters)
except: events = r['response']
print(events[0])
except Exception as e:
print(e)
sys.exit("Invalid response received from MISP.") sys.exit("Invalid response received from MISP.")
if len(events) == 0: if len(events) == 0:
sys.exit("No events returned.") sys.exit("No events returned.")

View File

@ -48,41 +48,34 @@ def get_event(event_id):
event_id = int(event_id) event_id = int(event_id)
if event_id > 0: if event_id > 0:
event = source.get_event(event_id) event_json = source.get_event(event_id)
if event.status_code == 200: event_core = event_json["Event"]
# event_threatlevel_id = event_core["threat_level_id"]
try: # attribute_count = event_core["attribute_count"]
event_json = event.json() attribute = event_core["Attribute"]
except:
return False
event_core = event_json["Event"] for attribute in event_core["Attribute"]:
# event_threatlevel_id = event_core["threat_level_id"] if app_ids_only and not attribute["to_ids"]:
continue
# attribute_count = event_core["attribute_count"] value = attribute["value"]
attribute = event_core["Attribute"] title = event_core["info"]
if app_netflow:
for attribute in event_core["Attribute"]: app_printcomment = False
if app_ids_only and not attribute["to_ids"]: if attribute["type"] == "ip-dst" and app_ip_dst:
continue network_ip_dst.append([build_entry(value, event_id, title, "ip-dst")])
else:
value = attribute["value"] if attribute["type"] == "ip-src" and app_ip_src:
title = event_core["info"] network_ip_src.append([build_entry(value, event_id, title, "ip-src")])
if app_netflow: elif attribute["type"] == "ip-dst" and app_ip_dst:
app_printcomment = False network_ip_dst.append([build_entry(value, event_id, title, "ip-dst")])
if attribute["type"] == "ip-dst" and app_ip_dst: elif attribute["type"] == "domain" and app_domain:
network_ip_dst.append([build_entry(value, event_id, title, "ip-dst")]) network_domain.append([build_entry(value, event_id, title, "domain")])
elif attribute["type"] == "hostname" and app_hostname:
network_hostname.append([build_entry(value, event_id, title, "hostname")])
else: else:
if attribute["type"] == "ip-src" and app_ip_src: continue
network_ip_src.append([build_entry(value, event_id, title, "ip-src")])
elif attribute["type"] == "ip-dst" and app_ip_dst:
network_ip_dst.append([build_entry(value, event_id, title, "ip-dst")])
elif attribute["type"] == "domain" and app_domain:
network_domain.append([build_entry(value, event_id, title, "domain")])
elif attribute["type"] == "hostname" and app_hostname:
network_hostname.append([build_entry(value, event_id, title, "hostname")])
else:
continue
else: else:
print("Not a valid ID") print("Not a valid ID")
return return
@ -121,8 +114,8 @@ def print_events():
if firsthost: if firsthost:
firsthost = False firsthost = False
else: else:
print " or " print(" or ")
print "host %s" % ip[0] print("host %s" % ip[0])
else: else:
if app_ip_src: if app_ip_src:
for ip in network_ip_src: for ip in network_ip_src:

View File

@ -228,8 +228,7 @@ def push_event_to_misp(jsonEvent):
#################### ####################
# upload json event # upload json event
r = misp.add_event(jsonEvent) event = misp.add_event(jsonEvent)
event = r.json()
# save event id for file upload and tagg # save event id for file upload and tagg
iocDescriptions["misp_event_id"] = event["Event"]["id"] iocDescriptions["misp_event_id"] = event["Event"]["id"]

View File

@ -25,4 +25,4 @@ if __name__ == '__main__':
misp = init(misp_url, misp_key) misp = init(misp_url, misp_key)
stats = misp.get_tags_statistics(args.percentage, args.namesort) stats = misp.get_tags_statistics(args.percentage, args.namesort)
print json.dumps(stats) print(json.dumps(stats))

View File

@ -1138,7 +1138,7 @@ class PyMISP(object):
else: else:
name_sort = 'false' name_sort = 'false'
url = urljoin(self.root_url, 'tags/tagStatistics/{}/{}'.format(percentage, name_sort)) url = urljoin(self.root_url, 'tags/tagStatistics/{}/{}'.format(percentage, name_sort))
response = session.get(url).json() response = session.get(url)
return self._check_response(response) return self._check_response(response)
# ############## Sightings ################## # ############## Sightings ##################